What The Snippet Collects

The snippet (t.js) records what people do on the pages it is installed on, and attaches it to the signed-in person where there is one. This is the full list.

What It Records

Pages

Page views, including moves between pages inside a single-page app, with the page address, the referrer, any campaign tags in the address (UTM tags and ad click IDs), time on page and how far down each page people scrolled. Parameters that look like secrets are removed from every address before it is sent, whether the page, the referrer, a clicked link or where a form posts, and are never kept as campaign tags: common secret names such as token, code, state, password, key, session and signature, names such as reset_token, client_secret, api_key and user_email, and any parameter whose value is an email address.

Clicks

Each click with the element clicked (its label, link and where on it the click landed), rage clicks, clicks that did nothing, and clicks on outbound, download, email and phone links. A clicked form field is named by its label, placeholder or name. What is typed or picked in a field, or written in a text editor on the page, is never sent with a click, hover or view.

Pointer and attention

Pointer movement, sampled into a coarse grid for heatmaps; where the pointer rested; which parts of the page came into view; active and idle time; leaving and returning to the tab; and the pointer heading off the page to leave.

Forms

Which fields were used, how long each took, whether it was filled and how many characters it holds, validation errors (which check failed, never what was typed), forms started but never sent, and submits.

Content

Text selected, copied or pasted, as a length only; files picked in a file field, as count, size and type only, never their names; video and audio played, paused and finished; printing.

Errors and speed

JavaScript errors, files that failed to load, failed or slow network requests (the address, status and timing, never what they carried), page load timing and Core Web Vitals.

Device

Browser and operating system, screen and window size, language, time zone, touch support, connection speed, the processor cores and memory the browser reports, and light or dark and reduced-motion preferences.

Who it is

For a signed-in person, their email, and their name and picture where the login provides them, read from the sign-in session, your site's own responses or an account screen. On a form with no password field, such as a newsletter, waitlist, contact or demo form, the email typed in and any name fields beside it, which makes that person a lead. See how the snippet recognises who is signed in.

What It Never Reads

• Sensitive fields. Password and hidden fields, and fields named for card numbers, CVV, PINs, account, routing or IBAN numbers, social security numbers, dates of birth, tokens or secrets. Nothing they contain is sent. Add data-behavly="mask" to any other field to treat it the same way.
• Login tokens themselves. Only the claims named above are read from a sign-in session; the token is never sent.
• What was copied, pasted or selected, and the names of files picked.

The snippet sets no cookies. It keeps a random anonymous ID in the browser's local storage.

IP Addresses Are Not Stored

Country is derived from the request at the edge, and the IP address is discarded rather than stored. You get the country column; Behavly does not keep the address it came from.

Bots Are Tagged, Not Dropped

Bot traffic is recognised and flagged as it arrives, then left out of what you see: a device counts only through its human sessions. Tracking → Heatmaps and Insights apply the same rule, so their totals agree.

Password Forms Are Skipped

The snippet never identifies anyone from a form containing a password field. Such forms are skipped entirely rather than having their other fields read.

Opting Out

A visitor who opts out is not recorded in that browser from then on. Call behavly.optOut() from your own consent banner, or behavly.consent(false), which also records the withdrawal.

Browser privacy signals (Global Privacy Control and Do Not Track) are not honoured by default, because some browsers send them for every visitor. To honour them for a site, ask Behavly Agent to respect privacy signals for it, which takes effect at once, or add data-gpc="respect" to the script tag.

Turning Parts Off

Attributes on the script tag switch parts of the snippet off for that site:

data-identity="off"

No automatic recognition of who is signed in.

data-network="off"

Recognition never looks at your site's own responses.

data-heatmap="off"

No pointer movement is sampled.

data-autocapture="basic"

Keeps page views, clicks, scroll and forms, and drops the finer detail: pointer and attention, content, errors and speed, and form field timing.