What next-story records, and what it does not

Per event: the event type, the normalized route pattern (for example /orders/[id]), a timestamp, a per-tab id, a sequence number, the session id and the anonymous id. Rage and dead clicks add a click-target label of at most 32 characters and a click count or effect latency. Conversions add the name the site gave them.

Per batch: whether consent was granted, the release id the site supplies, the SDK version and whether the 200-event session cap was hit.

Per session (written by the worker): entry and exit route, the ordered list of routes, duration, rage and dead click counts, outcome, consent coverage and a synthetic-traffic flag.

Query strings and hash fragments are removed from every URL, in the browser and again on the server. Raw IP addresses are never stored; a hash salted per day is used only for rate limiting. The user-agent string is read to flag known bots and is not stored.

Click labels are scrubbed: email addresses, phone numbers and runs of four or more digits are replaced. Password, hidden, one-time-code and payment-card fields get no label at all, and any element marked data-ns-no-label is skipped.

No keystrokes, form values, page content, screenshots or DOM snapshots.

The recorder sets first-party cookies and uses browser storage. When the site signals that consent is withdrawn, the SDK deletes __ns_aid and __ns_sid and purges the queue. Safari limits script-set cookies to 7 days, so __ns_aid is often re-minted there.

The SDK reads one consent signal that the host site sets. By default an unset signal is not treated as a refusal, so recording starts unless the site says no. A site that needs opt-in consent sets requireConsent: true, and then nothing is recorded until the visitor agrees. Each batch carries the consent flag.

Raw events are kept for 14 days by default and removed by dropping whole daily partitions. Session summaries carry the anonymous id and have no automatic expiry; the operator decides how long to keep them. Daily rollups hold no identifiers.

An erasure request only has to touch raw_event and session_summary. Identity links are append-only rows the operator controls.