Fullstory Privacy Strategy

Overview

This guide provides strategic guidance for implementing privacy-conscious Fullstory semantic decoration. It helps developers decide:

• What data to send to Fullstory
• What data to never send
• What data to hash/encrypt before sending
• When to use joinable keys instead of raw data
• How to balance analytics value with privacy protection

Remember: Fullstory is a tool for understanding user experience, NOT a database for storing customer data. Send only what's needed for analysis.

---

Fullstory's Privacy Architecture

First-Party Cookies (Not Third-Party)

Fullstory uses first-party cookies set on YOUR domain, which provides inherent privacy benefits:

Privacy Aspect	Fullstory Approach
Cookie Domain	Set on YOUR domain (e.g., yoursite.com), not Fullstory's
Cross-Site Tracking	❌ Impossible - each site has its own isolated fs_uid cookie
Data Isolation	Your user data is completely isolated from other Fullstory customers
Browser Compatibility	✅ First-party cookies aren't blocked by browsers or ad-blockers
User Control	Users can clear cookies to reset their identity on your site

Key Privacy Guarantee: A user's identity CANNOT be connected across different sites using Fullstory. If the same person visits Site A and Site B (both using Fullstory), they have separate, unlinked identities on each site.

Cookie Transparency

Cookie	Duration	Purpose	User Impact
fs_uid	1 year	Links sessions from same browser	Can clear to "start fresh"
fs_cid	1 year	Stores consent state	Remembers consent choice
fs_lua	30 min	Last activity timestamp	Session timeout management

Reference: Why Fullstory uses First-Party Cookies

Private by Default Mode

Fullstory offers a Private by Default mode—a privacy-first capture approach that inverts the default behavior:

Mode	Default Behavior	Best For
Standard	Capture everything, add fs-mask/fs-exclude to protect	Low-sensitivity sites
Private by Default	Mask everything, add fs-unmask to reveal	High-sensitivity applications

How Private by Default Works:

1. All text is masked by default - No text captured unless explicitly unmasked
2. Zero accidental exposure - Impossible to accidentally capture sensitive data
3. Selective unmasking - Add .fs-unmask to navigation, buttons, product names
4. Session replay shows wireframes - See user behavior without seeing data

Recommended for:

• ✅ Healthcare applications (HIPAA)
• ✅ Banking/financial services (PCI, GLBA)
• ✅ Multi-tenant SaaS (customer data protection)
• ✅ Enterprise applications
• ✅ Any application where "default open" is too risky

Enable via:

• New accounts: Select during onboarding wizard
• Existing accounts: Contact Fullstory Support

Reference: Fullstory Private by Default

---

Core Privacy Principles

1. Minimum Necessary Data

"Capture only what you need to understand the user experience."

Data Category	Ask Yourself	Recommendation
User identifiers	Do I need to link sessions?	Use hashed/internal IDs
Names	Do I need the actual name?	Mask or use initials
Emails	Is email essential for lookup?	Hash or use user ID
Addresses	Do I need full address?	Mask street, keep city/state
Financial	Do I need actual amounts?	Use ranges ("$100-$500")
Health	Is this needed at all?	Usually NO - exclude entirely

2. Privacy by Design

Build privacy into your semantic decoration from the start, not as an afterthought:

┌───────────────────────────────────────────────────────────────┐
│  PHASE 1: DESIGN                                               │
│  - Identify all data fields                                    │
│  - Classify by sensitivity                                     │
│  - Determine minimum needed for analysis                       │
├───────────────────────────────────────────────────────────────┤
│  PHASE 2: IMPLEMENT                                            │
│  - Apply privacy controls (exclude/mask/unmask)                │
│  - Hash or tokenize identifiers                                │
│  - Use joinable keys for linkage                               │
├───────────────────────────────────────────────────────────────┤
│  PHASE 3: VERIFY                                               │
│  - Review session replays                                      │
│  - Audit captured properties/events                            │
│  - Test edge cases (errors, modals, dynamic content)           │
├───────────────────────────────────────────────────────────────┤
│  PHASE 4: MAINTAIN                                             │
│  - Regular privacy audits                                      │
│  - Update for new features/fields                              │
│  - Monitor for accidental exposure                             │
└───────────────────────────────────────────────────────────────┘

3. Data Classification Framework

Classification	Examples	Fullstory Handling
Public	Product names, prices, UI text	Unmask
Internal	Order IDs, session IDs	Send as-is or hash
Confidential	Names, emails, addresses	Mask or hash
Restricted	SSN, credit cards, passwords	Exclude always
Regulated	Health data, financial data	Exclude + comply with regulations

---

Decision Matrix: What Data to Send

User Identification

Approach	When to Use	Example
Internal ID	Always preferred	setIdentity({ uid: "user_12345" })
Hashed email	Need email linkage	setIdentity({ uid: sha256(email) })
Raw email	Only if required for support	setIdentity({ uid: "user@example.com" })
Joinable key	Link to external system	setIdentity({ uid: "cust_abc123" })

User Properties

Data Type	Send Raw?	Hash?	Joinable Key?	Exclude?
Account ID	✅
Account tier (Gold/Silver)	✅
Company name	⚠️ Consider		✅ company_id
User's full name			✅ user_id	⚠️ Mask
Email		✅	✅ user_id
Phone				❌ Don't send
Address				❌ Don't send
SSN/Tax ID				❌ Never
Account balance	⚠️ Ranges
Credit score				❌ Never

Event Properties

Data Type	Recommendation	Example
Product ID	Send raw	{ product_id: "SKU-123" }
Product name	Send raw	{ product_name: "Wireless Headphones" }
Price	Send raw	{ price: 199.99 }
Quantity	Send raw	{ quantity: 2 }
Order ID	Send raw	{ order_id: "ORD-789" }
Search query	⚠️ Consider	May contain PII
Error message	⚠️ Sanitize	May contain PII
User-generated content	⚠️ Consider	Comments, reviews

---

Joinable Keys Strategy

Instead of sending sensitive data to Fullstory, send an identifier that can be joined in your analytics warehouse:

The Pattern

                    Fullstory                    Your Data Warehouse
                    ┌─────────────────┐          ┌─────────────────────┐
User Session:       │ user_id: "u123" │    →     │ user_id: "u123"     │
                    │ session_events  │          │ email: "john@co.com" │
                    │ page_views      │          │ name: "John Smith"   │
                    └─────────────────┘          │ ssn: "***-**-****"   │
                                                 └─────────────────────┘
                           ↓
                    JOIN ON user_id
                           ↓
                    ┌─────────────────────────────────────────────┐
                    │ Combined analytics with full PII context   │
                    │ (in YOUR secure data warehouse)             │
                    └─────────────────────────────────────────────┘

Implementation Example

// BAD: Sending PII directly to Fullstory
FS('setIdentity', {
  uid: user.email, // PII!
  displayName: user.fullName, // PII!
  email: user.email, // PII!
})

FS('setProperties', {
  type: 'user',
  properties: {
    ssn: user.ssn, // NEVER!
    phone: user.phone, // PII!
    address: user.address, // PII!
  },
})

// GOOD: Using joinable keys
FS('setIdentity', {
  uid: user.internalId, // Not PII, just an ID
})

FS('setProperties', {
  type: 'user',
  properties: {
    // Business context, not PII
    account_tier: user.tier,
    signup_date: user.createdAt,
    plan_type: user.subscription.plan,

    // Joinable keys for your warehouse
    crm_id: user.salesforceId, // Join to Salesforce
    support_id: user.zendeskId, // Join to Zendesk
  },
})

Joinable Keys for Common Systems

System	Key to Send	Join In Warehouse
Salesforce	salesforce_account_id	Account, Contact objects
HubSpot	hubspot_contact_id	Contact properties
Zendesk	zendesk_user_id	User tickets, interactions
Stripe	stripe_customer_id	Payment, subscription data
Segment	segment_user_id	Full user profile
Internal DB	user_id, account_id	All internal data

---

Hashing Strategy

When you need to identify users but can't use internal IDs:

When to Hash

Scenario	Recommendation
Need email for session linking	Hash email
Multiple systems use email as key	Hash email
Legal requires pseudonymization	Hash all PII
Support needs to find user	Consider: do they need Fullstory or CRM?

Hash Implementation

⚠️ SECURITY WARNING: Client-side hashing is NOT a security control - it's only a privacy measure. JavaScript code is inspectable, and unsalted hashes are reversible via rainbow tables. True security requires server-side processing. Use hashing only to prevent accidental PII exposure in Fullstory, not to protect against determined attackers.

// PREFERRED: Hash on your backend, pass to frontend
// This keeps the hashing logic and any salt server-side
const userFromAPI = await fetchUser() // { id, hashedEmail: "5e884..." }

FS('setIdentity', {
  uid: userFromAPI.hashedEmail,
})

// ---

// ALTERNATIVE: Client-side hashing (less secure, but better than raw PII)
async function hashForFullstory(value) {
  const encoder = new TextEncoder()
  const data = encoder.encode(value.toLowerCase().trim())
  const hashBuffer = await crypto.subtle.digest('SHA-256', data)
  const hashArray = Array.from(new Uint8Array(hashBuffer))
  return hashArray.map((b) => b.toString(16).padStart(2, '0')).join('')
}

const hashedEmail = await hashForFullstory(user.email)

FS('setIdentity', {
  uid: hashedEmail, // e.g., "5e884898da28047d..."
})

Important Considerations

1. Server-side hashing is preferred: Hash on backend, send hash to client
2. Consistent hashing: Always lowercase, trim whitespace before hashing
3. Salt optional for Fullstory: Unsalted hashes allow you to join later
4. Document mapping: Keep record of hash → original for support lookups
5. Not a security measure: Hashing prevents accidental exposure, not malicious extraction

---

Regulatory Compliance Guide

GDPR (Europe)

Requirement	Fullstory Approach
Consent before processing	Use FS('setIdentity', { consent: true/false })
Right to be forgotten	Use Fullstory's deletion API
Data minimization	Use joinable keys, not raw PII
Purpose limitation	Only capture UX-relevant data
Pseudonymization	Hash identifiers

// GDPR-compliant identification
function identifyUserGDPR(user, hasConsent) {
  FS('setIdentity', {
    uid: hashEmail(user.email), // Pseudonymized
    consent: hasConsent, // Explicit consent
  })

  if (hasConsent) {
    FS('setProperties', {
      type: 'user',
      properties: {
        // Only essential, non-PII data
        account_tier: user.tier,
        country: user.country, // May be needed for analysis
        language: user.language,
      },
    })
  }
}

HIPAA (Healthcare - USA)

Requirement	Fullstory Approach
PHI protection	Exclude ALL health-related content
Minimum necessary	Capture only UX metrics
Audit trail	Use Fullstory's audit logs
BAA required	Ensure signed with Fullstory

// HIPAA-compliant approach
// DO NOT capture:
// - Diagnoses, conditions
// - Medications
// - Treatment plans
// - Provider names
// - Insurance info
// - Any PHI

FS('setIdentity', {
  uid: patient.internalId, // Not PHI
})

FS('setProperties', {
  type: 'user',
  properties: {
    // OK: Non-PHI operational data
    portal_type: 'patient',
    preferred_language: 'en',
    login_method: 'SSO',

    // NOT OK - do not include:
    // diagnosis: patient.conditions  ❌
    // provider: patient.doctorName   ❌
  },
})

PCI DSS (Payment Cards)

Data Type	Allowed in Fullstory?
Card number	❌ Never (auto-excluded)
CVV/CVC	❌ Never (auto-excluded)
Expiry date	❌ Never (exclude)
Cardholder name	❌ No (exclude)
Last 4 digits	⚠️ Maybe (for reference)
Card brand	✅ Yes (Visa, MC)
Transaction ID	✅ Yes
Amount	✅ Yes

// PCI-compliant event tracking
FS('trackEvent', {
  name: 'purchase_completed',
  properties: {
    // OK: Non-sensitive transaction data
    order_id: order.id,
    amount: order.total,
    currency: order.currency,
    card_brand: order.payment.cardBrand, // "Visa"

    // NOT OK - do not include:
    // card_number: order.payment.number  ❌
    // cvv: order.payment.cvv             ❌
  },
})

CCPA (California - USA)

Requirement	Fullstory Approach
Right to know	Document what Fullstory captures
Right to delete	Use Fullstory's deletion API
Right to opt-out	Use consent API
Non-discrimination	Same experience regardless of opt-out

---

Data Category Decision Trees

User Identification Decision Tree

Should I send this identifier to Fullstory?
│
├─ Is it an internal ID (no PII)?
│  └─ YES → Send as uid ✅
│
├─ Is it an email address?
│  ├─ Is email required for support lookup?
│  │  ├─ YES → Consider: Can support use internal system instead?
│  │  │  ├─ YES → Send hashed email or internal ID
│  │  │  └─ NO → Send email (document justification)
│  │  └─ NO → Send hashed email
│  └─ Can you link via internal ID?
│     └─ YES → Use internal ID instead
│
├─ Is it a phone number?
│  └─ → Don't send, use internal ID ❌
│
├─ Is it a username?
│  └─ → Could be PII, prefer internal ID
│
└─ Is it SSN/Tax ID/Government ID?
   └─ → NEVER send ❌❌❌

Property Decision Tree

Should I send this property to Fullstory?
│
├─ Is it regulated data (PHI, financial details)?
│  └─ YES → Don't send ❌
│
├─ Does it contain PII?
│  ├─ Is PII necessary for analysis?
│  │  ├─ YES → Can you generalize? (age range vs DOB)
│  │  │  ├─ YES → Send generalized
│  │  │  └─ NO → Document justification, minimize
│  │  └─ NO → Don't send, use joinable key
│  └─ Can you use a joinable key instead?
│     └─ YES → Send key, join in warehouse
│
├─ Is it business context (tier, plan, industry)?
│  └─ YES → Send ✅
│
├─ Is it behavioral (feature flags, A/B variant)?
│  └─ YES → Send ✅
│
└─ Is it operational (version, platform)?
   └─ YES → Send ✅

---

Common Patterns by Data Type

Names

// Options for handling names

// Option 1: Don't send at all (use joinable key)
FS('setIdentity', {uid: user.id})
// Look up name in your CRM/database

// Option 2: Send only first name (if needed for greetings analysis)
FS('setProperties', {
  type: 'user',
  properties: {
    first_name_initial: user.firstName.charAt(0),
  },
})

// Option 3: Mask in UI, don't send as property
// (handled by fs-mask class in HTML)

Email Addresses

// Options for handling emails

// Option 1: Internal ID (preferred)
FS('setIdentity', {uid: user.id})

// Option 2: Hashed email (for cross-system linking)
FS('setIdentity', {uid: sha256(user.email.toLowerCase())})

// Option 3: Email domain only (for B2B analysis)
FS('setProperties', {
  type: 'user',
  properties: {
    email_domain: user.email.split('@')[1], // "company.com"
  },
})

Monetary Values

// Options for handling money

// Option 1: Send actual values (usually OK for transactions)
FS('trackEvent', {
  name: 'purchase',
  properties: {
    amount: 149.99,
    currency: 'USD',
  },
})

// Option 2: Send ranges (for sensitive financial data)
function getAmountRange(amount) {
  if (amount < 100) return '$0-$100'
  if (amount < 500) return '$100-$500'
  if (amount < 1000) return '$500-$1000'
  return '$1000+'
}

FS('setProperties', {
  type: 'user',
  properties: {
    account_balance_range: getAmountRange(user.balance),
  },
})

// Option 3: Percentiles (for comparative analysis)
FS('setProperties', {
  type: 'user',
  properties: {
    spending_percentile: user.spendingPercentile, // 75
  },
})

Dates

// Options for handling dates

// Option 1: Full date (usually OK for non-sensitive)
FS('setProperties', {
  type: 'user',
  properties: {
    signup_date: user.createdAt.toISOString(),
  },
})

// Option 2: Relative time (for age-sensitive data)
function getAgeRange(birthDate) {
  const age = calculateAge(birthDate)
  if (age < 18) return 'under-18'
  if (age < 25) return '18-24'
  if (age < 35) return '25-34'
  // etc.
}

FS('setProperties', {
  type: 'user',
  properties: {
    age_range: getAgeRange(user.dateOfBirth),
  },
})

// Option 3: Don't send DOB (link via joinable key)

Locations

// Options for handling location

// Option 1: Country/region only (usually OK)
FS('setProperties', {
  type: 'user',
  properties: {
    country: user.address.country,
    region: user.address.state,
  },
})

// Option 2: City (if needed for analysis)
FS('setProperties', {
  type: 'user',
  properties: {
    metro_area: user.address.city, // Consider privacy implications
  },
})

// Option 3: Don't send address details
// Full addresses are PII - mask in UI, don't send as properties

---

Privacy Audit Checklist

Use this checklist before launch and periodically:

Session Replay Audit

• Watch 10 random replays from each user type
• Check all form fields for proper masking/exclusion
• Verify error messages don't expose PII
• Check modals and pop-ups for sensitive content
• Review any user-generated content areas
• Verify third-party widgets are properly handled

Properties Audit

• List all setIdentity calls and their values
• List all setProperties calls (user and page)
• List all trackEvent calls and their properties
• For each: Is this data necessary? Is it minimized?
• Verify no regulated data in properties
• Check that joinable keys are used where appropriate

Console/Network Audit

• Check if console capture is enabled
• If yes, verify no PII in console logs
• Review network request capture settings
• Verify sensitive APIs are excluded

Compliance Verification

• Consent mechanism implemented (if required)
• Deletion API integrated (if required)
• Privacy policy updated
• Team trained on privacy requirements

---

KEY TAKEAWAYS FOR AGENT

When helping developers with privacy strategy:

1. Default to privacy: When in doubt, don't send it
2. Joinable keys are your friend: Send IDs, join PII in warehouse
3. Hash when needed: For cross-system linking without raw PII
4. Know the regulations: GDPR, HIPAA, PCI, CCPA have specific requirements
5. Audit regularly: Privacy leaks happen with new features

Questions to Ask Developers

1. "What regulations apply to your business?"
2. "Can you use an internal ID instead of email?"
3. "Is this data necessary for understanding UX?"
4. "Can you join this data in your warehouse instead?"
5. "Have you tested session replay for PII exposure?"

Common Mistakes to Watch For

• Sending email as uid when internal ID exists
• Including PII in event properties "for debugging"
• Not masking dynamically loaded content
• Forgetting about console log capture
• Assuming auto-detection catches everything

---

REFERENCE LINKS

Core Skills

• Privacy Controls - Technical implementation
• User Consent - Consent API
• Identify Users - User identification

Fullstory Documentation

• Privacy Overview: https://help.fullstory.com/hc/en-us/articles/360020623574
• Private by Default: https://help.fullstory.com/hc/en-us/articles/360044349073
• Data Deletion API: https://developer.fullstory.com/deletion
• GDPR Compliance: https://www.fullstory.com/legal/gdpr

---

This skill document provides strategic guidance for privacy-conscious Fullstory implementations. Always consult your legal and compliance teams for specific regulatory requirements.