Privacy Policy
How didka collects, uses, stores and protects data.
Last updated: October 2026
Summary
didka is a session replay and user behavior analytics platform. This policy explains what we collect when you use the didka website, demo and panel, which cookies we use, and what rights you have over your data.
By using didka you confirm that you have read this policy. If you do not agree with it, please do not use the service.
What session recording captures
After you install the tracker on your website, didka records visitor interactions: clicks, scrolling, mouse movement, form input, navigation between pages and DOM changes, plus basic browser and device information.
We use this data only to provide didka features such as session replay, heatmaps, funnel analysis and journey tracking.
- Recording happens only on websites where the tracker is installed.
- Users are not tracked across other websites, and data is never shared with third parties.
- Sensitive inputs such as passwords and card numbers are masked automatically; you can set the masking level and excluded pages in the panel.
Cookies and local storage
didka uses these to keep the website secure and working correctly:
- Login cookie auth_token (HttpOnly, SameSite=Lax and Secure in production): keeps your login session; JavaScript cannot read it.
- Cookie csrf_token: protects requests that change data against cross-site forgery.
- Browser local storage (localStorage) with the didka-locale key: remembers your language only.
- The session token is not stored in localStorage.
Payments
Paid plans are bought through the Iranian BitPay payment gateway (bitpay.ir). didka does not store your card details; the gateway handles the payment completely.
Retention and deletion
You choose how long recorded data is kept, per plan and per project. Data older than that period is deleted automatically (the default is 30 days).
You can delete sessions from the dashboard or remove a whole project together with its sessions. After you cancel a plan, data stays available until the end of the paid period and is then deleted by the retention policy.
Data security
See the security page for more details.
- AES-256 encryption at rest and TLS 1.3 encryption in transit.
- Role-based access control, two-factor authentication and audit logs.
- Regular backups, with data stored in secure, access-limited data centers.
Your rights
You can access, export, correct and delete recorded data, and turn recording off for specific pages or projects.
To use these rights, contact us through the contact page or email support@didka.app.
Changes to this policy
If this policy changes, we publish the new version on this page with its update date. If you keep using the service after that, you accept the new version.
See also our Terms of Service.