Heatmap Privacy

Settings → Heatmap Privacy controls whether interaction heatmaps are captured, how long they're kept, and which page regions are masked from capture — keeping sensitive data out of session recordings.

Why it matters

Heatmaps record where customers click, move, and scroll so you can improve journey and page design. Because that capture can sweep up whatever is on screen — including names, card fields, and other personal data — these controls are how you keep recordings useful without retaining data you shouldn't. Tight retention and selector masking help you honor data-minimization expectations under regimes like GDPR/CCPA and keep payment fields out of recordings entirely.

Tenant defaults

• Capture heatmaps — turn capture on or off. When off, the recorder doesn't start in any journey player and ingestion rejects incoming events.

• Retention (days) — how long heatmap data is kept (min 1, max 365, default 90). Pruning runs daily and removes raw events and step snapshots older than this window.

• Masked selectors — CSS selectors (one per line) whose regions are excluded: pointer events on matching elements are dropped at capture time and their snapshot HTML is wiped before upload, so the data never leaves the visitor's browser.

Per-journey overrides & pruning

Override the defaults for a specific journey — additional masked selectors merge with the tenant list rather than replacing it, so a journey can only mask more, never less. You can also preview or trigger a retention prune for the tenant on demand.

How to use it

1. Add selectors for any payment, name, email, or other PII-bearing elements to Masked selectors before enabling capture broadly.

2. Set Retention to the shortest window that still serves your analysis.

3. Use per-journey overrides to mask extra regions on sensitive flows.

Gotchas

• Masking is selector-based — if a layout changes and a selector no longer matches, that region stops being masked. Re-check selectors after redesigns.

• Per-journey selectors only add to the tenant list; you can't un-mask something the tenant default masks.

• Tightening retention prunes older data on the next daily run — it isn't recoverable.