Cookie Policy
4. Third-Party Cookies
Certain third-party services used by Webrec may set their own cookies when you interact with them. We do not control these cookies, and they are only set when you actively engage with the relevant feature. They include:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| Stripe (__stripe_mid, __stripe_sid, and others) | Third-party HTTP cookie | Fraud prevention and payment processing. Set when you visit the billing page or enter payment details. | Session to 1 year (varies by cookie) |
| Google OAuth cookies | Third-party HTTP cookie | OAuth authentication. Set only when you use "Sign in with Google". | Varies (controlled by Google) |
| GitHub OAuth cookies | Third-party HTTP cookie | OAuth authentication. Set only when you use "Sign in with GitHub". | Varies (controlled by GitHub) |
| OpenAI Ads conversion pixel (oaiq) | Third-party script and browser storage | Measures whether an advert we placed on OpenAI products led to a signup. Loads only after "Accept All" consent, on marketing and signup pages only, and never when your browser sends a DNT or GPC signal. | Controlled by OpenAI; removed from the page when consent is withdrawn |
For more information about how these services handle your data, please see their respective privacy policies:
5. Webrec SDK Browser Storage
When Customers deploy the Webrec SDK (webrec) on their websites or applications, the SDK uses browser storage mechanisms to function. It is important to understand the distinction between storage set by Webrec on our own website (covered in sections 3-4 above) and storage set by the SDK on our customers' websites (covered here).
5.1 Storage Items Created by the SDK
The following storage items may be created on End User devices when visiting a website that has the Webrec SDK installed:
| Name | Type | Purpose | Duration |
|---|---|---|---|
| wr_session | localStorage | Stores the current session identifier. Used to group user interactions into a single recording session, shared across the tabs of one site so that one visit is recorded once rather than once per tab. | Expires after 30 minutes of inactivity |
| wr_session_ts | localStorage | Stores the time of the last recorded activity. Used only to decide when the current session has been idle long enough to end. | Expires after 30 minutes of inactivity |
| wr_identity | localStorage | Stores the user identity set by the Customer via the identify() API. Only present if the Customer explicitly calls this method to associate a session with a known user. | Persistent (until cleared or overwritten) |
| wr_group | localStorage | Stores the organisation or company association set by the Customer via the group() API. Only present if the Customer explicitly calls this method. | Persistent (until cleared or overwritten) |
| wr_anon_id | localStorage | Stores an anonymous visitor identifier (a random UUID) to correlate sessions from the same visitor across page loads. This ID is scoped to the single origin and cannot be used for cross-site tracking. | Persistent (until cleared) |
| wr_remote_config | localStorage | Caches the project's recording settings so the SDK does not re-request them on every page load. Contains configuration only, and no information about the End User. | Persistent (until refreshed or cleared) |
| wr_sampled | sessionStorage | Records whether this tab fell inside the sampling rate, so that a Customer recording only a percentage of sessions gets a consistent answer across page loads rather than a fresh coin toss on each one. | Tab session (cleared on tab/browser close) |
5.2 What the SDK Does Not Store
- The SDK does not set traditional HTTP cookies on the customer's domain
- The SDK does not store any personally identifiable information (PII) unless the Customer explicitly passes it via the identify() API
- The SDK does not create any storage that is accessible by third-party domains
- The SDK does not use fingerprinting or any technique that persists beyond standard browser storage
5.3 Important Notes
- sessionStorage items are automatically cleared when the tab or browser is closed
- localStorage items persist until explicitly cleared by the user, the website, or browser settings
- The session identifier is an exception to the line above: it is held in localStorage so that several tabs of the same site count as one visit, but it is treated as expired after 30 minutes without activity and replaced with a new one. It is a random value that identifies a visit, not a person
- All storage items are only accessible by the website that created them (same-origin policy) and cannot be used for cross-site tracking
- If the user's browser has Do Not Track (DNT) or Global Privacy Control (GPC) enabled, the SDK does not create any storage items and does not record the session
- Customers are responsible for disclosing the use of the Webrec SDK in their own privacy and cookie policies, and for obtaining any required consent from their End Users
6. ePrivacy Directive Compliance
The EU ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC), often referred to as the "Cookie Law", requires that websites obtain informed consent before storing or accessing information on a user's device, except where the storage is strictly necessary for the service requested by the user.
6.1 How Webrec Complies
- Strictly necessary cookies (authentication, CSRF protection): These are exempt from the consent requirement under Article 5(3) of the ePrivacy Directive because they are essential for providing the service you have requested. We set these without prior consent.
- Functional storage (theme, consent preference): These localStorage items enhance your experience but are not essential. We consider them low-risk and provide clear information about them in this policy.
- Third-party cookies (Stripe, OAuth): These are only set when you actively interact with the relevant feature (e.g., clicking "Sign in with Google" or visiting the billing page). They serve a specific function you have requested.
- No analytics or advertising cookies: Because we do not use analytics or advertising cookies, no consent is required for these categories.
6.2 Guidance for Webrec Customers
If you are a Webrec Customer deploying the SDK on your website, you should be aware of the following:
- The Webrec SDK uses sessionStorage and localStorage, which are covered by the ePrivacy Directive in the same way as cookies
- Depending on your jurisdiction and the applicable national implementation of the Directive, you may need to obtain consent from your End Users before the SDK stores data on their devices
- The SDK provides a programmatic API to delay initialisation until consent is obtained (see SDK documentation)
- You are responsible for including the Webrec SDK storage items in your own cookie policy and consent banner
7. Cookie Consent
When you first visit webrec.app, we display a cookie consent banner that explains our use of cookies and browser storage. You can:
- Accept all cookies: this allows all cookies described in this policy, including first-party session recording and analytics of your visit to webrec.app (via our own SDK, with inputs masked), and third-party cookies when you use the relevant features
- Accept essential only: this limits storage to strictly necessary authentication cookies. Functional preferences (theme) will still work for the current session but will not persist.
Your consent choice is stored in the webrec_cookie_consent localStorage item so that we do not show the banner again on subsequent visits. Analytics and session recording on webrec.app only run after you choose “Accept all”, and stop immediately if you withdraw that choice.
Your cookie preferences
Current choice: …. You can change it at any time. The change applies immediately.
7.1 Withdrawing Consent
You can withdraw or change your consent at any time by:
- Clearing cookies and site data for webrec.app in your browser settings (this will reset the consent banner)
- Opening your browser's developer tools (usually F12), navigating to the Application or Storage tab, and deleting the webrec_cookie_consent item from localStorage
- Contacting us at [email protected] to request that we assist you
9. Do Not Track and Global Privacy Control
Webrec respects both the Do Not Track (DNT) browser signal and the Global Privacy Control (GPC) signal.
9.1 Do Not Track (DNT)
Do Not Track is a browser setting that sends a signal to websites requesting that they do not track the user. When the Webrec SDK detects that a user has DNT enabled, no session recording will occur and no browser storage items will be created. The SDK checks the navigator.doNotTrack property on every page load.
9.2 Global Privacy Control (GPC)
Global Privacy Control is a newer standard that allows users to signal their privacy preferences to websites. It is recognised under regulations such as the California Consumer Privacy Act (CCPA) and the Colorado Privacy Act (CPA). When the Webrec SDK detects the GPC signal via navigator.globalPrivacyControl, no session recording will occur and no browser storage items will be created.
10. Updates to This Policy
We may update this Cookie Policy from time to time to reflect changes in the cookies and storage we use, or for legal, operational, or regulatory reasons. We will update the "Last updated" date at the top of this policy when we make changes.
For material changes, we will provide notice through a prominent banner on our website or by email to registered users. We encourage you to review this policy periodically.
11. Contact
If you have questions about this Cookie Policy or our use of cookies and browser storage, please contact us:
- Privacy inquiries: [email protected]
- Legal inquiries: [email protected]
- General support: [email protected]
Rouic Ltd is a company registered in England and Wales. You can also write to our registered address if you prefer to contact us by post.