Privacy model

What HumanBehavior stores from the browser, what you must configure, and GDPR-minded checklist.

Model

HumanBehavior records product analytics and session replays from the browser SDK. Privacy is a shared responsibility:

The SDK defaults toward masking inputs (privacy-first redaction).
You configure redaction for your UI and avoid sending secrets in events/logs.
You meet your own legal obligations (notices, DPA, retention, region) — this page does not give legal advice.

Channel	Risk	Controls
Session replay (DOM / inputs)	Typed values, on-screen PII	`redactionStrategy`, password always masked — Replay privacy
Console warn/error	Tokens printed via `console.warn` / `console.error` (`console.log` is not ingested)	`enableConsoleTracking: false` or stop logging secrets on those levels
Network errors	URLs, optional bodies	Keep `captureRequestBodies` false unless needed; bodies are redacted when on
Custom events	Anything you put in properties	Do not send passwords / raw cards / secrets
Identify traits	Email, name, plan	Send only what you need for product analytics
Error reports	Stacks, breadcrumbs, URLs	Source maps may reveal original paths; still avoid secrets in messages

Option	Default	Privacy note
`redactionStrategy.mode`	`privacy-first`	Mask inputs unless unredacted
`recordCanvas`	`false`	Opt-in visual capture of canvas
`enableConsoleTracking`	`true`	Opt-out
`enableNetworkTracking`	`true`	Opt-out; failures/long loads
`captureRequestBodies`	`false`	Opt-in
`enableErrorTracking`	`true`	Opt-out

Password fields cannot be unredacted. Visibility-first still forces password masking and supports [data-hb-redact="true"].

Choose privacy-first or an explicit visibility-first + redactFields list.
Record a staging session covering login, checkout, and any PII forms — inspect the replay.
Audit console.* in sensitive flows.
Confirm custom events and identify payloads.
Call tracker.logout() on app sign-out so shared devices do not merge identities.
Document retention / access for your org (product retention policy details beyond schema are unknown here — confirm with your team).

Mode	Inputs	Selectors
`privacy-first`	Masked by default	`unredactFields` to show
`visibility-first`	Visible by default	`redactFields` / `data-hb-redact` to hide; passwords always hidden