FullStory

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Do not build this — and read the reason, because it is not only technical.

**Replay that reconstructs a page faithfully** — single-page applications, shadow DOM, lazy content, dynamic styles — is years of edge cases. But the sharper point is what a session recording is: a record of an individual person using your product, including what they typed. Deployed carelessly, it becomes a database of things people never meant to give you.

WHEN TO KEEP PAYING
- You genuinely need replay, and you would rather the masking defaults were somebody else's professional responsibility

WHEN TO BUILD
- Self-host OpenReplay or build on rrweb, which is covered under OpenReplay and Hotjar elsewhere in this catalogue

WHATEVER YOU DO, THESE COME FIRST
- **Mask by default, reveal by exception.** The opposite ordering guarantees something sensitive is captured on the first day
- Password fields never captured under any configuration. Remove the code path rather than making it a setting
- Payment fields and anything marked sensitive replaced in the browser, before the data leaves. Masking on the server is too late
- Record a test page containing a password, a card number and an address, then read the stored stream by hand. Do that every release, not once
- Retention in days, enforced by a sweeper that actually deletes, and deletion by user identifier in one command
- **Log every viewing**: who watched whose session. That log is what keeps the tool honest inside your own company, and it is the control nobody builds
- Write all of it in your privacy notice, in plain words

THE CHEAPER ANSWER THAT USUALLY WORKS
Most questions people open a replay for are answered by two lists: rage clicks and dead clicks, with the element and the page. Those need no recording at all — a few kilobytes of script, an events table, and a ranked list. Build that first and see how many of your questions it answers before recording anybody.

THE ONE-LINE VERSION
Try the rage-click list before the replay. If you must record, mask by default and audit who watches.