Data and privacy

Bug reports are most useful with context. Capture collects multiple data points to help debug issues on your website:

Attachments, such as screenshots and screen recordings, show what the user saw on the page.

Signals are what the application was doing. Capture records four kinds:

• Network signals - Requests made by your application, including their headers and bodies.
• Console signals - Messages logged to the browser console, along with uncaught errors.
• Activity signals - User actions such as clicks, form submissions, and page navigations.
• Resource signals - Assets loaded by the page, such as images, stylesheets and scripts.

Environment details such as the browser, operating system and screen size, along with any information you attach with identify or custom context.

The reporting window

Capture monitors the browser for signals while your webpage is open. When a new Capture is submitted, only the signals that occurred during the reporting window are uploaded.

• For screenshots, the reporting window is the 3 minutes before the screenshot was taken.
• For screen recordings, the reporting window is the duration of the recording.

Anything recorded outside of this window is not uploaded with the bug report and does not leave the user's browser.

Some of this may contain personal information that you do not wish to be shared.

Capture hides common kinds of sensitive data automatically, and gives you control over exactly what goes into your reports when the default configuration is not enough.

Hiding sensitive data

Some of the information that Capture records may contain sensitive details that you do not want included in your bug reports. Capture omits some kinds of sensitive data automatically:

• Sensitive form fields such as passwords, card numbers and one-time codes are blurred in screenshots and screen recordings when detected by auto-blur.
• Keystrokes and form input are not included in activity signals. We log which form fields were interacted with, but not what a user typed.
• Authorization headers and bearer tokens are removed from network signals before they are recorded.

Limiting what is sent

You can configure Capture per webpage to omit additional data specific to your application:

• Use Auto-blur to obscure elements and form fields in screenshots and screen recordings.
• Use Data transform to mask values, redact fields, or omit signals before they are recorded.

How we protect your data

For details of encryption, data location, retention, access control and our sub-processors, see data security.