Skip to content

Ironfang Analytics

Session replay

Watch the visit.
Keep the details.

Session replay that starts on the first page, masks card numbers before they leave the visitor's browser, and keeps the IP address, browser and window size beside every recording.

No card required. One script tag, and recordings deleted after 28 days.

Ironfang Analytics / recordingExample output
/apply00:41 / 01:12
IP address
203.0.113.9
Reported by
Cloudflare
Browser
desktop, chrome, windows
Window
1280 x 900
Time zone
Europe/London
Came from
google.com
3 pages / 1 min 12 s card numbers masked

What a recording holds

The visit, and who made it

Install one script tag and every visit is kept for 28 days unless the visitor opts out: the page as it was, and what the browser reported about itself.

Watch the visit, live or back

The page as the visitor saw it: scrolling, clicks, pointer movement and route changes across page loads. Replay it with speed controls and inactivity skipped, or watch a visit as it happens, a second or two behind, with nothing on the visitor's screen to say so.

See where each page is used

Heatmaps come from the same recordings, with nothing more to install: where visitors click, how far they scroll, what holds their attention and where the pointer rests. Choose desktop, tablet or mobile and the last 7, 30 or 90 days, compare with the period before, and scroll the whole page as a real visitor saw it, the heat over it.

Records from the first page

Recording starts when the page loads and is kept once the visitor interacts, so crawlers and visits nobody touched never use your allowance. Opt a visitor out with one call and their browser remembers it, or ask for consent first and nothing is recorded or requested until your page grants it.

Card numbers never leave the page

Anything that looks like a card number is masked in the browser, and card, CVV, password and one-time-code fields are blocked outright, whatever you set. Mask every form field, all text or whole regions by CSS selector when you need to.

The visitor beside the replay

IP address and whether Cloudflare vouched for it, full user agent, window and screen size, language, time zone, country and the page they came from, for every recording.

Find the one that matters

Search every site at once by date, IP address or network, device, browser, country and entry path, and jump from one recording to every other from the same address or the same browser.

UK hosted, deleted on time

Recordings are stored on our own infrastructure in the UK and deleted after 28 days, with the IP address and every other detail kept with them. Delete one sooner at any time.

Pricing

Free each month, then pay as you go

Every account has these free allowances each month. With Pay as you go switched on, usage past them is charged at the rates below, within the monthly limit you set. Prices exclude VAT.

Kept recordings

Each recording kept: playable, and not discarded as empty or too short.

5,000 recordings free each month

Paid units after the free allowanceRate per 1,000
First 50,000£1.50
Next 450,000£1.00
Above 500,000£0.70

Kept for 28 days as standard.

A recording is counted once, when it ends and is kept: playable, and not discarded as empty, untouched or too short. Visitors who opt out, visits nobody interacts with and sites you have turned off cost nothing. Every account records the same way, with the same masking, visitor details and search.

When the free allowance is used up without Pay as you go, or a usage limit is reached, new visits are not recorded until the allowance renews next month or the limit changes. Your pages keep working and nothing already recorded is touched.

Operational limits

The same on every account. Paying more never lifts them.

  • Recordings stop at 100 MiB by default
  • Recordings of up to 100 MiB at most
  • Recordings of up to 60 minutes
  • Recordings kept for 28 days as standard
  • Up to 10 GiB of recordings kept per account

Questions

What Ironfang Analytics does and what it does not

What counts as a recording?
One browser tab on one of your sites, from its first recorded page until the visitor leaves or goes idle for 30 minutes. It is counted once, when it ends and is kept; one that never becomes playable, or is discarded as empty or too short, is not counted, and a visit across several pages in the same tab is one recording.
Does it record what visitors type?
Only what you allow. Card numbers are masked in the visitor's browser wherever they appear, and card, CVV, password and one-time-code fields are never recorded. Anything else typed into a form is recorded as typed unless you turn on Mask form fields or mask its region by CSS selector.
Why keep the IP address and user agent?
So a recording can be checked when something looks wrong: repeated attempts from one address, a device that does not match the account, a time zone that does not match the country. They are kept with the recording and deleted with it. Your privacy notice should say so.
Will it slow my site down?
The install snippet is about 32 KB. The recorder, about 31 KB compressed, loads only when your site has recording on and the visitor has not opted out, and sends batches in the background.
Who can watch a recording?
Members of your organisation with the permission to read recordings. The replay runs in an isolated frame on its own address, so a recorded page can never act on the portal, and recorded scripts are never run.
Where do heatmaps come from?
From the recordings you keep. Each one is read once, shortly after it ends, for where its visitor clicked, scrolled, rested the pointer and spent time on each page, and a heatmap totals those visits for one page, one kind of screen and a period. It is drawn over a real visit, the page as it was in its first moments with your masking applied. To make it the recorder adds only when the tab is hidden and the page's height. Visits that are opted out, not kept or past your allowance are not in it, and it covers only the recordings you still keep.
Can a visitor tell when someone is watching live?
No. While you watch, their browser sends what it records every second instead of every ten. Nothing on their page changes, and nothing is shown, stored or logged in their browser to tell them.
How are one visitor's recordings linked?
Once a browser is recorded it keeps a random visitor id in local storage and sends it with each new recording, so a second tab or a return visit sits beside the first. It is made from nothing about the visitor, it is not a cookie, and opting out deletes it.
What is not available yet?
Video exports and MCP tools. Recording, replay, live viewing, heatmaps, search, visitor details and deletion are available now, in the portal and the REST API.

Less to operate. More to ship.

See what your visitors saw.

Add a site, publish one DNS record to prove it is yours and install the snippet.

No card required. Card numbers and password fields are never recorded, and any visitor can be opted out.