# Privacy & masking

Screenshots are captured and scrubbed entirely client-side before anything is sent.

Screenshots are captured and processed entirely in the browser — pixels never leave the page until the user reviews the capture and hits send. Before anything is drawn, the widget scrubs the frame automatically:

- All `<input>`, `<textarea>`, and `contenteditable` elements are masked with an opaque overlay — form values are never captured.
- Captured URLs are stripped to origin + pathname — query strings and hashes are never sent.
- Users can add their own redactions in the annotation editor; redactions are baked destructively into the image before upload.

## Controls you add

- `data-feedback-mask` — force-mask any element (account numbers, avatars, anything sensitive).
- `data-feedback-ignore` — exclude an element from captures and from the element picker entirely.

## The capture pipeline

1. **Exclude / hide** — `[data-feedback-ignore]` elements are removed before capture.
2. **Clone-scrub** — a cloned DOM is scrubbed of input values and masked content.
3. **Opaque overpaint** — inputs and `[data-feedback-mask]` regions are painted over with an opaque hatch so nothing shows through.

> **Note:** Nothing is uploaded until the user reviews the annotated capture and presses send. The clean base image stored server-side already has redactions baked in.