Privacy and data protection

A monitoring product stores other people's data: your visitors' sessions, the error messages your code wrote, the queries your services ran. This page lists what is collected, what is not, and which settings change that. It is not legal advice, and whether you need consent depends on where you and your visitors are.

Where the data goes

Measurements go to your install and stay there. They are not sent to an advertising network, a data broker or an analytics company. On a self-hosted install, that means your server. On obscenter.site, it means the hosted service. A few things reach out from your install, and each one can be checked:

• Map tiles, from OpenStreetMap by default. MAP_TILES=off stops it.
• Vulnerability data: package names and versions are looked up at OSV.dev, and CVE ids at CISA and FIRST.
• A language model, only if you add one. See AI reading.
• Sentry, only if you connect it.
• Webhooks, mail and workflows that you configure.

In the visitor's browser

• No cookies. The tag keeps a random visitor id and the current session in the site's own local storage, readable only by that site. If you identify users, the id is kept there too. Local storage is still information kept on the device, so where consent is required for analytics, it is required for this in the same way as for a cookie.
• Form values are not sent when a field changes. Only the field's selector and name are. Fields whose name or type looks like a password, card, CVV, SSN or token are skipped entirely.
• Clicked elements are described by their selector and their text or value, up to 60 characters. Set data-mask-text="1", or give elements a data-rum-name, if clicked elements can show personal data.
• Do Not Track is respected with data-dnt="1". Whole paths can be left out with data-ignore, and sampling reduces how much is collected.
• The full page address is recorded, query string included. Keep personal data out of URLs, or leave those paths out.

IP addresses

A visitor's IP address is not stored. It is used to find a country, and to count visitors apart through a salted, shortened hash: an HMAC-SHA256 with the install's secret, cut to 16 characters. Then it is discarded. The hash is enough to count and not enough to identify anyone. Set STORE_IP=1 to store raw addresses. Under the GDPR an IP address is personal data, so that needs a legal basis and a notice, and it follows the application's retention. Nothing in the product depends on it.

The same rule holds on the server side. Callers in traces, SSH logins and scanners are kept as a country and a salted hash, never as an address. The exception is the successful SSH logins list, which shows the address so that you can recognise your own.

Session replay

New applications record every visit (100%) until you lower it. In the browser recording:

• every input, text area and form field is masked before it leaves the browser;
• rum-block elements are left out entirely;
• rum-mask text is hidden;
• canvas content and fonts are not collected.

Recordings are kept for seven days by default, separately from other data. Native app recordings in screenshot mode are not masked. Use wireframe mode where screens show personal data. See Session replay and privacy masking.

On the server side

• The agent records method, route with ids replaced, status and duration per request. It does not record credentials, cookies or authorization headers. Header capture is off by default and uses an allowlist that never includes those.
• Request body samples are on by default for instrumented services, and masking of secret-looking fields is off by default. Review them on the Browser page.
• Log lines and exception messages are stored as your software wrote them.

Text for your privacy policy

Install → Web application → For your privacy policy writes a plain-language paragraph for your visitors from the application's own settings. It covers what is measured, the cookies question, IP handling, the values read from the page, whether replay is on, and how long everything is kept. Change replay, retention or attributes, and the text changes with them. Fill in who to contact.

The hosted service

obscenter.site publishes its own terms of service and privacy notice at /terms and /privacy. On a self-hosted install, you are the controller, and these pages are not served unless you switch them on.