If it's visible, it's capturable, it's simply a matter of how obfuscated it is and how much effort you want to spend capturing it. In highly dynamic web apps these days, it could be simple as a right click or as complex as figuring out their rendering system, source data stream, generated key handshake to verify it's the script accessing the data and not a person, and so on. I see this sort of trash a lot more than I care to.