> For the complete documentation index, see [llms.txt](https://docs.luciq.ai/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.luciq.ai/product-guides-and-integrations/product-guides/luciq-pii-masking.md).
# Luciq PII Masking
### 1. Core Principles
All PII masking in the SDK happens client-side, on the device, before any data is written to encrypted local storage or transmitted to the backend. The masking model rests on a few non-negotiable principles:
* **Masking is on-device.** Sensitive regions are painted over in the bitmap itself, and network values are stripped at capture time. The SDK never persists a raw, un-masked image.
* **The backend never decodes anything.** The backend receives data that is already masked. There is no server-side step that could reverse masking — the unmasked value simply never exists off-device.
* **Developers decide what is masked.** Masking is driven by SDK configuration and per-view marking in app code, supplemented by an automatic safety net.
* **Two surfaces are covered.** Visual content (screenshots, repro-step images, session replay frames) and network logs (headers, query parameters, payloads).
{% hint style="info" %}
**Where it applies:** Screen masking covers repro-step screenshots, bug-report screenshots, user steps, and Session Replay frames. Network masking covers all captured network logs. Auto type-based masking applies to screenshots only (not screen recordings).
{% endhint %}
### **Masking & Privacy Controls**
{% columns %}
{% column width="50%" %}
{% content-ref url="/pages/wrCUylbtHB995SSb1zTs" %}
[Screen & Screenshot Masking](/product-guides-and-integrations/product-guides/luciq-pii-masking/screen-and-screenshot-masking.md)
{% endcontent-ref %}
{% content-ref url="/pages/i2pm0Z9BoT8cMU2FB9Lo" %}
[User Steps Privacy API](/product-guides-and-integrations/product-guides/luciq-pii-masking/user-steps-privacy-api.md)
{% endcontent-ref %}
{% content-ref url="/pages/GHPij3Y1GCFnBaLeggbC" %}
[Server-Driven UI (SSUI) Setup](/product-guides-and-integrations/product-guides/luciq-pii-masking/server-driven-ui-ssui-setup.md)
{% endcontent-ref %}
{% endcolumn %}
{% column width="50%" %}
{% content-ref url="/pages/HgVYqbH4ppVpjPu1krm2" %}
[Network Log Masking](/product-guides-and-integrations/product-guides/luciq-pii-masking/network-log-masking.md)
{% endcontent-ref %}
{% content-ref url="/pages/UMRTJytxb4sqPQ6K0VCd" %}
[Repro Steps Control](/product-guides-and-integrations/product-guides/luciq-pii-masking/repro-steps-control.md)
{% endcontent-ref %}
{% content-ref url="/pages/cRx294gNEJqHqlUH40gr" %}
[Additional Privacy Control](/product-guides-and-integrations/product-guides/luciq-pii-masking/additional-privacy-control.md)
{% endcontent-ref %}
{% endcolumn %}
{% endcolumns %}
***
### 2. Best Practices & Pre-Production Checklist
{% columns %}
{% column width="50%" %} **DO**
* Always mask financial information (credit cards, bank accounts, CVV).
* Mask personal identifiers (e-mail, SSN, national IDs).
* Mark authentication screens private (passwords, PINs, OTPs, security questions, etc.).
* Mask health and medical information.
* Test masking before every production release.
{% endcolumn %}
{% column width="50%" %} **DON'T**
* Don’t rely on grayscale alone for privacy.
* Don’t assume any backend masking exists — masking is client-side only.
* Don’t enable Session Replay for all users without a consent flow where required.
* Don’t capture screens displaying sensitive documents.
{% endcolumn %}
{% endcolumns %}
#### 2.1 Verification steps
* Mark views as private in code.
* Trigger a session in the app.
* Navigate to the screen containing the private views.
* Open the session/replay in the dashboard.
* Confirm masked areas appear as solid black rectangles.
* Validate with every new screen added in the app that has private data.
#### 2.2 Pre-production privacy checklist
* [ ] All text input fields are automatically masked.
* [ ] Login / authentication screens are marked private.
* [ ] Payment screens are marked private.
* [ ] Personal-information screens are marked private.
* [ ] Sensitive network requests are obfuscated or omitted.
* [ ] User-consent flow is implemented where required.
* [ ] Privacy policy mentions session recording.
* [ ] QA has verified masking works correctly.
* [ ] Legal / compliance has approved.
#### 2.3 Known limitations & troubleshooting
* **Android:** hardware-accelerated views may produce blank screenshots; a media-projection capture API exists (prompts the user to allow recording).
* **iOS:** custom `NSURLSession` needs `enableLoggingForURLSessionConfiguration`; AFNetworking/Alamofire need helper classes; SSL pinning requires the auth-challenge handlers.
* **Flutter:** very rapid animations may occasionally not mask correctly due to the nature of the fluter framework
* Network logs are capped at 1,000 per report.
### 3. Platform support matrix
| Capability | iOS | Android | Flutter | React Native |
| --------------------------------------------------- | ------------------------------------- | ------------------------------------- | ------------------------------------- | ------------------------------------- |
| Auto type-based screenshot masking | Yes | Yes | Yes | Yes |
| Manual private views | Yes | Yes | Yes | Yes |
| Private views in declarative UI (Compose / SwiftUI) | Yes | Yes (Compose) | n/a | n/a |
| Auto network header/query masking | Yes | Yes | Yes | Yes |
| Manual network obfuscate / omit | Yes | Yes | Yes | Yes |
| Grayscale screenshot mode | Yes (Only supported in SessionReplay) | Yes (Only supported in SessionReplay) | Yes (Only supported in SessionReplay) | Yes (Only supported in SessionReplay) |
| Secure-window control (FLAG\_SECURE) | n/a | Yes | n/a | n/a |
| Private views in screen recording | Yes | No — use FLAG\_SECURE | No | No |
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.luciq.ai/product-guides-and-integrations/product-guides/luciq-pii-masking.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.