Session Recording, Heatmaps & User Behavior

Paid pluginsize Lplanned, not built

Indicative price, not an offer: $19-49/mo; anchor: Clarity free or $25/mo MIDA

Generated from docs/plan/paid/session-recording-heatmaps-user-behavior/PLAN.md in the AstroBaaS repository. Nothing described below is implemented — it is the written plan for it.

Session Recording, Heatmaps & User Behavior provides session replay video (watch what customers do), heatmaps (see where they click/scroll), and cohort analytics to understand why customers abandon and where conversion flows break.

The problem

Merchants don’t know why customers abandon carts; they need session replays and heatmaps to see where they drop off.

What it does

• Session replay: record browser activity (clicks, scrolls, form fills, navigations), playback as video
• Heatmap: visualize clicks/taps, scroll depth (red=high, blue=low)
• Scroll depth: % of page scrolled
• Form analytics: which fields skipped, left blank, cause drop-off
• Cohort analysis: replay abandoned vs completed checkout
• Privacy: anonymize sensitive data (CC#, passwords, emails)
• Session filtering: find by URL, time, device, browser, geo
• Rage clicks: rapid clicks on same element
• Dead clicks: clicks on non-interactive elements
• Conversion funnel: pages visited before abandon
• Video export: download replay
• GDPR: customer can request deletion

What it deliberately does NOT do

Each boundary carries its reason. A boundary without a reason gets crossed by the next person who reads this.

• Live monitoring (real-time alerts) — historical replay only
• Predictive drop-off (ML model) — analytics feature
• Automated action (show help chat if stuck) — automation separate
• Cross-site tracking — single store only
• Third-party tool sync (Mixpanel, etc.) — isolated
• Consent UI (scope assumes consent handled) — out of scope

Data model

SessionRecording: id, store_id, customer_id (nullable), session_uuid, started_at, duration_seconds, page_count, device, browser, geo_country. SessionEvent: id, recording_id, type, timestamp, url, x, y, scroll_depth_percent, element_selector, element_text (anonymized). Heatmap: id, store_id, url, heatmap_type, heatmap_image (SVG/PNG), generated_at, date_range. SessionAnalytics: recording_id, rage_click_count, dead_click_count, time_to_add_to_cart, time_to_checkout, conversion, exit_page. Migration: add 4+ tables.

API

• GET /admin/sessions/recordings
• GET /admin/sessions/recordings/{id}
• GET /admin/sessions/recordings/{id}/video
• DELETE /admin/sessions/recordings/{id}
• GET /admin/heatmaps
• GET /admin/heatmaps/{id}
• POST /admin/sessions/recordings/export
• GET /admin/funnels/checkout

Every route added here must also appear in src/pages/openapi.json.ts — a test fails the build if it does not.

Admin

Sessions list: filter device/browser/conversion/date; sort by rage-click. Replay player: timeline, mark events, element selector. Details: device/browser/geo/entry/exit/time/rage/dead clicks/conversion. Heatmap viewer: select URL, see image. Form analysis: field abandonment. Funnel dashboard: landing to product to cart to order, drop-off rates. Bulk export: JSON.

The seam — why this is paid

Core owns: storefront event hooks/tracking script, session storage, GDPR deletion. Paid module owns: replay video rendering (rrweb), heatmap generation/visualization, form analytics, funnel calc, filtering UI.

Paid module owns replay video recording, storage infrastructure, heatmap rendering, and session analysis; core cannot store video

Dependencies

• customer-profiles (optional)

Acceptance checks

Each of these must be able to fail. Before claiming this is done, break the code deliberately and watch each one go red.

• Visiting storefront loads tracking script; interactions sent every 10 seconds
• Recording 100 events; replay shows video of interaction timeline (click 5s on Add-to-Cart, scroll 10s)
• Export to JSON shows events with timestamps
• Heatmap /products from 1000 sessions; click density shows most-clicked products
• Anonymization: payment field shows [REDACTED], not plaintext card
• 5 rapid clicks on Add-to-Cart (2s) flagged as rage click
• GDPR delete request: video deleted, unrecoverable
• Funnel: 1000 visits to product (900) to cart (700) to checkout (300) to order (250) = 25% conversion

Risks

Video storage unbounded; 1M sessions = 10B GB (must archive or 90-day retention). Tracking script slows storefront (lazy-load, batch events). Sensitive data not redacted. Session UUID guessed. Heatmap generation slow (background-queue). GDPR delete doesn’t actually delete. Cross-domain tracking.

Commercial context

The anchor is what the nearest equivalent charges on Shopify or Magento today. It is context for a pricing decision, not the decision.

---

Generated from the commerce plan. See docs/COMMERCE-PLAN.md for the full catalogue and ../../AI-GUIDE.md for how to work on this repository.