Ethical Analytics. As little data as needed.
Understanding user behavior shouldn't come at the cost of human privacy. At MousePlayer, we build tools for insights, not surveillance.
We believe that robust digital analytics and strict data privacy are not mutually exclusive. MousePlayer was engineered from the ground up with a privacy-first architecture, ensuring that you get the telemetry you need to improve your UI/UX with as little personal data as possible. That data is not anonymous - it is pseudonymous, and below we tell you exactly what that means.
Pseudonymous, Not Named
We care about *how* elements are interacted with, not *who* is interacting with them. MousePlayer assigns random, pseudonymous identifiers to visitors and sessions; they are valid only on the website concerned. There is no cross-site tracking, no fingerprinting and no attempt to identify your visitors. A name or your own customer ID for a visitor exists only if you, as the operator, send or assign it yourself. Behavioural profiles and AI analyses describe groups of visits or individual pseudonymous visitors within your project; they are not linked to data of other projects or other customers.
Masking in the Browser
Input is masked at the source. Passwords and payment data at every masking level, and text typed into form fields by default in full, are made unreadable directly in the visitor's browser before any data is transmitted to our servers. What your page itself displays is not covered by this; that is what the markers further down are for.
Your Data, Siloed
We are a tool provider, not a data broker. Your telemetry data is strictly siloed within your workspace. We do not sell your visitors' data and do not pass it on for third-party advertising, profiling or marketing. Data leaves MousePlayer only to recipients you set up yourself (integrations and share links), to the parties named in the list of sub-processors and where we are legally obliged to disclose it.
The Mechanics of Ethical Tracking
1. Form Input & Keystroke Sanitization
Watching a session replay should reveal usability friction, not personal secrets. MousePlayer’s client-side tracking script employs rigorous sanitization logic. When a user interacts with standard input fields, the recorded data is masked instantly by default. You will see that a user typed into a field, allowing you to gauge interaction time, but the actual characters are replaced with non-readable indicators or stripped entirely. Password and payment fields stay masked at every masking level. Two limits apply, and we name them rather than gloss over them: the two weaker masking levels are enabled only on our written approval, and masking never reaches what your own page prints into the document. Both are set out in the DPA.
2. DOM Element Masking
For websites handling highly sensitive data (such as medical portals or financial dashboards), MousePlayer lets developers mark the areas that must never be recorded. There are two markers, and they do different things.
The attribute data-mp-mask, or the class mp-masked, on the element that wraps a sensitive area. Inside that area, every non-whitespace character of every text node is replaced with an asterisk before the page snapshot leaves the browser, and every attribute value apart from a short technical allow-list is replaced with [FILTERED]. The replacement happens on a copy; the page the visitor sees is untouched.
The attribute data-mp-ignore, or the class mp-ignore, is narrower: it suppresses the values of form fields. It does not remove anything from the page snapshot.
Note: mp-mask — without the data- prefix and without the trailing ed — is not a marker and has no effect. If you have used it, replace it with data-mp-mask.
"Our philosophy is simple: what we never collect cannot be exposed, leaked or misused. Privacy is not a feature you toggle; it is part of the foundation of our architecture."
3. Transparent Geolocation
From a visitor's IP address we determine country, city and network operator when the connection is established. The address itself is stored only in truncated form (for IPv4 without the last octet, for IPv6 without the last block). The complete address is held only in memory during the connection, for a few seconds to detect connection floods and - where it is blocked automatically on suspicion of an attack - for up to 24 hours as a block entry in our cache.
4. Ephemeral Live Viewing
Our Live Viewer relays mouse coordinates and page changes to the viewer over encrypted connections (WSS). The live view itself creates no additional copy; only what is stored anyway as the session recording is stored. Once the live connection ends, the temporary buffer in memory is cleared.