fix(acquisition): close invite privacy gaps

apps/web/app/providers.tsx

@@ -4,6 +4,7 @@ import posthog from 'posthog-js'
 import { PostHogProvider as PHProvider } from 'posthog-js/react'
 import type { CaptureResult } from 'posthog-js'
 import { useEffect } from 'react'
+import { usePathname } from 'next/navigation'
 
 const INVITE_PATH_PATTERN = /\/join\/[^/?#\s]+/g
 
@@ -38,18 +39,41 @@ export function redactInvitePathsBeforeSend(event: CaptureResult | null): Captur
 }
 
 export function PostHogProvider({ children }: { children: React.ReactNode }) {
-  useEffect(() => {
-    if (typeof window !== 'undefined' && process.env.NEXT_PUBLIC_POSTHOG_KEY) {
-      posthog.init(process.env.NEXT_PUBLIC_POSTHOG_KEY, {
+  const pathname = usePathname()
+
+  useEffect(() => {
+    if (typeof window !== 'undefined' && process.env.NEXT_PUBLIC_POSTHOG_KEY) {
+      const isInvitePage = window.location.pathname.startsWith('/join/')
+      posthog.init(process.env.NEXT_PUBLIC_POSTHOG_KEY, {
         api_host: process.env.NEXT_PUBLIC_POSTHOG_HOST || 'https://eu.i.posthog.com',
         person_profiles: 'identified_only',
         capture_pageview: false,
         capture_pageleave: false,
         get_current_url: redactInviteUrl,
         before_send: redactInvitePathsBeforeSend,
-      })
+        // This must be part of initialization, not only the navigation effect
+        // below, so an initially loaded invite page is protected before its DOM
+        // can be considered for capture or recording.
+        autocapture: !isInvitePage,
+        disable_session_recording: isInvitePage,
+        mask_all_text: isInvitePage,
+      })
     }
-  }, [])
+  }, [])
+
+  useEffect(() => {
+    if (!process.env.NEXT_PUBLIC_POSTHOG_KEY) return
+
+    // Invite codes are credentials. Do not let their page enter PostHog's DOM
+    // autocapture or session-recording pipeline, even though event properties
+    // and URLs are separately redacted below.
+    const isInvitePage = pathname?.startsWith('/join/')
+    posthog.set_config({
+      autocapture: !isInvitePage,
+      disable_session_recording: isInvitePage,
+      mask_all_text: isInvitePage,
+    })
+  }, [pathname])
 
   if (!process.env.NEXT_PUBLIC_POSTHOG_KEY) {
     return <>{children}</>