Everything in one script
Replay, issues, analytics and AI Insights share one set of sessions, and every plan has all of them. Jump to the part you care about.
The cause, explained before you go looking
No searching, filtering or report building. As soon as a new error, failed request or on-screen message reaches a visitor with a replay, the AI reads the evidence and writes what happened, up to 3 likely causes and one fix, then looks again once 3 visitors have met it. It shows up at the top of your Overview and Issues pages.
Photo uploads over 10 MB fail without a message
Visitors who add a photo larger than 10 MB see the upload spinner stop with nothing on screen. The upload request fails with 413, and the listing is saved without its photos.
The upload server rejects files over 10 MB, and the page doesn’t handle the error.
Resize photos in the browser before upload, and show an error when an upload fails.
The number of sessions with this issue should fall.
The problems visitors hit, including the ones your code never reports
When a session ends, its replay is read for error messages and not-found pages. Everything is grouped into issues by message, request or element, and ranked by sessions affected, severity and how recent it is.
On-screen errors and not-found pages
Error banners, alerts, field errors and not-found pages, read from the replay once they’ve been on screen for half a second. Your code doesn’t need to log anything. Messages that read as normal validation, like “Invalid email or password”, go to Low signal.
Errors and failed requests
JavaScript errors and unhandled rejections with their stack, and failed fetch and XMLHttpRequest calls (axios too) with method, status and timing.
Rage and dead clicks
Rage clicks: 3 clicks within a second in the same spot. Dead clicks: a click on a link or button after which nothing on the page changes for 3 seconds.
Turn-backs
A visitor clicks a link, reaches the next page, and comes back or leaves the site within 10 seconds. Counted per link over 28 days of human traffic, split by signed-in and signed-out visitors.
Form struggle
A visitor submits a form 3 or more times without reaching another page, or submits and never leaves. A form becomes an issue once 5 or more sessions, and at least a quarter of the people submitting it, struggle.
Dead inbound links
When people land on a missing page from outside your site, the not-found issue shows where they came from: the top UTM source or referring site.
Regressions and groups
Mark an issue resolved and it comes back as Regressed, with the release it returned in. Issues of the same kind that mostly hit the same sessions are grouped into one row, so one bug isn’t three.
Watch the visit, with the activity beside it
Replays skip the idle stretches and mark errors, failed requests, rage clicks and dead clicks on the timeline. The activity list beside the player shows every page view, click, form submit, error and on-screen message. Open a replay from an issue and it starts at the problem.
- Input values masked in the browser by default. Add data-at-mask or data-at-block for anything else
- Route changes in single-page apps are recorded as page views, with no extra code
- Add release to init() and every issue shows the release it started in
Only people in your numbers
Every session is scored on signals such as a webdriver flag, a headless screen size, a crawler user agent and whether a pointer ever moved. Likely bots and bots are Filtered out of reports, and so is your own team once you list your hosts or mark staff. Each session shows its tier and the reasons, and you can change it.
Private by design. We never sell your data.
Privacy rules for each region are built in, and you choose how strict they are. Turn on rules by location and visitors in the EU, UK, Switzerland and Quebec are only counted, with no replay, until they consent.
We never sell your data
Your data, and your visitors’ data, are used to run your dashboard and are never sold. Read the privacy policy.
Masked in the browser
Input values are masked before anything leaves the page. Add data-at-mask to hide an element’s text or data-at-block to leave it out. Tokens, emails and passwords in URLs are redacted in the browser too.
No IP addresses in your data
Visitor IP addresses are used to look up country and network. They aren’t saved with events or sessions.
AI Insights can be turned off
The AI gets page outlines and short timelines, never session or user IDs, IP addresses or locations. Page text you haven’t masked can be included. Anthropic doesn’t train its models on what is sent through its API (Anthropic’s policy).
Delete on request
Export or delete everything tied to a signed-in user, and set how long data is kept for each site.
Rules kept current
Location rules come from c15t’s open-source privacy rule set, checked for updates at least every six months.
One script, one dashboard
Replay, issues and analytics share one set of sessions, so every chart opens the replays behind it.
Capture
- Page views, clicks, form submits, scroll depth and time on page, captured automatically
- Custom events and signed-in users
- Release tagging
- Retries and an offline queue, so data survives flaky connections
Issues
- JavaScript errors with stack
- Failed fetch and XHR calls
- Rage and dead clicks
- On-screen errors and not-found pages
- Form struggle and dead inbound links
- Related issues grouped into one row
- Resolve, ignore or mute until a date
- Low signal for known noise
Replay
- Full page replay with idle time skipped
- Timeline markers for errors and frustrated clicks
- Activity list and journey beside the player
- Opens at the moment of the issue
AI Insights
- Powered by Claude Opus 5.5 from Anthropic
- On for each site, off with one switch
- Top 10 issues kept explained
- Causes cite replay moments
- Also explains turn-backs and drops in your Key flow
- Helpful or Wrong on every Insight
Analytics
- Overview with Engaged visitors, Quick exit rate, Active time and Key flow conversion against the previous period
- Unusual traffic days marked, with how those visitors fared
- Pages with scroll depth, journeys, top clicked elements and turn-backs
- URLs with IDs grouped automatically, like /orders/:id
- Trends, Funnels, Retention and an Event log
- Locations, sources, devices and browsers
Data quality and privacy
- We never sell your data
- Bot scoring with reasons
- Internal traffic by host or staff user
- Masking and URL redaction
- Privacy rules by location, with three settings
- Retention per site
- Export or delete one user’s data
Admin
- Multiple sites, each with its own keys
- Ingest-only and erasure API keys
Feature requests
Missing something you need? E-mail [email protected] and tell us.
Claude Opus 5.5 from Anthropic, through the Anthropic API. The AI only sees the evidence for the issue it is explaining.
The evidence for one issue: up to 5 affected sessions and up to 2 that went fine, the 30 seconds around the problem in each, an outline of the page, the device type, the browser and its major version, whether the visitor was signed in, and the issue’s counts. Never session or user IDs, IP addresses, locations, network names, full user agents or form values. Page text you haven’t masked can be included. “What the AI saw” shows the exact evidence for every Insight.
AI Insights are on for each site unless you turn them off in its settings. A few times a day the AI reviews your top issues, and it takes a first look at new ones from the first visitors who meet them. An issue is reviewed again if it grows or comes back after you resolve it. Each review uses one of the AI Insights in your plan.
No. OnProd sends Claude the evidence for an issue through the Anthropic API, and Anthropic doesn’t train its models on what is sent through its API. Read Anthropic’s policy.
Yes. Input values are masked by default. data-at-mask replaces an element’s text with asterisks, data-at-block leaves it out (it shows as an empty box), and maskAllText: true masks all text. Masking covers text, not attributes such as title, alt or aria-label, so block elements whose attributes hold personal data.
Yes. Route changes through the History API, which React Router, Vue Router, Next.js and most routers use, are recorded as page views and in the replay.
One visit. A session ends after 30 minutes without activity. A visitor who is only counted under your privacy settings stores nothing in the browser, so each of their page loads is its own session.
Each session is scored from signals like a crawler user agent, a webdriver flag, an 800x600 headless screen, no pointer movement and a single page load with no clicks. 4 to 5 points is Likely bot, 6 or more is Bot, and both are Filtered out. Playwright, Cypress and Selenium runs are caught the same way. You can mark any session as human.
No. Your data, and your visitors’ data, are used to run your dashboard and are never sold. Read the privacy policy.
Yes. With privacy rules by location on, visitors in the EU, EEA, UK, Switzerland and Quebec are only counted, with no replay, until they consent, and in US privacy-law states a browser that sends Global Privacy Control is treated the same. Inputs are masked in the browser, IP addresses aren’t saved with events or sessions, and you can delete a user’s data or set how long data is kept. Your consent banner and privacy policy are still yours to provide. Our data processing agreement is still a draft and not in force yet; ask us for a copy.
By default your consent setup decides and everything is recorded. You can switch to counting without consent in opt-in regions (EU, UK, Switzerland, Quebec, and unknown locations, currently including all of Canada) or everywhere. Call grantConsent() from your banner, and revokeConsent() to stop and clear what the SDK stored in the browser. OnProd doesn’t provide the banner.
Yes for signed-in users: export or delete everything tied to a user ID in Settings. You can also set how many days data is kept per site. Until you set it, data is kept for as long as you have a trial or plan.
See it on your own site
Free for 30 days, no card needed. Set-up takes two tags.