URL privacy
Control how browser URL metadata is attached to submissions.
URL privacy
By default, the SDK attaches privacy-safe URL metadata to each submission:
- Included:
origin+pathname - Excluded: query strings and hash fragments
That preserves screen context without leaking tokens, invite codes, or other sensitive query state.
Modes
Configure on DeckProvider (or on low-level submitFeedback via urlCapture):
urlCapture | Behavior | Example sent as meta.url |
|---|---|---|
"path" (default) | Origin + pathname only | https://app.example.com/settings/billing |
"full" | Full window.location.href | Includes ?token=… and #… if present |
"none" | Omit URL metadata | undefined |
<DeckProvider
publishableKey={pk}
user={{ id: user.id, email: user.email }}
urlCapture="path" // default — recommended
>
{children}
</DeckProvider>Full URL (opt-in)
urlCapture="full"Use only when you are certain full URLs never contain secrets.
Disable URL metadata
urlCapture="none"Low-level client
await submitFeedback({
publishableKey: pk,
user: { id: "u1" },
urlCapture: "none",
submission: { widgetId: "wgt_…", sentiment: "positive" },
});