Skip to content
EverockDocs
Open dashboard

Privacy and consent

View Markdown

Control what leaves the runtime before it reaches the collector.

When visitor consent is required, initialize with capture disabled through the consent state, then enable only the allowed categories. Omitting consent preserves the SDK's existing capture behavior; it does not automatically display or implement a consent banner.

Consent integration
import { init, setConsent } from '@everock/sdk';
init({
  publicKey: 'pk_YOUR_PROJECT_KEY',
  endpoint: 'https://collector.example.com',
  consent: { analytics: false, replay: false },
});
// Invoke only after your own consent UI records the visitor's choice.
setConsent({ analytics: true, replay: false });

Revocation stops the corresponding capture and discards pending data for the revoked category. Visitor consent takes precedence over dashboard plugin settings.

Redact and filter

URLs lose query strings, fragments, and embedded credentials. Common secret-bearing fields are redacted. Add application-specific field names and a final local filter:

Local privacy filter
init({
  publicKey: 'pk_YOUR_PROJECT_KEY',
  endpoint: 'https://collector.example.com',
  redactKeys: ['customerAddress', 'paymentDetails'],
  beforeSend(event) {
    if (event.message === 'private-operation') return null;
    return event;
  },
});

A filter exception safely discards the event. Serialization is bounded; oversize or unsupported data may be truncated or rejected. Review what you put in event messages and payloads rather than treating redaction as an automatic guarantee for arbitrary content.

Replay has separate DOM masking controls. Repository access, source-map uploads, and architecture summaries are separate data flows. See keys and GitHub.