DEJA privacy and data handling
What the DEJA tracker records, what it never records, what a site owner can add, where the data is stored, how long it is kept, and how to delete it.
DEJA records sessions on sites that installed it. This page describes what the recorder actually captures, as implemented — not an aspiration. Two audiences: the site owner deciding whether to install it, and the visitor of a site that already has.
What is recorded
- The page structure and how it changes — the DOM and its mutations, which is what makes replay possible.
- Interactions: clicks, scrolls, mouse movement, navigation between pages, and the viewport size.
- JavaScript errors that reached the page, with the message and the URL it happened on.
- The browser's user-agent string, and the timestamps of each event.
What is never recorded
- Passwords. Any field that is a password, or was ever a password, is masked before it leaves the browser. That decision fails closed: on any error or ambiguity the value is masked rather than sent.
- Anything the site owner marked. A field inside
.deja-mask,.deja-block,[data-deja-mask]or[data-deja-block]is masked the same way. Mark anything sensitive to your product — DEJA cannot know which of your fields is a national ID number and which is a nickname. - IP addresses and geolocation. Neither is stored.
- Cross-site activity. The tracker only sees the site it was installed on. There is no network across customers and no profile that follows a person between them.
Other input values are captured, because a replay where every form is blank rarely explains why someone abandoned it. If that trade is wrong for a particular field, mark that field.
Identity is opt-in, by the site owner
A session is anonymous unless the site owner explicitly attaches an identity, by calling deja("identify", …) with a user id and optionally an email, a name and an account id. Nothing is inferred: DEJA never derives who someone is from what they typed. Where identity is attached, it is the site owner's own user record, supplied deliberately, and it is their responsibility to have the basis to do so.
Where the data lives, and for how long
| Data | Kept for |
|---|---|
| Friction events (rage clicks, dead clicks, errors) | 30 days, then deleted by a daily job |
| Page and heatmap rollups | 180 days, then deleted by the same job |
| Session recordings | Until the project's owner deletes them from Settings |
Everything is stored in DEJA's Convex deployment. Recordings are stored as opaque compressed chunks and are never decompressed on the server. The retention job compares a stored day column against a cutoff computed once per run, so nothing outside the window is ever touched.
Deletion
A project owner can delete every recording and every derived analytic for a project from Settings, under the danger zone. The deletion runs through the stored chunks as well as the rollups — it is a real purge, not a flag. If you are a visitor rather than a customer, the site you visited controls that data and is the party to ask; DEJA holds it on their behalf.
Selling data
DEJA does not sell recordings, does not sell derived analytics, and does not use one customer's sessions to build anything another customer sees.
DEJA is in private beta and this page describes current behaviour. Material changes will be reflected here.