Cookie Policy
4. Third-Party Cookies
Certain third-party services used by Webrec may set their own cookies when you interact with them. We do not control these cookies, and they are only set when you actively engage with the relevant feature. They include:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Stripe (__stripe_mid, __stripe_sid, and others) | Third-party HTTP cookie | Fraud prevention and payment processing. Set when you visit the billing page or enter payment details. | Session to 1 year (varies by cookie) |
| Google OAuth cookies | Third-party HTTP cookie | OAuth authentication. Set only when you use "Sign in with Google". | Varies (controlled by Google) |
| GitHub OAuth cookies | Third-party HTTP cookie | OAuth authentication. Set only when you use "Sign in with GitHub". | Varies (controlled by GitHub) |
For more information about how these services handle your data, please see their respective privacy policies:
5. Webrec SDK Browser Storage
When Customers deploy the Webrec SDK (webrec) on their websites or applications, the SDK uses browser storage mechanisms to function. It is important to understand the distinction between storage set by Webrec on our own website (covered in sections 3-4 above) and storage set by the SDK on our customers' websites (covered here).
5.1 Storage Items Created by the SDK
The following storage items may be created on End User devices when visiting a website that has the Webrec SDK installed:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| wr_session | sessionStorage | Stores the current session identifier. Used to group user interactions into a single recording session. Automatically cleared when the browser tab is closed. | Tab session (cleared on tab/browser close) |
| wr_identity | localStorage | Stores the user identity set by the Customer via the identify() API. Only present if the Customer explicitly calls this method to associate a session with a known user. | Persistent (until cleared or overwritten) |
| wr_anonymous_id | localStorage | Stores an anonymous visitor identifier (a random UUID) to correlate sessions from the same visitor across page loads. This ID is scoped to the single origin and cannot be used for cross-site tracking. | Persistent (until cleared) |
5.2 What the SDK Does Not Store
- The SDK does not set traditional HTTP cookies on the customer's domain
- The SDK does not store any personally identifiable information (PII) unless the Customer explicitly passes it via the identify() API
- The SDK does not create any storage that is accessible by third-party domains
- The SDK does not use fingerprinting or any technique that persists beyond standard browser storage
5.3 Important Notes
- sessionStorage items are automatically cleared when the tab or browser is closed
- localStorage items persist until explicitly cleared by the user, the website, or browser settings
- All storage items are only accessible by the website that created them (same-origin policy) and cannot be used for cross-site tracking
- If the user's browser has Do Not Track (DNT) or Global Privacy Control (GPC) enabled, the SDK does not create any storage items and does not record the session
- Customers are responsible for disclosing the use of the Webrec SDK in their own privacy and cookie policies, and for obtaining any required consent from their End Users
6. ePrivacy Directive Compliance
The EU ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC), often referred to as the "Cookie Law", requires that websites obtain informed consent before storing or accessing information on a user's device, except where the storage is strictly necessary for the service requested by the user.
6.1 How Webrec Complies
- Strictly necessary cookies (authentication, CSRF protection): These are exempt from the consent requirement under Article 5(3) of the ePrivacy Directive because they are essential for providing the service you have requested. We set these without prior consent.
- Functional storage (theme, consent preference): These localStorage items enhance your experience but are not essential. We consider them low-risk and provide clear information about them in this policy.
- Third-party cookies (Stripe, OAuth): These are only set when you actively interact with the relevant feature (e.g., clicking "Sign in with Google" or visiting the billing page). They serve a specific function you have requested.
- No analytics or advertising cookies: Because we do not use analytics or advertising cookies, no consent is required for these categories.
6.2 Guidance for Webrec Customers
If you are a Webrec Customer deploying the SDK on your website, you should be aware of the following:
- The Webrec SDK uses sessionStorage and localStorage, which are covered by the ePrivacy Directive in the same way as cookies
- Depending on your jurisdiction and the applicable national implementation of the Directive, you may need to obtain consent from your End Users before the SDK stores data on their devices
- The SDK provides a programmatic API to delay initialisation until consent is obtained (see SDK documentation)
- You are responsible for including the Webrec SDK storage items in your own cookie policy and consent banner
7. Cookie Consent
When you first visit webrec.app, we display a cookie consent banner that explains our use of cookies and browser storage. You can:
- Accept all cookies -- this allows all cookies described in this policy, including third-party cookies when you use the relevant features
- Accept essential only -- this limits storage to strictly necessary authentication cookies. Functional preferences (theme) will still work for the current session but will not persist.
Your consent choice is stored in the webrec_cookie_consent localStorage item so that we do not show the banner again on subsequent visits.
7.1 Withdrawing Consent
You can withdraw or change your consent at any time by:
- Clearing cookies and site data for webrec.app in your browser settings (this will reset the consent banner)
- Opening your browser's developer tools (usually F12), navigating to the Application or Storage tab, and deleting the webrec_cookie_consent item from localStorage
- Contacting us at privacy@webrec.app to request that we assist you
9. Do Not Track and Global Privacy Control
Webrec respects both the Do Not Track (DNT) browser signal and the Global Privacy Control (GPC) signal.
9.1 Do Not Track (DNT)
Do Not Track is a browser setting that sends a signal to websites requesting that they do not track the user. When the Webrec SDK detects that a user has DNT enabled, no session recording will occur and no browser storage items will be created. The SDK checks the navigator.doNotTrack property on every page load.
9.2 Global Privacy Control (GPC)
Global Privacy Control is a newer standard that allows users to signal their privacy preferences to websites. It is recognised under regulations such as the California Consumer Privacy Act (CCPA) and the Colorado Privacy Act (CPA). When the Webrec SDK detects the GPC signal via navigator.globalPrivacyControl, no session recording will occur and no browser storage items will be created.
10. Updates to This Policy
We may update this Cookie Policy from time to time to reflect changes in the cookies and storage we use, or for legal, operational, or regulatory reasons. We will update the "Last updated" date at the top of this policy when we make changes.
For material changes, we will provide notice through a prominent banner on our website or by email to registered users. We encourage you to review this policy periodically.
11. Contact
If you have questions about this Cookie Policy or our use of cookies and browser storage, please contact us:
- Privacy inquiries: privacy@webrec.app
- Legal inquiries: legal@webrec.app
- General support: support@webrec.app
Rouic Ltd is a company registered in England and Wales. You can also write to our registered address if you prefer to contact us by post.
Related policies
Questions about our policies? Email privacy@webrec.app