While an audit runs
Snags records nothing until you start an audit on a website, and then only on that website's pages.
While an audit runs, Snags keeps a short record of the page in your browser's memory:
- what changed on the page, for the replay, covering the last 30 to 60 seconds
- the steps you took: pages opened, clicks, which fields you typed into, the Enter, Escape and Tab keys, and scrolling
- console errors and warnings, uncaught errors, and network requests that failed
None of this leaves your browser until you save a comment, and the heavy parts don't leave it until you publish.
What a comment contains
You write what's wrong. The comment then carries:
- the page's address and title, with the query string and fragment removed and anything in the path that looks like a secret replaced
- the element you clicked: its selector, where it sat on the screen, the start of its visible text and, when the page exposes it, the component that rendered it (see Source context)
- a screenshot cropped to the element with some room around it and the element outlined, plus the whole viewport as a Full view
- a replay of the moments before the comment
- the steps you took before it, as a list of plain actions
- console errors, uncaught errors and failed requests from about 30 seconds before it
- the page's state: browser zoom, scroll position, light or dark colour scheme, reduced motion and connection type
- the site's release, commit and environment, when the page announces them
Once per audit, Snags also records the browser it ran in: the browser and its version, the operating system, the device type, the screen size and pixel ratio, the language and time zone. It records nothing that identifies a person: no IP address, user-agent string, fonts, other extensions or hardware details.
Failed requests
For a request that failed, Snags keeps the method, address, status and timing, and its request and response headers and bodies, so the comment shows the actual error.
Headers that carry credentials, such as Authorization, Cookie and anything named like a token, session or API key, are replaced with [redacted]. Bodies are swept for secrets and cut short. Form uploads and binary bodies are never kept.
Masking
Typed values are never captured. Screenshots and replays hide what's typed into inputs, text areas, dropdowns and editable regions, and your steps say which field you typed into, never what.
Console messages, errors, request details and the page text in replays are swept for secrets before they leave the browser: passwords, tokens, API keys, JWTs, card numbers and email addresses are replaced.
Hide more of a page
Snags respects the privacy markers a site may already use:
- Masked: text inside
data-snags-mask,data-rebase-mask,data-private,.rr-mask,data-sentry-maskand.fs-maskbecomes asterisks in replays and is covered in screenshots. - Blocked: elements marked
data-snags-block,data-rebase-block,.rr-block,data-sentry-block,.fs-excludeand.lr-hidebecome empty boxes.
Snags' own toolbar and outlines are always left out of screenshots and replays.
Replay
The replay is a recording of what changed on the page, not a video. When you save a comment, Snags freezes the recording before it hides its own toolbar for the screenshot, so the replay ends on the moment you were looking at.
If you moved between pages of the site, the earlier pages are joined in front, up to 90 seconds back. A replay is at most 4 MB, compressed.
People with the link press Replay to watch it. Exported files can't play replays, so they animate your steps over the screenshot instead.
Automatic checks
After the first comment on each page, Snags runs three checks on that page and keeps what it finds with the audit:
- Accessibility: an automated scan of the page for issues such as missing labels and low contrast.
- Layout shift: how much the page moved while it loaded.
- Broken links: up to 40 links to other pages of the same site, checked for errors.
The findings appear on the audit page, in its Markdown export and to coding agents.
Where it's kept
The text of each comment syncs to Snags as you write it, as a draft. Screenshots, replays and errors stay in your browser (in IndexedDB) until you publish, and then upload with the audit.
Drafts that are never published are deleted after 7 days. Free links last 7 days. Pro and Team links last until they're deleted. See Billing and plans for storage limits, and the privacy policy for the details.