Replay Shield

About

See who's recording what you type.

Session-replay scripts like FullStory, Hotjar and Microsoft Clarity can capture your keystrokes in a form — before you ever press submit — and send them to a third party. Replay Shield catches them in the act, shows you what they can capture, and blocks them.

DETECT — Two-signal detection (recorder script URLs + live page globals) tells a script that merely loaded apart from one that's actively recording, across the major session-replay tools in use today.

SEE — The Ghost Mirror: focus an email, address, card, or message field on a recorded page and a small mirror echoes your typing — an honest demonstration of what a recorder can receive. Password fields are excluded.

BLOCK — Protect a site with one click; the recorder's scripts and data beacons are blocked using Chrome's declarativeNetRequest. A local "sites that watched me" log remembers where recorders were found.

WHY REPLAY SHIELD
• 100% on-device — detection, the Ghost Mirror, and your log run entirely in your browser. Nothing you type is transmitted.
• Honest by design — it describes only what it observes (that a recorder CAN capture a field) and never claims a company steals your data. Reputable recorders mask password fields; email, address, card, and message fields often are not masked.
• Free forever for the core — detection, Ghost Mirror, caught-sites log, and protecting up to 3 sites. Pro ($2.99/mo) adds unlimited protected sites and always-on auto-protect.

PERMISSIONS
Replay Shield installs with NO access to any website. Detection runs only when you click the toolbar icon, on the current tab. "Always-on protection" across every site is optional and requested only when you turn it on.