Feature
Privacy limits in code
What must never be stored is enforced on the client and again on the server.
Query strings and hash fragments are stripped. Raw IPs are never stored; rate limiting uses a hash salted per day. Click labels are cut to 32 characters and scrubbed of email addresses, phone numbers and long digit runs; credential and card fields get no label.
These limits are checked by tests, including a schema audit, rather than by review. Recording is still pseudonymous: events carry an anonymous id from a first-party cookie.