Replayborg

Privacy Policy

Last updated: 7 August 2026 · Applies to the Replayborg WordPress plugin, this documentation site, and support provided by Stackborg.

The short version

Replayborg sends us nothing. No telemetry, no usage statistics, no licence check, no crash reports. The plugin never contacts Stackborg or any other server.
Recordings stay on your site. They are written to your own WordPress database and read back from it. We cannot see them, and neither can anyone else you have not given access to.
This page collects nothing. No cookies, no analytics, and nothing requested from any other server.
If you run the plugin, the recordings are yours to answer for. They are personal data, and you are the controller of them.

Who and what this covers

Replayborg is published by Stackborg. This policy describes three separate things, which are easy to confuse and are worth keeping apart:

The thing	Who holds the data
The plugin, running on your WordPress site	You. Everything it records is stored in your database, on your server.
This documentation site	Stackborg — and it collects nothing beyond what any web server logs.
Support you ask us for	Stackborg, or WordPress.org if you use the plugin's support forum.

Installing the plugin creates no relationship in which we process your visitors' data. We never see it.

What Replayborg records

When a visitor loads a page on a site running Replayborg, the plugin records:

Recorded	Detail
Page structure and changes	The DOM as the visitor saw it, and how it changed while they were there
Pointer and scroll behaviour	Movement, clicks and scrolling — as coordinates within the page, not as video
Pages visited	The URLs the visit moved through, with the entry and exit page
Device and viewport	Screen size, and whether the device is desktop, mobile or tablet
Referrer and campaign	The referring URL the browser sent, and any UTM parameters on the entry URL
Timing	When the visit started, how long it lasted, and how long each page held attention
An anonymous visitor id	A random identifier generated in the browser and kept in `localStorage` — not a cookie, not linked to an identity, not shared with any other site
WordPress user, if signed in	The user id, so the session can be attributed to that account

What is deliberately not recorded

Text typed into inputs. Input masking is on by default: what a visitor types is replaced in the browser, before anything is sent. Passwords, payment details and message bodies never reach the database.
Anything matched by the block selector. Elements you name by CSS selector are excluded from recording entirely.
IP addresses are not stored with recordings. The visitor's address is used only to form a short-lived counter that stops one browser flooding the site, and is never written into a recording.
No cookies are set by the plugin.
Nothing at all, if a filter says so. A site can decline to record any page view, role or visitor.

Masking is a default, not a guarantee of anonymity. A recording still shows the page as it was rendered — so a name, an order number or an email address printed into the page is visible in the replay even though nothing was typed. If your site displays personal data on screen, block those elements. See Privacy in the documentation.

Where it is stored

In tables of the plugin's own, inside your WordPress database — one row per visit, and the recorded frames alongside it, compressed. Nothing is written anywhere else, and nothing is written outside your database.

Retention defaults to 30 days and is configurable. A daily job deletes recordings past the window, along with their frames.
Access requires the manage_options capability — in practice, an administrator.
Deactivating the plugin removes nothing. Deleting it removes its tables and its settings, leaving nothing behind.

What we never receive

Stackborg receives no data from a site running Replayborg. Specifically, the plugin does not:

send usage statistics, telemetry or analytics of any kind
check a licence, a key or an activation
report errors or crashes to us
load scripts, fonts, images or stylesheets from our servers or anyone else's
register your site, your email address or your domain with us

There is no external service in the product at all. This is verifiable rather than a promise: the plugin's source ships inside the package, in src-js/, and there is no network call in it to any host but your own.

The plugin bundles rrweb (MIT licensed) in its compiled recorder. rrweb is code that runs in your visitor's browser, not a service — it contacts nothing.

If you run the plugin, you are the controller

Session recordings are personal data under the GDPR, the UK GDPR, the CCPA and comparable laws. Because they are stored on your server and never reach us, you are the data controller and Stackborg is not a processor of them.

That means these decisions are yours, and the plugin cannot make them for you:

Tell visitors. Your privacy policy should say that you record sessions, what is recorded, how long you keep it and why. Suggested wording is below, and the plugin also registers it with Tools → Privacy.
Choose a lawful basis. In the EU and UK, session recording is commonly treated as requiring consent; legitimate interests may apply in narrower cases. Take your own advice — this page is not legal advice.
Turn the consent gate on if you need it. Set consent_required and have your consent tool set window.sbReplayborgConsent = true once the visitor agrees.
Set a retention period you can defend. Shorter is easier to justify. 30 days is the default, not a recommendation for every site.
Block what masking cannot cover — anything sensitive that your pages display rather than accept as input.
Do not record what you do not need. Checkout, account and medical pages are usually better excluded outright.

Access and deletion requests

If a visitor asks for their data, the recordings are yours to search and to delete. A recording is identified by its session id and by the anonymous visitor id kept in that visitor's browser; a signed-in visitor's recordings also carry their WordPress user id.

Signed-in users — sessions can be found by user id and deleted.
Anonymous visitors — you can only identify their recordings if they can give you their visitor id, because nothing else ties the browser to a person. That is a consequence of the plugin not building visitor profiles.
Everything expires anyway at the end of your retention window, and is deleted rather than archived.

Wording you can adapt for your own policy

A starting point, not a substitute for your own review:

Session recording

We record how visitors use this website so we can understand where our
pages are unclear and fix them. A recording captures the pages you
visited, the structure of those pages, and your mouse movement, clicks
and scrolling.

Text you type into forms is masked before it leaves your browser and is
not recorded. We do not record passwords or payment details.

These recordings are stored on our own servers, are visible only to our
administrators, and are deleted automatically after [30] days. They are
not shared with, or sent to, any third party.

To ask about a recording, contact us at [your address].

Adjust the retention period and contact details, and add your lawful basis and consent arrangements if your jurisdiction requires them.

This website

The documentation and this policy are static HTML files. They request no fonts, images, stylesheets, scripts or trackers from any other server, set no cookies, and run no analytics. Each carries a dozen inline lines of JavaScript that highlight the section you are reading in the contents rail; it reads nothing and sends nothing. Nothing you do here is recorded by us.

As with any website, the web server that delivers these pages may keep standard access logs — an IP address, a timestamp, the page requested and the browser's user agent — for security and diagnostics. Those logs are not combined with anything else, are not used to build a profile, and are kept only as long as the hosting provider's ordinary log rotation.

Support

Support happens by email. Write to support@stackborg.com for anything about the plugin, or security@stackborg.com for a security report. We hold what you send: your email address, the message, and anything you attach. We use it to answer you and to fix what you reported, and for nothing else. We do not add you to a mailing list, and we do not sell or share your address. Support correspondence is kept while it is useful for the issue and for a reasonable period afterwards, then deleted.

Please do not send us database dumps, recordings or exports containing your visitors' personal data. We do not need them to help, and we would rather not hold them. If a reproduction case genuinely requires one, ask us first and remove what is not needed.

Your rights

For the small amount of data Stackborg holds — essentially, support correspondence — you can ask us to show you what we have, correct it, delete it, or stop using it. Email support@stackborg.com and we will respond within 30 days.

For recordings made by a site running Replayborg, we are not the right address: contact the operator of that site. We have no access to their database and cannot retrieve or delete anything in it.

Changes to this policy

If this policy changes, the date at the top changes with it, and anything material will be noted in the plugin's changelog. We will not make a change that quietly starts collecting something the plugin did not collect before — if that ever became necessary, it would be an opt-in, announced in a release.

Contact

General and privacy questions — support@stackborg.com
Security reports — security@stackborg.com
Documentation — replayborg-wp-plugin.stackborg.com
The plugin — wordpress.org/plugins/sb-replayborg

This page describes what the software does and what we hold. It is not legal advice, and it cannot tell you what your own site's privacy policy needs to say — that depends on where you and your visitors are, and on what else your site does.