Data collected

On every page (automatic aggregates)

Page Insights records page views, available timing, external referrer hostnames, and browser and operating-system families, alongside campaign, device and country breakdowns. It also counts, once per page or SPA route, the first uncaught JavaScript error or unhandled rejection, the first failed request, the first rage click (three clicks on one element inside two seconds) and the first dead click (a control that changed nothing within a second). For the error and the failed request one sample is kept per distinct error per day: the redacted message with its source file and line, or the request method, URL without its query string, and status. No stacks, request bodies, headers, selectors, full user-agent strings, visitor identifiers or referrer query strings are stored in these automatic aggregates. Timing is not available for SPA route changes. Automatic aggregates are retained for 91 days by the scheduled retention job.

One beacon per page view and per widget open carrying: page path (no query string), utm_source / utm_medium / utm_campaign, and a device class. The server adds a country code from the IP address and drops the IP. Stored as daily totals per page, campaign, country and device, capped at 500 paths and 50 campaign values per day.

When a visitor sends feedback

• Always: rating and/or message, page URL and title, referrer, UTM tags, device class, browser, language, timezone, viewport, page timing.
• Problem reports and ratings of 1–2 add: last 20 failed requests (method, URL without query, status, duration), last 50 console errors/warnings (≤300 chars each), last 20 JavaScript errors, last 5 click targets as CSS selectors.
• Optional: an email or phone number the visitor chooses to leave, with their opt-in. With an email and opt-in, the visitor can receive an optional receipt and, once the report is marked fixed, one email saying so; both carry a private link to the report's status page.
• Optional: facts your own code attaches with data-version or window.backwire.set(), up to ten short strings.

Redaction

Applied in the browser and again on the server to messages, console lines, error messages and request URLs: email addresses → [email]; bearer tokens, JWTs, API keys and 32+ character hex or base64 runs → [token]; 13–19 digit runs → [card]; query strings removed entirely.

Limits

Message ≤ 2,000 characters, contact ≤ 200, context ≤ 32 KB, request body ≤ 64 KB. Rate limits per visitor and per project; Cloudflare Turnstile checks run invisibly and failures are stored as spam rather than shown to the visitor.