Privacy & masking

Pinwren runs on your visitors' pages, so it collects as little as it can by default and gives you three levers for the rest: masking (per element), privacy mode (per project) and a consent notice.

MaskingCopy Anchor Link

Masked elements are hidden in the captured copy of the page and painted over as solid grey blocks of the element's size, so whoever reads the report sees that something was withheld rather than a hole that looks like a rendering bug. Masking applies to every capture mode, including screen share of the current tab, and to session replay.

<div class="account-summary" data-pinwren-mask>Jane Doe · IBAN DE89 3704 0044 0532 0130 00</div>

To leave something out of screenshots entirely — not even a block — use data-pinwren-ignore. The widget's own UI is always left out.

<div class="debug-toolbar" data-pinwren-ignore>…</div>

Privacy modeCopy Anchor Link

Turn on Privacy mode on the project's Privacy & data tab (the EU privacy mode card) for pages that show personal data (customer portals, health or finance apps, anything under GDPR scrutiny). It changes both sides:

In the widget

• every text field is masked in screenshots, on top of the built-in masks;
• no page-timing metadata is sent;
• the user agent is reduced to the browser and OS families (“Chrome on Windows”) — no versions, no device model; time zone and referrer are left out;
• session replay is off unless the page explicitly opts in (allowReplayInPrivacyMode);
• screen recording is off unless an admin switches it on in the project's Capture tab (a video cannot be masked);
• the error prompt is never shown and no Sentry / PostHog / LogRocket / Datadog ids are attached.

On the server

• the consent notice is forced on, and console capture is capped at errors;
• reports from older or modified widgets are filtered again on arrival: non-error console entries and timing data are dropped and the user agent is reduced;
• answers to custom fields marked Contains personal data are replaced by [redacted] in exports, webhooks and agent briefs (the stored answer stays visible to your team);
• stored IP addresses are truncated (to /24 for IPv4, /48 for IPv6), and the instance's outbound update check is switched off;
• turning it on shortens a “keep forever” retention to 90 days (unless you set a retention in the same change).

Consent noticeCopy Anchor Link

With consent.enabled (Ask for consent in the Widget tab's Consent notice card), the composer and the bug report show a short notice above the send button, which becomes Agree & send. The default text, in the visitor's language:

Sending shares your comment, this page's address, the element you marked and basic browser details (browser, screen size, language) with the site owner. Bug reports also include recent console errors and failed requests.

Set consent.text for your own wording (up to 1,000 characters) and consent.privacyUrl to link your privacy policy. The visitor is asked once per project and browser; changing the text or link asks again.

Each submission also records which notice was accepted and when (consent: { version, acceptedAt }), stored with the feedback.

What is sent, and whenCopy Anchor Link

Diagnostics stay in memory on the page; nothing is sent until someone submits. The widget keeps a few small values in the visitor's browser — the name and email they typed, the reporter tokens of their own items, the consent they gave (localStorage), and drafts and queued reports (IndexedDB) — and sets no cookies: its API requests are sent without credentials.

Network capture never records request or response bodies, and redacts sensitive-looking query parameters — see Bug reports.