session replay

Watch the failure, without recording the person

Session replay shows the page changes, clicks, requests, and errors around a problem. It is designed to answer “what happened?” without collecting the visitor’s identity or readable page content.

What gets kept

The browser holds a bounded timeline locally. By default, Sixty keeps a recording only when the session already contains an incident: a dead click, rage click, JavaScript error, or failed request. You can instead turn storage off for a service, or sample a percentage of otherwise healthy sessions from the Sessions page.

A retained replay is attached to the operation and finding it explains. It is available from the Sessions page and beside the relevant finding, then deleted after three days.

Enable browser replay

Recording is an explicit application decision. Enable it where the browser agent is initialised; a dashboard setting cannot add recording code to a bundle that did not ship it.

import { init } from '@sixty-sh/browser'

init({
  key: 'sixty_pk_…',
  service: 'checkout-web',
  release: process.env.NEXT_PUBLIC_GIT_SHA,
  replay: { enabled: true },
})

replay: true is the equivalent short form. The normal proxy install can omit the public key and continue posting through its existing/api/drift route.

Privacy masking is fail-closed

• Text is masked before upload. Text nodes and form input values become placeholders in the visitor’s browser.
• Attributes are allowlisted. Structural and visual attributes survive; prose-bearing values such as labels, titles, alt text, and placeholders do not.
• URLs are reduced. Query strings and fragments are removed, and routes use shapes such as /orders/:id.
• No visitor identity is attached. There is no user ID, session ID, cookie, or IP address in the recording.

Make safe interface text readable

Fully masked replay is safe but can be hard to interpret. If your fixed navigation and control labels never contain customer data, explicitly allow those selectors. Do not include regions that render names, email addresses, messages, order details, or other user-provided content.

init({
  replay: {
    enabled: true,
    unmask: 'nav, button, h1, h2, [role="tab"]',
  },
})

Control what is stored

Open Sessions and choose a policy per service:

• Off immediately discards recordings without requiring a deploy.
• On failure keeps only incident-triggered recordings.
• Sample keeps incidents plus the percentage of healthy sessions you set.

The server-side policy can narrow what the installed recorder stores, but it cannot enable a recorder that the application did not explicitly ship.

React Native

React Native replay records an ordered, redacted timeline of screens, requests, and errors rather than screenshots. Enable it with replay: true in the React Native agent. Screen text, request and response bodies, headers, identifiers, and screenshots are excluded.