Cookie Policy
Last updated: 16 August 2026
Everything on this page was measured, not assumed: a fresh browser profile, the page loaded, nothing clicked, then every request and every stored entry written down. You can repeat it in your browser’s developer tools — Application → Storage.
1. The recorder sets nothing that needs consent
rec.blocrec.app sets no cookies at all and contacts no advertising network. It keeps four entries in your browser’s local storage, all of them strictly necessary for the service you asked for and therefore free of consent under § 25 (2) no. 2 TDDDG:
| Entry | What it is for | How long |
|---|---|---|
blocrec.settings.v1 | Your settings — resolution, camera position, format — so the app looks the way you left it | Until you clear it |
blocrec.token | Your plan ticket, only if you signed in: a signed note saying which plan this browser may use. Without it a paying customer would get a watermark | 30 days, then re-issued |
blocrec.micNotice.v1 | That you have seen the notice about recording other people (§ 201 StGB) — so we show it once and never nag | Until you clear it |
blocrec.onboarded.v1 | That you have seen the short introduction | Until you clear it |
There is no cookie on the recorder and there is no banner, because there is nothing to consent to. The page’s Content-Security-Policy lists every address it is allowed to contact at all; it is visible in the response headers.
2. This sales site, before you decide anything
Three things happen on blocrec.app on the first page view, without any click from you. We list them because they are there, not because they are convenient:
| Name | Set by | Purpose | Consent needed | Duration |
|---|---|---|---|---|
__client_uat, __session (and __clerk_db_jwt on test builds) | Clerk | Knowing whether this browser is signed in, and keeping you signed in once you are. Set on every page, including this one, because sign-in is loaded site-wide | No — strictly necessary for the sign-in function | Session / up to 1 year |
__clerk_environment (local storage) | Clerk | The sign-in dialog’s own configuration, cached so it does not have to be fetched twice | No — strictly necessary | Until you clear it |
__cf_bm, _cfuvid | Cloudflare, on Clerk’s own domain | Telling automated traffic from people, and keeping a connection on the same server. Set by Cloudflare in front of Clerk, not by us | No — security and delivery of a function you use | 30 minutes / session |
blocrec.consent.v1 (local storage) | Us | Your answer to the banner, with the date you gave it. A record of “no” is what keeps us from asking again — and it is deliberately not a cookie | No — strictly necessary | Until you clear it |
Loading the sign-in component also means your IP address reaches Clerk (USA) and Cloudflare on every page view of this site, before you have decided anything. We consider that necessary for the sign-in function, and we say so plainly rather than leaving you to find it in the network panel. Details of the transfer are in the privacy policy. The recorder is unaffected: it has no sign-in.
If Clerk shows a bot check during sign-in, that check is Cloudflare Turnstile and is loaded from challenges.cloudflare.com at that moment — not before, and never on the recorder.
3. Only after you say yes
| Name | Set by | Purpose | Consent needed | Duration |
|---|---|---|---|---|
_fbp, _fbc | Meta | Measuring which advertisement brought you here | Yes — Art. 6 (1) (a) GDPR, § 25 (1) TDDDG | Up to 3 months |
_gcl_au (and _gcl_aw after a click on a Google ad) | The same question for the other network: which advertisement led to a purchase. Set on our own domain, not Google’s | Yes — Art. 6 (1) (a) GDPR, § 25 (1) TDDDG | Up to 90 days |
Until you click “Accept”, no script from Meta or Google exists on the page: nothing is loaded from connect.facebook.net or googletagmanager.com, and neither fbq nor gtag is defined. That is checkable, and we check it — see the note at the top of this page.
Google offers a mode in which its tag loads before you decide and sends cookieless pings in the meantime. It measures better. We do not use it, because it would make the sentence above untrue.
One honest caveat about the Google row: at the time of writing no campaign is running, so that tag is not configured and sets nothing at all — you will not find _gcl_au in your browser today. It is listed in advance because the policy has to be right on the first day of advertising, not a week after. The measurement described at the top of this page is repeated before that day.
The same rule applies to the events our server sends to Meta about a purchase. Moving an advertising event from your browser to our server does not move it out of data protection law, so we do not send it either unless you consented.
4. Changing your mind
Use the Cookie settings button at the bottom of every page. It asks the question again, and choosing “Decline” stops both tags and deletes the cookies they set on this domain. Withdrawing is one click, exactly like agreeing was, and it costs you nothing: the product behaves identically either way. You can also clear blocrec.consent.v1 from this site’s local storage, or use your browser’s “delete site data” function.
Both buttons in the banner are the same size, the same colour and the same weight. Neither answer is the loud one — a banner that nudges is not a free choice.
5. Usage measurement
Our own measurement (PostHog, hosted in the EU) writes nothing to your device: no cookie, no stored identifier. On the recorder the identifier is a random number that lives in that browser tab’s memory and is gone when the tab closes; on this site it works the same way. Because nothing is stored on or read from your device, § 25 TDDDG does not apply and no consent is asked for — the legal basis is our legitimate interest in knowing whether the product works (Art. 6 (1) (f) GDPR), and you can object to it at any time (see the privacy policy).
The events are counters — “a recording was started”, “the limit was reached”, an error reason — and never carry anything of what you record. If you are signed in, the event is filed under your account rather than under a random number, because at that point we know who you are anyway.