One script tag. Here is exactly what it reads and sends.

<script src="https://api.useskate.com/skate.js"
  data-site="your-site-id" async></script>

Remove the tag to switch it off.

• The request, plus the visible controls and text of the current screen.
• The path and status of same-origin requests, so it can tell whether an action worked.

• Password, card and one-time-code fields.
• Cookies, request headers and request bodies.
• Anything inside an element you mark data-private.

In the browser, as the signed-in user, through your own UI. It has no API keys to your backend. Model keys stay on our server.

Docs and the security page.