Full Private

Full Private

English (US)

Deutsch

English (US)

Deutsch

FullStory Support

Privacy

Privacy Basics

Articles in this section

How do I protect my users' privacy in FullStory?

Form Privacy

FullStory Private by Default

Why does FullStory use an allowlist approach to Network Request/Response Bodies?

How do I make sure I'm in compliance with your acceptable use terms?

What to do if sensitive data has been captured

Can I delete sessions?

How do I create exceptions to element data capture rules?

How long is data kept in FullStory?

Should I be concerned at all with the security of my data?

See more

NOTE: Images cannot be masked when capturing data on web sessions. If you wish to hide images from data capture, use .fs-exclude .
Helpful guides and resources for digital professionals.
Search for solutions to get up and running with FullStory.
Helpful guides and resources for digital professionals.
Search for solutions to get
up and running with FullStory.
Understand the basics of FullStory privacy capabilities and feel confident utilizing them with our new FullStory Privacy 101 interactive course.
Private by Default is a setting that minimizes the risk of capturing sensitive or unwanted data with FullStory. When enabled, no text is ever captured or leaves the user's browser unless explicitly allowlisted as safe to capture. For FullStory for Mobile Apps customers, Private by Default also automatically masks any images that contain external content. Images that are bundled with the app remain visible.
This privacy-first approach is made possible by proprietary masking technology that essentially transforms (non-allowlisted) elements of your website into a wireframe during session replay. This means that without allowlisting even a single element, you are still able to gain deep insights into the user experience.
The main reason for this functionality is to allow FullStory to be used straight out of the box with zero risk of collecting unwanted end-user data. Failing to properly scope your data capture rules should no longer result in the collection of unwanted data. This article will teach you the functionality of Private by Default data capture rules and guide you through best practices you should consider for your digital properties.
Private by Default can be turned on via request to our Customer Support team .
If you’re an existing FullStory customer, note that enabling Private by Default may cause issues with pre-existing segments, event funnels, or Conversions funnels that are based on text elements. Please contact us if you’d like assistance in transitioning to Private by Default.
When opening a FullStory account for the first time, you'll be taken through a step by step wizard of our privacy settings options to help ensure critical privacy and data capture settings are defined before data capture begins.
FullStory has three different ways to treat elements when it comes to capturing data on a site or app. These (in order from most private to least private) are Exclude, Mask and Unmask. As mentioned above, the default setting for FullStory when Private by Default is enabled is to capture Masked versions of all elements. This gives you a safe place to begin your implementation and allows you to begin getting value from FullStory even before you have gone through the process of Unmasking the safe portions of you digital properties. Let’s explore each of these types of data capture rules in more detail.
FullStory’s most private element data capture rule is an Exclusion. For excluded elements, the element itself (as well as any child elements) will be ignored by data capture. All excluded elements are replaced in playback by rectangles containing diagonal grey and white stripes. This allows a FullStory user to differentiate between excluded elements and intentional white-space when viewing recreated sessions in Session Replay. Because exclusions apply to all child elements, it is not possible to Mask or Unmask the child of an excluded element.
Events that target excluded elements (click or change, for example) are ignored entirely. If understanding end-user interaction with an element is important, then using Mask is preferable to Exclude.
The CSS class .fs-exclude is a replacement for the deprecated (yet still currently supported) class .fs-block .
NOTE: The fact that click events are ignored on excluded elements is new. Prior to the existence of Masking, clicks on excluded elements were captured on FS Web.
Masking is FullStory’s “happy medium” privacy setting and is the default setting for capturing data out of the box when Private by Default is enabled. Masking is functional enough that even in a fully masked state, it is still possible to understand user experience using search, segmentation and session replay.
For masked elements containing text, all text will be replaced by irreversibly-transformed placeholder text, meant to resemble a wireframe of the original content. This placeholder text blob will retain the size, color and character length of the original text. Additional information on how collection / rendering of masked text is managed is included in the technical section below.
As with excluded elements, Masking applies to the children of masked elements. However, unlike with excluded elements, specific children of a masked element can be Unmasked. This allows for a more granular level of privacy control for complex elements like forms.
Interaction events targeting masked elements (such as click or change) are captured. Because actual text is not collected for masked elements, you will need to leverage CSS selectors in search where you might have searched using text had the element been fully Unmasked.
Unmask is FullStory’s “capture everything” setting. When elements are unmasked, FullStory will capture all text, images and user interactions. It is likely that for digital products that contain little to no sensitive data, the vast majority of the site or app can be unmasked. On an ecommerce site for example, the number of places that will need to be masked or excluded are likely limited to parts of the payment flow and/or the end-users profile/settings. The remaining bulk of the site could safely be unmasked.
Below is a summary table for comparing Exclude, Mask and Unmask:
Understand the basics of FullStory privacy capabilities and feel confident utilizing them with our new FullStory Privacy 101 interactive course.
FullStory offers two different approaches to managing your element data capture rules. The first is to implement the appropriate CSS classes into your element libraries, an approach we refer to as “code-first.” The second method for managing element data capture rules is through the FullStory Element Data Capture Rules UI located in Settings > Data Capture and Privacy > Privacy.
The code-first approach to managing element data capture rules is FullStory’s recommended approach. Adding CSS classes to your libraries is simply a less brittle and more future-proof approach than handling these rules through the UI using CSS selectors. FullStory has three classes for managing basic element data capture rules and three additional classes that interact with our fs.consent API :
Consent Related Data Capture Classes
NOTE: .fs-exclude is replacing the now deprecated (but still currently supported) CSS class .fs-block . Similarly, .fs-exclude-without-consent is replacing the now deprecated (but still currently supported) CSS class .fs-record-with-consent .
In the event that no engineering resources are available and/or there are circumstances that make managing data capture rules in a code-first manner untenable, it is possible to manage these rules via the Element Data Capture Rules UI located in app at Settings > Data Capture and Privacy > Privacy . This is an example of the Data Capture Rules widget:
From here you can create/modify data capture rules based on CSS selector. Additionally you can set a rule “Scope.” The scope is related to preview mode and will be discussed below.
Clicking the “Create Rule” button will open this Add Element Data Capture Rule widget, where the CSS selector is added, the rule type is selected and the rule is scoped (a similar widget exists for editing rules):
A similar widget is also available for adding element data capture rules directly from Inspect Mode.
Note: To exclude elements when using FullStory for Mobile Apps, you'll need to enter the name of the container element.
CSS selectors are the main mechanism for managing Exclude, Mask and Unmask through the FullStory UI. It is important to properly make use of broad selectors, especially when Unmasking, in order to keep the list of items in your Data Capture Rules as manageable as possible. For managing data capture rules, FullStory supports nearly all types of CSS selectors. The complete list can be seen here:
Attribute word selector contains: [a~=b]
For reference, Element Data Capture Rules DO NOT support the following CSS selectors:
Here are some examples of some broad CSS selectors that have been used for unmasking larger sets of things (these examples worked in the case of a specific test site and may not apply to all sites):
All selectors where the class contained “search” making all search bars visible
[class^="hz-secondary-menu container"]
All selectors where the class starts with “hz-secondary-menu container”
All divs where the class contains “carousel”
If your account was created on or after November 10, 2021, you'll also see a feature under Settings > Data Capture and Privacy > Privacy called Form Privacy. Form Privacy automatically enables a set of six element data capture rules that mask all form elements with the attributes input , textarea , select , and contenteditable , and exclude all form elements with the attributes radio and checkbox . This proactively protects end users' privacy by preventing FullStory from logging potentially sensitive user data captured by form elements on your site or mobile application. Learn more about Form Privacy here .
A common question related to element data capture rules normally goes something like “How do I know if I should upgrade the rule for an element from Mask to Exclude?” This is a great question, and while the answer isn’t particularly complicated, it does require some careful thought.
First, if the element in question is meant to contain or could possibly contain information of a regulated nature (meaning the information is governed by regulations like HIPAA, FERPA, GLBA, etc) then you should seriously consider upgrading from Mask to Exclude.
Second, personal confidential data like Social Security numbers, driver’s license numbers, bank account numbers or passwords are also great candidates for Exclusion.
The third potential application of Exclude over Mask is definitely the most nuanced. You should consider upgrading from Mask to Exclude for elements where the nature of the information, even in masked form and/or end-user interaction with the element makes it possible to potentially infer personal details about the end-user. Let’s look at a couple of examples.
Example 1: We could imagine that there are healthcare related sites or apps that are meant to collect all kinds of information about an end-user’s medical history. If part of the interface were to contain checkboxes for capture data on the presence of certain medical conditions, it would not be enough to simply obscure the text content in session replay. Because masked elements collect interaction data, it would be possible for someone with good working knowledge of the product to understand which health issues a user was checking the boxes for. Therefore, the best course of action would be to exclude the checkboxes themselves, so that it would be impossible to make these kinds of inferences.
Example 2: This second example comes to us from the financial technology sector. Many different services exist for managing various aspects of one's finances. These include banking apps, investment apps, apps for creating and managing budgets, apps for transfering money and even apps for paying taxes. Many of the elements contained in applications like these would be just fine masked. However, there may be fields (like account balance) where even the relative text length might actually be too much information. If you were comparing the session replays of 2 different accounts and one showed a placeholder string for account balance that was three inches long and the other had a placeholder string that was half an inch long, you now know more about these two accounts than you probably need to. So, fields like account balance are good candidates for upgrading from Mask to Exclude.
Hopefully these suggestions have helped make it more clear when to consider Exclude over Mask. If there is ever a situation where you are on the fence, go with the most private option. You’ll sleep better, and it’s the right thing to do!
With the introduction of FullStory’s Preview Mode, Admins now have the ability to test new data capture rules on themselves before pushing these changes live for actual end-users. This should help to increase the confidence that Admins have about new iterations of their data capture settings and should reduce the need to constantly test new data capture rules in an actual staging environment.
As noted briefly in the Settings UI section above, all element data capture rules can now be Scoped. This means that you can set data capture rules to function in four different ways:
To learn more about using scoped rules with FullStory's Preview Mode, please check out the existing help article for Preview Mode .
The FullStory Team awaits your every question.
© 2022 FullStory, Inc | Atlanta ◆ London ◆ Sydney

Table of contents

Exit focus mode

Light

Dark

High contrast

Light

Dark

High contrast

This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
Microsoft Outlook or the Outlook Web App (OWA) doesn't display full details of private appointments on shared calendars.
This issue occurs if you have the default permissions on a shared mailbox calendar, and it occurs even if you create the private appointment.
You may experience different symptoms that depend on the version of Outlook and Exchange that you are using. For example, Outlook Web App in Exchange Server 2010 doesn't display the full details, but Outlook Web App in Exchange Server 2013 does.
To fix this issue, use one of the following methods:
This issue doesn't occur in Outlook Web App in Exchange Server 2013, Exchange Server 2016, and Exchange Online (Microsoft 365). This issue may occur in some older versions of Outlook.

Main Page

Discuss

All Pages

Community

Interactive Maps

Recent Blog Posts

KingOfMoths

TheRealASFALAF2007

Misry6

Valkerone

Kronika X Cetrion

The King Peacock

JackTemper345

Magma MK-II

AustinDR

Love Robin

BeholderofStuff

Jester of Chaos

Lucariobot

Ordeaux26

The Pro-Wrestler

Red Chevalier

Valkerone

694244

Looperreallyreallysucks

Mesektet

Pure Evil Criteria

Pure Evil Proposals

Proposal Permissions

Discussion Dates

Main Page

Discuss

All
Teen Pussy Outdoor
Www Private
Emma Lesbian

Full Private

Report Page