Last updated
This page lists everything Garro stores in your browser and every analytics tool we use. The list is short, and we keep it complete.
What the service cannot work without: signing in, the anti-bot check on the sign-in forms, your language and theme, the maintenance bypass for our staff, and the cookie that remembers your cookie choice. Under the ePrivacy rules these need no consent, so there is no switch for them. They are listed in full in the next section.
Also in this category, though it stores nothing in your browser: error monitoring with Sentry (EU data region). When a page breaks, Sentry receives the error, the page address with share links removed, your browser and operating system, and a pseudonymous user id if you are signed in — and only when something has gone wrong: no performance measurements of your visit and no session recordings. It is how we keep the service running and secure.
Page statistics (Vercel Web Analytics and Speed Insights) and product analytics (PostHog), described below. Until you choose Accept all, or switch Analytics on in Customize, none of them is loaded — no script, no request. Choosing Reject all, or not answering at all, keeps them off.
| Name | Set by | Purpose | Kept for |
|---|---|---|---|
| __session, __client_uat and related | Clerk (our sign-in provider) | Keeps you signed in and protects the session. Strictly necessary — without these you cannot log in. | Session, and up to 1 year for the device record |
| __cf_bm and Turnstile check | Cloudflare, via the sign-in form | Distinguishes people from bots on the sign-in, sign-up and password-reset forms. Strictly necessary for security. | Up to 30 minutes |
| garro_consent | Garro | Remembers your cookie choice — whether analytics is allowed — and when you made it, so the banner does not ask again on every page. | 12 months, then you are asked again |
| locale | Garro | Remembers whether you chose English or Croatian. | 1 year |
| theme | Garro (local storage) | Remembers whether you chose the light or dark theme. | Until you clear your browser storage |
| sidebar_state | Garro (club dashboard only) | Remembers whether you collapsed the sidebar. | 7 days |
| garro_bypass, garro_bypass_active | Garro | Lets our own staff into the site while it is closed for maintenance; set only when a staff bypass link is used. Strictly necessary. | 8 hours |
| garro:platform-reload-at | Garro (session storage) | Limits how often a page reloads itself when the service goes into or comes back from maintenance. Strictly necessary. | Until you close the tab |
| garro.viewerId | Garro (session storage) | A random id the video player uses to count you once as a live viewer in this tab, however often the stream reconnects. Not linked to you or your account. Strictly necessary for the viewer count. | Until you close the tab |
| garro.thumbs.v2 | Garro (session storage) | Keeps the short-lived thumbnail addresses of recordings already shown, so the list does not fetch them again. | Until you close the tab |
| garro.mobileNoticeDismissed | Garro (club dashboard only, session storage) | Remembers that you dismissed the notice that the dashboard is built for a larger screen. | Until you close the tab |
| Tool | Provider | Purpose | Stored in your browser |
|---|---|---|---|
| Web Analytics | Vercel | Counts page views, in aggregate. Used on the website and the club dashboard. | Nothing |
| Speed Insights | Vercel | Measures how fast pages load, in aggregate. Used on the website and the club dashboard. | Nothing |
| Product analytics | PostHog (EU data region, Frankfurt) | How people find and use the website: pages visited, the referring site and campaign parameters, and a short documented list of actions such as starting sign-up or opening a share link. | Nothing |
For all three, share links and recording ids are removed from page addresses before anything is sent.
PostHog is set up to store nothing in your browser: no cookie, no local storage, no session storage. Its identifier lives only in the open page, so a visitor who is not signed in counts as a new, anonymous visitor on every page load; a signed-in visitor is identified by a pseudonymous user id, never by email or name. Your IP address is discarded rather than stored, there is no session recording and no autocapture of what you click or type, and the data is kept for 12 months. Its requests go to our own domain and are forwarded from there.
If you later withdraw your consent, the tools stop sending at once, in the open page as well, and PostHog forgets the in-page identifier.
A few account events — signing up, accepting a club invitation, creating a club, and a club's recordings starting, stopping and becoming ready — are recorded by our own servers when they happen, and some are forwarded to PostHog with a pseudonymous user id. Nothing is read from or stored in your browser for this, so it is not part of the cookie choice; it rests on our legitimate interest in understanding how the service is used, as the Privacy Policy explains, and you can object to it by writing to us.
For the avoidance of doubt, none of the following exists anywhere in Garro:
We count how many times a video has been played. That is a single number stored on the recording itself. It is not stored in your browser, not linked to you, and not linked to your device.
Our web fonts are served from our own servers, not from Google Fonts, so loading a page makes no request to Google.
The video player is part of our own site. It loads recordings and live streams from Bunny.net's content delivery network, which needs your connection data — such as your IP address — to deliver the video to you, as any video host must. While you watch, the player tells our media server every 30 seconds that a view is in progress, so we can show viewer counts and count minutes played.
Neither the player nor the video delivery sets cookies. The player only loads on a page where you have asked to watch something.
The cookie banner asks once, on your first visit. To change your answer later, use Cookie settings at the bottom of every page of the website and the club dashboard, or here: . Withdrawing consent is as easy as giving it, and takes effect immediately, in every open tab. Your choice is remembered for 12 months in this browser only; after that, or if we add a new analytics tool, we ask again. The website (garro.tv), our marketing website and the club dashboard each remember their own choice, so each asks separately, and changing one does not change the others. The marketing website sets no other cookie.
If your browser sends a Do Not Track or Global Privacy Control signal, we treat it as a refusal: analytics stays off whatever was chosen before, and the banner does not ask.
Every browser lets you view and delete cookies and site data, and block them per site. Doing so is entirely your choice.
Be aware that blocking the Clerk cookies stops sign-in from working at all, since they are what a logged-in session is. Clearing theme or locale only resets those preferences to their defaults; clearing garro_consent turns analytics off and brings the banner back.
Write to support@heapforge.hr. How we handle personal data more generally is in the Privacy Policy.
The Croatian version of this document is the binding one for users in Croatia.
