Privacy masking & data attributes
How Spectry automatically masks sensitive data, and the data attributes you can use to control it.
Spectry is built to avoid capturing personal or sensitive data. Masking happens automatically, and you can fine-tune it with HTML attributes.
Automatic masking
- Input values are never captured by auto-capture or session replay — only field metadata (tag, name, type).
- Sensitive input types (password, email, tel, payment fields, etc.) are never recorded.
- PII patterns in visible text and inputs are detected and masked — credit-card numbers (Luhn-validated), SSNs, email addresses and international phone numbers.
Data attributes
Add these attributes to elements to control capture:
data-spectry-mask— force this element's text/inputs to be masked.data-spectry-unmask— explicitly allow capture of an element that would otherwise be masked.data-spectry-block— remove an element entirely from session replay.
<div data-spectry-mask>Order #12345 — jane@example.com</div>
<section data-spectry-block> ...sensitive area excluded from replay... </section>What to mask beyond the defaults
Automatic PII detection covers recognisable formats. It cannot know that your order-confirmation page prints a delivery address, that an account screen shows a customer number, or that a support tool renders someone else's ticket. Mark those regions yourself — a data-spectry-mask on the container is cheap, and reviewing replays is the wrong moment to discover what you were recording.
Consent-gated custom scripts
You can make your own third-party scripts wait for Spectry consent by setting their type to text/plain and tagging a category:
<script type="text/plain" data-spectry-consent="analytics">
// runs only after analytics consent is granted
</script>Accepted values are analytics, statistics and marketing (all three map to the analytics category), plus heatmaps, feedback and replay. The script is rewritten and executed the moment that consent is granted — including later in the same page view, if the visitor accepts after the page has loaded.
See Consent mode & categories for how categories map to features.