Decide what you will never record
Privacy work starts with refusal. Define fields, selectors, and screens that should never be captured: passwords, payment details, health information, private messages, API keys, and internal admin notes. Instrumentation should make these exclusions explicit rather than relying on reviewers to notice them later.
A written never-record list also helps product and support teams understand what evidence they can safely request.
Mask by default, reveal by exception
For session replay, default masking keeps collection predictable. If a specific non-sensitive label is needed for diagnosis, reveal that selector intentionally and document why. This model gives teams enough context to debug flows without turning replay into a raw copy of the user's page.
Review retention like a product setting
Retention should match the decision cycle. If sessions are used for weekly triage, keeping them forever rarely creates value. Shorter retention reduces risk and forces teams to summarize learnings while evidence is still fresh.