Web session replay records the DOM. Mobile replay has to work differently: an SDK inside the app captures native view snapshots and an event timeline, masks sensitive content on the device, and uploads completed sessions for playback.
The privacy design is the product. Consent, a visible recording indicator, on-device masking of text inputs and marked views, bounded storage, sampling, a remote kill switch, and real deletion are what separate replay from surveillance.
Replay answers a narrow question well: what did this person actually do? It does not replace analytics, and it should not record keyboard values, audio, or request bodies.