GhostViewRequest access →

Trust & privacy

Privacy you can verify,
not just trust.

Session recording only works if the people you invite believe it won't leak what they type. So GhostView masks input by default, never stores IP addresses, and hands you an export and delete button for everything it holds. Here's exactly what that means.

Masked by default

What your tester types isn't what you see.

The recorder redacts form values, typed text, and passwords in the visitor's browser — before anything is sent. You watch the behavior, not the secrets.

What the tester types

Email
dana@realuser.com
Password
hunter2-correct-horse
Card number
4242 4242 4242 4242

What you see in the replay

Email
••••••••••••••••••
Password
•••••••••••••••••••••
Card number
•••• •••• •••• ••••

Masking is on for every input the moment the recorder starts — not a setting you have to remember to switch on.

What GhostView captures

  • Clicks, scrolls, navigation, and timing
  • Page flow — which pages, in what order
  • Browser, OS, device type, and viewport
  • An anonymous, random visitor/tester ID to group one session's events

What it never stores

  • Input values, typed text, and passwords — masked before they leave the browser
  • IP addresses — used only transiently to rate-limit abuse, never written to the database
  • Names or email addresses by default
  • Data sold or shared with advertisers — ever

Your data, your rules

Export anything

Every session downloads as full JSON — events, stats, and annotations. Pipe it wherever you want.

Delete anything

Remove a session, a project, or your whole account. Backups are purged within 30 days.

No lock-in

It's your recording of your users on your app. We're the processor, not the owner.

Controls for builders

Tighten it further with two class names.

.gv-block

Add it to any element and that whole region is excluded from recording — nothing inside is ever captured. Use it for anything sensitive you don't even want in the DOM snapshot.

.gv-unmask

Inputs are masked by default. If you deliberately want to see a specific field's values — say a search box — opt just that one back in. The default is always privacy.

<!-- Excluded from recording entirely --> <div class="gv-block"> ... </div> <!-- Values visible in replay (opt-in) --> <input class="gv-unmask" name="search" />

Trust is the whole point.

You can't learn from users who don't trust the tool watching them. GhostView is built so the honest default is the only default.

Request early access→

Read the full privacy policy and terms.