How to Update Mobile Privacy Settings in Fullstory

By default, all text nodes will be masked until you choose to either unmask or exclude selectors in the privacy settings.

Before getting into how to update Privacy Settings for Fullstory for Mobile Apps, it's worth clarifying the following terminology: Excluding and Masking.

• Excluding - View “exclusion” refers to the existing process of completely removing a view node and its subtree from the data capture stream. It is replaced with a placeholder node that shows only a rectangle where the original node was displayed. All events targeting it are ignored. This is done upon request using a “blacklist” of nodes to be excluded.
• Masking - View “masking” is the new approach to masking sensitive end-user data from the view hierarchy. A masked node will have all text replaced with irreversibly-transformed placeholder text, meant to resemble a wireframe of the original content. Any view metadata required for rendering, but not containing end-user data, will be preserved. This allows masked and captured nodes to be nested in one another in a way that’s not possible with excluded nodes.

Note: User input within a masked or excluded element will not be searchable within Fullstory.

Exclude element entirely: The inner contents of the element are not captured. Additionally, any clicks, taps or interactions with this element will not be visualized in playback and will not be searchable. Excluded elements are represented in playback with grey and white diagonal lines:

Mask element content on client: The inner contents of the element are not captured. For text nodes, the number of characters and approximate typing behavior will be captured. Taps, clicks, and other interactions will be visible in playback and will be searchable.

Unmask element content on client: All element data is captured.

Capture with user consent: Gives you the ability to selectively capture parts of your site or application based on explicit user consent (more info).

Exclude or Mask Elements using Code-first Approach

We would recommend taking a code-first approach for modifying privacy settings for mobile apps. The complete set of pre-configured classes that may be applied to control privacy are:

To control privacy settings via code, mobile applications can make use of FS.addClass.

For Android:

// The password field should be entirely excluded
FS.addClass(myPasswordView, "fs-exclude");
// The hint label field does not contain PII, so it should always be unmasked
FS.addClass(myPasswordHintLabelView, "fs-unmask");

For iOS (Objective-C):

// The password field should be entirely excluded
[FS addClass:myPasswordView className:@"fs-exclude"];
// The hint label field does not contain PII, so it should always be unmasked
[FS addClass:myPasswordHintLabelView className:@"fs-unmask"];

Modify Privacy Settings using Inspect Mode

1. While viewing a mobile app session, click Page Insights

2. Click Inspect Mode

3. Click an element to inspect it and confirm its selector on the right

4. Click "Create data capture rule" 

5. Update the element privacy setting and save

Select Entire Screen

Often, rather than individually choosing certain elements, it would be much more convenient to unmask a whole section of your application. For example, the home tab of your application might not contain any user input or identifiers. While Inspect Mode does allow you to choose containers of views to unmask, it can be a little tricky depending on how your application UI is structured.

Starting with SDK version 1.43.0, you can now select an entire screen from Inspect Mode for Android (Classic Android) and iOS Apps (UIKit).

How do I select an entire screen?

From Session Replay, go to Inspect Mode as you normally would. When you select an element, a new “Select Entire Screen” button will appear under the selector. Click that button, and it will change the selected element to the selector which maps to the screen container. From there you can create a privacy rule, name the screen element, or use the selector how you normally would from Inspect Mode.

What Frameworks does it support?

Currently, this feature is only supported for Android and iOS Apps built using Android Fragments, or iOS UIKit. 

How does it work? What is a screen?

Android and iOS Applications have different ways of putting content on screen. For now, Fullstory's approach considers the fundamental ways that iOS and Android applications handle navigation and drawing to a screen: 

• On iOS, we use the main UIViewController’s root view as the root for the screen content, tied directly to what we emit as our Navigation events in the Event List. 
  • While iOS doesn’t have a concept of “main” view controller, we try to choose the first non UIKit Navigation based UIViewController in a UIViewController Hierarchy.
• On Android, we use the largest Fragment on screen

Because we approximate what the main content container is, the suggested selector may be more broad or narrow than you may have intended, so it is important to verify your unmasking rules after you’ve created them. Since these selectors have the name of your application’s UIViewController or Fragments, developers should be able to easily recognize their names in the suggested selectors, and verify that they target the correct portions of the application.

Exclusion Example

Masking / Unmasking Example