Privacy Policy
Last updated: 16 August 2026
1. Controller
Tobias Westrich, BlocRec — Tobias Westrich, Hochstraße 33, 66287 Quierschied, Deutschland. Email support@blocrec.app, telephone +49 177 5260714. A data protection officer is not appointed: § 38 BDSG requires one only where at least twenty people are constantly engaged in processing personal data, or where the processing requires a data protection impact assessment. Neither applies here — a sole trader, no employees, no large-scale or high-risk processing.
2. The short version
Your recordings are made on your device. On the free plan they are never sent to us: the file is written straight to your disk. We only process a recording’s content if you are on a paid plan and choose to upload it in order to share a link.
The recorder at rec.blocrec.app sets no cookies and shows no banner. This sales site loads its sign-in component on every page, which sets the cookies listed in the cookie policy; the advertising tags load only if you accept them.
3. What we process, and on what basis
| Data | Purpose | Legal basis | Where |
|---|---|---|---|
| Email address, account, sessions | Sign-in, subscription management | Art. 6(1)(b) GDPR — contract | Clerk (USA) |
| IP address and browser data on every page view of this site | Loading the sign-in component, and Cloudflare’s protection in front of it. It happens before you click anything, because sign-in is available on every page | Art. 6(1)(f) GDPR — providing a working, protected site | Clerk (USA), Cloudflare |
| Bot check during sign-in, when Clerk asks for one | Keeping automated sign-ups out | Art. 6(1)(f) GDPR | Cloudflare Turnstile |
| Payment and invoice data | Payment, invoices, statutory bookkeeping | Art. 6(1)(b), Art. 6(1)(c) GDPR | Stripe (Ireland/USA) |
| Plan, quota, renewal date | Providing the paid features | Art. 6(1)(b) GDPR | Clerk metadata |
| Your two confirmations at checkout (immediate start, loss of the right of withdrawal), with a timestamp | Proving that the withdrawal right lapsed lawfully (§ 356 (5) BGB) | Art. 6(1)(c) GDPR — legal obligation | Stripe (session metadata) |
| Uploaded videos, title, duration, size | Hosting and sharing links you create | Art. 6(1)(b) GDPR | Cloudflare R2 (EU jurisdiction) |
| Usage events (recording started/stopped, errors) | Finding out whether the product works | Art. 6(1)(f) GDPR — legitimate interest | PostHog EU (Germany) |
| Server logs (IP, time, URL) | Operating and securing the site | Art. 6(1)(f) GDPR | Vercel |
| Meta pixel events in your browser | Measuring which advertisement brought you here | Art. 6(1)(a) GDPR — consent · § 25(1) TDDDG | Meta (Ireland/USA) |
| Purchase event sent from our server to Meta, with your email address hashed | Measuring advertising without relying on your browser | Art. 6(1)(a) GDPR — the same consent. Without it we send nothing | Meta (Ireland/USA) |
| Google Ads tag in your browser, and the purchase it reports | Measuring which advertisement led to a subscription | Art. 6(1)(a) GDPR — consent · § 25(1) TDDDG | Google Ireland Ltd. (Ireland/USA) |
| Emails we send you | Receipts, cancellation confirmations, warnings before deletion | Art. 6(1)(b), Art. 6(1)(c) GDPR | Resend |
| Your cancellation form (name, email, contract, wishes) | Cancelling your contract and confirming receipt in text form (§ 312k BGB) | Art. 6(1)(b), Art. 6(1)(c) GDPR | Resend, our mailbox |
4. What we do not process
- The content of free-plan recordings. It never reaches us.
- Session recordings or screen contents inside the recorder. Never, on any plan.
- Anything that would let us identify anonymous users of the recorder.
- Anything we sell, rent or pass on for someone else’s advertising.
Usage measurement in the recorder runs without cookies and without any stored identifier: the id is a random number that exists only in that browser tab and is gone when it closes. When you move between blocrec.app and the recorder, that number is passed along in the link so the two halves of a visit are not counted as two people; it is still never written to your device, and it still disappears with the tab. If you are signed in, the event is filed under your account instead.
5. Transfers outside the EU
Clerk (sign-in) has no EU data residency in any of its plans, so account data — and the IP address of every page view of this site — is processed in the USA. Stripe, Meta, Google and Resend also process data in the USA. These transfers are based on the EU standard contractual clauses and, where the recipient is certified, on the EU–US Data Privacy Framework.
You should know what that does and does not achieve: those safeguards oblige the recipient, but they cannot rule out that US authorities gain access under US law, and US law gives you fewer remedies than EU law does. Video storage (Cloudflare R2, created under Cloudflare’s EU jurisdiction, which keeps the objects inside the European Union rather than merely preferring it) and usage measurement (PostHog, Germany) stay in the EU. Recordings on the free plan leave your device for nobody.
6. How long we keep things
- Account data: while the account exists, then deleted.
- Uploaded videos: while your plan runs; after cancellation 30 days, then an email, then deletion.
- Invoices and the withdrawal confirmations attached to them: 10 years (§ 147 AO, § 257 HGB).
- Cancellation declarations and their receipts: 3 years (statutory limitation period).
- Usage events: 30 days, then deleted automatically by PostHog.
- Server logs: 24 hours. That is how long our hosting provider Vercel keeps runtime logs on our plan; we do not export them anywhere and we keep no copy.
- Your answer to the cookie banner: it stays on your device, not with us, until you clear it.
7. Your rights
You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18) and data portability (Art. 20), and the right to withdraw a consent at any time with effect for the future (Art. 7(3)) — for the advertising pixel that is the Cookie settings button at the bottom of every page. Write to support@blocrec.app; we answer within one month.
Right to object — Art. 21 GDPR
Where we rely on a legitimate interest (Art. 6(1)(f)) — usage measurement, server logs, the sign-in component and its protection — you may object at any time, for reasons arising from your particular situation. A message to support@blocrec.app is enough; no form, no reason required beyond that. We then stop the processing unless we can show compelling grounds that override your interests.
You may also complain to a supervisory authority, in particular in the member state of your residence or workplace (Art. 77). The authority responsible for us is the Unabhängiges Datenschutzzentrum Saarland — Landesbeauftragte für Datenschutz und Informationsfreiheit, Fritz-Dobisch-Straße 12, 66111 Saarbrücken.
8. Do you have to give us this data?
No, and mostly there is nothing to give: recording needs no account and no data at all. An email address is required to buy a plan — without it a contract cannot be concluded or invoiced. The cookie banner is genuinely optional; declining changes nothing about how the product works.
9. No automated decisions, no profiling
We make no decisions about you by automated means, and we build no profiles (Art. 22 GDPR does not apply). Usage measurement counts events; it does not score people.
10. Processors and joint controllership
We have data processing agreements under Art. 28 GDPR with Vercel, Clerk, Cloudflare, Stripe, PostHog, Google and Resend. The current list is kept in our record of processing activities and is available on request.
The Meta pixel is different: for collecting your data in your browser and transmitting it to Meta, we and Meta Platforms Ireland Ltd. are joint controllers under Art. 26 GDPR, on the basis of Meta’s controller addendum. What Meta does with the data afterwards, Meta decides alone and answers for alone; its information is at facebook.com/privacy/policy. You can exercise your rights against either of us.
Google Ireland Ltd. is different again: for the conversion measurement described above we instruct Google as our processor under the Google Ads Data Processing Terms. What Google then does with the data for its own purposes, it decides as a controller in its own right, under its privacy policy. We do not use Google Analytics on this site, and no Google tag exists on the recorder.
11. Where the data comes from
All of it comes from you or from your use of the product. We buy no data and receive none from third parties.
12. Changes to this policy
We update this text when the product changes. The date at the top says when. The measurement it is based on — every request and every stored entry, before any click — is repeated before each change.