Security and privacy
What CEC Feedback captures, what it never captures, who can see it, and how long it's kept.
What's captured with feedback
When someone sends feedback from the widget, CEC Feedback saves:
- what they wrote, and their name and email (as they typed them, or as the site passed them through the SDK);
- a screenshot of the page as they saw it, with their pin and drawings, or their screen recording;
- the page and browser details: address, title, browser and version, operating system, device type, window and screen size, language, time zone and colour scheme;
- the last 200 console messages and the last 100 failed network requests from the page;
- any custom metadata the site attached with the SDK.
What's never captured
- Password fields, always.
- Anything marked by the site:
data-cecfb-maskpaints an element over with grey, anddata-cecfb-ignoreleaves it out entirely. See Keeping data out of screenshots. - Areas the reporter blacked out with the Blackout tool. Masking and blackouts are applied in the browser, before anything leaves the page.
- Request and response bodies. Console and network logs never include them, and query strings are stripped from logged addresses.
- Cookies. The widget sets none.
Who can see it
- The CEC team sees all of a project's feedback in the dashboard, which is behind CEC's
Cloudflare Access sign-in on
feedback.cec.dev. See Members and roles. - Clients see feedback in the widget only as far as the project allows: everyone's, only their own, or none. They never see anything marked Members only.
- Integrations (ClickUp, Slack, webhooks) receive what the team chooses to send them. Webhook payloads never contain reporter emails or logs.
How the widget is protected
- The project key in the snippet identifies the project; it isn't a password. Restrict it to the client's sites with allowed origins, and rotate it if it ends up somewhere it shouldn't.
- Member sign-in from the widget goes through CEC's sign-in, works only on that project's site, lasts 30 days, and ends at Sign out or when the member is removed.
- Requests are rate limited, and every upload is checked for its size and type.
- Stored credentials (integration tokens, screenshot passwords) are encrypted, and never shown again after they're saved.
- Webhooks are signed, so receivers can check they came from CEC Feedback. See Webhooks.
Where data lives
Everything is stored in CEC's own Cloudflare account: feedback in a Cloudflare D1 database, and
screenshots, recordings and logs in Cloudflare R2. Emails are sent through Cloudflare's email
service from feedback@cec.dev.
How long it's kept
| Data | Kept |
|---|---|
| Feedback, comments, screenshots and recordings | Until the project is deleted. |
| Archived projects | Deleted, with all their files, 90 days after archiving. |
| The page copies used to render screenshots | Deleted 30 days after the screenshot is rendered. |
| Uploads never attached to feedback (such as an abandoned recording) | Deleted after 24 hours. |
| Backups | A nightly backup kept for 35 days, plus 30 days of point-in-time restore. |
Deleting a project from Settings › General › Danger removes its feedback and files straight away. To have specific feedback removed sooner, ask the CEC team.