Skip to main content
Session capture can include any DOM content by default. This guide helps you decide which elements to tag before you deploy, so the sensitive or personally identifying information (PII) they render is masked or excluded from capture. You tag elements with the privacy classes (fs-mask, fs-exclude, and others) — no JavaScript API needed.

​
What to tag

Scan the codebase for elements that render any of the following:
  • Email addresses, phone numbers, postal addresses
  • Full names, usernames, profile photos
  • Payment data — card numbers, CVV, billing details
  • Auth secrets — passwords, MFA codes, recovery phrases
  • Government IDs — SSN, tax ID, driver’s license
  • Health data, financial balances, account numbers
  • Free-text fields where users may paste any of the above (notes, support messages, chat)

​
Mask or exclude?

Which class you reach for depends on whether the value is sensitive or the element’s very existence is.
Default to fs-mask for individual inputs and fs-exclude for whole sensitive sections.

​
What not to tag

Some sensitive UIs render in iframes that the recorder cannot see into anyway. Don’t waste effort tagging the wrapper around them.
If you build a payment form with native <input> elements, tag those inputs. If you embed Stripe Elements, leave them alone — they’re already opaque.

​
Process

1

Walk the codebase

Cover form inputs (<input>, <textarea>), profile and settings pages, account/billing pages, chat or messaging UIs, anywhere PII can render.
2

Propose each change

For each element, propose the file, line, and the class (fs-mask vs fs-exclude). Wait for confirmation before writing.
3

Insert the class

Add the class, then verify the markup still compiles.
Tagging only takes effect on new sessions captured after deploy. Sessions already recorded are not retroactively masked.

​
Verify on a real session

The static code walk catches obvious cases. To find the rest, run the privacy MCP (or subtext privacy propose from the CLI) against a real session URL. It returns suggested CSS selectors that the auto-configure pipeline flagged as likely PII. Review the proposals, create rules in preview scope, verify against a preview session, then promote. See the privacy overview for the full governance lifecycle and the tools reference for each privacy tool’s parameters.