How recording works

Replayful captures user sessions using rrweb, an open-source library that snapshots the DOM and records mutations + interactions as JSON events. Playback rebuilds the DOM and replays the events, there's no video file, which is how the payload stays small.

What gets captured

• The initial DOM snapshot.
• Mutations to that DOM over time (elements added / removed / attributes changed).
• Mouse position (sampled), mouse clicks, touches, scrolls, viewport resizes.
• Form interactions, but as focus / blur / click events only. Never the typed values.
• Network status (the page URL on navigation; not the body of requests).
• HTTP status of the initial page load, so 4xx / 5xx sessions are flagged.

What does not get captured

• Input values. Every text input, search box, and textarea is masked at the source. The tracker overrides the default rrweb behaviour to maskAllInputs: true, so we never receive the keystrokes.
• Anything inside iframes you don't own. Embedded chat widgets, payment iframes, third-party checkout flows all stay opaque.
• IP addresses. We use the IP at ingest time to derive country, then drop it.
• Cookies or local storage values.

Payload size

A typical 2-minute desktop session is around 100–500 KB of event JSON. The tracker buffers events client-side and flushes every few seconds via fetch, falling back to sendBeaconon tab close so the trailing events don't disappear.

Performance impact

The tracker is loaded async, so it never blocks first paint. Run-time cost is dominated by the initial DOM serialisation (≤10ms on most pages) and ongoing MutationObserver work, which scales with how much the DOM changes. On a typical marketing site you won't measure the difference.

When does a session start?

The tracker initialises on page load and emits an ingest event the first time it sees real activity. If a visitor lands and bounces inside 200ms, you may not see a session, that's usually a bot or a misclick.