SDK: Privacy and security
Privacy and data
What the SDK stores in the browser:
| Where | Key | Value | Why |
|---|---|---|---|
localStorage | ft_<surveyId> | Session ID | Recognize a returning visitor, so an answered or dismissed survey doesn't show again |
- The SDK sets no cookies.
- If
localStorageis unavailable, the session lives in memory, and every page load starts a new session. - With repeat responses allowed, the key is removed after each answer, so the next visit starts a new session.
- To reset a survey for yourself while testing, delete the
ft_<surveyId>key in DevTools or use a private window.
What the SDK sends to feedback.tools:
- the score, the text and the email that the respondent submits;
metadataand the current page URL (page_url);userId,userEmailandlanguage, if you pass them;- screenshots, only those the respondent captures and keeps;
- open events of the survey and close events of the popup.
The "Powered by" link adds your site's host to its URL as ?ref=.
Content Security Policy
If your site sends a Content-Security-Policy header, allow these sources:
| Directive | Source | Why |
|---|---|---|
script-src | Host of __SDK_URL__ | The SDK script |
style-src | Host of __SDK_URL__ | The widget CSS. Each widget loads it with a <link> inside its shadow root. Blocked CSS leaves the widget unstyled. |
connect-src | https://feedback.tools | Survey data and responses |
img-src | data: blob: | Screenshot capture and its preview |
The widget loads no external fonts.
A screenshot capture fetches the page's images and fonts again with fetch(), so connect-src applies to them. An image from a host that connect-src doesn't allow comes out blank in the screenshot.
Browser support
Chrome and Edge 111+, Firefox 120+, Safari 16.4+ (iOS 16.4+).