Cookie Policy
Last updated 16 September 2026
Cookies and similar technologies (including scripts that access browser or device information and browser local storage) can be used to remember preferences or measure how a service is used. This policy explains what we use and how you control it. It should be read with our Privacy Policy.
Your choice
We set strictly necessary storage to run the Service — this does not require consent. Before you make an analytics choice, we may also count limited usage on trybroc.io and on anonymous pages of app.trybroc.io — including the report checkout, if you get that far without signing in to an account. We do this only for aggregate service-improvement statistics under the UK PECR statistical-purposes exception. This mode uses a temporary analytics identity that lives in your browser tab’s session storage and is discarded when the tab closes, no analytics cookies, no session replay and no account identification. Choosing Reject/No thanks or Turn off stops this optional measurement too.
Enhanced analytics cookies, persistent product analytics and session replay remain off unless you explicitly allow them. So do advertising cookies, which are a separate choice: allowing analytics does not allow advertising, and turning either off leaves the other as it was. You can change both at any time below; withdrawing consent is as easy as giving it.
Strictly necessary (always on)
These are required to operate the Service, keep you signed in or remember the privacy/appearance choices you make.
| Name | Type | Purpose | Duration |
|---|---|---|---|
broc-theme | Local storage | Remembers your light/dark theme preference. | Until replaced or cleared in your browser. |
broc-analytics-consent | Local storage & cookie | Remembers your analytics choice so we don't ask again — also set as a cookie shared with app.trybroc.io so your choice applies across the Service. | Cookie: about 180 days. Local storage: until replaced or cleared. |
__ph_opt_in_out_* | Local storage (PostHog preference flag) | May be used by the analytics SDK when applying or changing an analytics objection/permission. It is a preference flag, not an analytics identifier. | Until replaced or cleared. |
| Authentication cookies | Cookie (on app.trybroc.io) | Keep you signed in securely (set by our auth provider, Supabase). | For the relevant authentication/session lifetime. |
Report access cookie (broc_report_access) | Cookie (on app.trybroc.io) | Set only if you bought a report without creating an account and opened it from the personal link we emailed you. It identifies the purchase so we can show you the report you paid for, and nothing else. It is set by us rather than by our auth provider, and it is strictly necessary to deliver what you bought — so it is not covered by the analytics choice. Signing in to the account — with an email or with Google — retires both the link and this cookie. Adding an email address on its own does not: it is the first sign-in that withdraws the link, so until then a copy you forwarded still opens the report. | 30 days, or until you sign in. |
Before you choose (anonymous service statistics)
Until you make an analytics choice, we may use PostHog on our marketing site and on the anonymous funnel in our product — the address search, the onboarding questions and the report checkout — solely to produce aggregate statistics that help us improve the Service. That includes buying a report without an account: we create an unnamed, anonymous account behind the scenes so the checkout has something to attach your answers to, and because you have not signed in and have not been asked the analytics question, this limited mode is what runs. It is never linked to that account. This can count pages or funnel steps viewed, referral/campaign information and coarse browser/device information. The analytics identity is kept only in your browser tab’s session storage (an entry named ph_…_posthog on trybroc.io and on app.trybroc.io, discarded when you close the tab and never written to a cookie), session replay is off, and we do not identify you or link the temporary anonymous activity to a Broc account. In the product app, a strict event filter excludes buyer/profile submissions and other non-approved custom events. Query strings and advertising click identifiers (such as Google’s gclid) are removed before analytics are sent, and so is the part of a web address that names the specific property you are looking at — a page such as /property/<id> is recorded as /property/[redacted], so we can count that the screen was seen without recording which home it was about. On consent, the anonymous identity is reset before full analytics begin.
PECR permits storage/access without consent where the sole purpose is producing statistical information about use of a service to improve it, provided clear information is given and there is a simple, free way to object. Broc relies on that statistical-purposes exception for this limited mode. Our tab-scoped design goes further than the exception requires: the identifier is never written to a cookie or to persistent storage, so it cannot follow you across visits or between our two domains. A small preference record may nevertheless be written when you object or change your analytics choice so that we can honour it. Use Reject/No thanks, Turn off in the anonymous-statistics notice in the product, or the controls above to object; the optional measurement then stops.
Enhanced analytics cookies and session replay (consent required)
With your consent, we use these to understand how the Service is used so we can improve it. They are not used for advertising — advertising is the separate choice described in the next section — and we do not sell the data.
| Provider | What it does | Cookies? |
|---|---|---|
| PostHog (EU Cloud) | Persistent product analytics and session replay — usage patterns, feature use, and masked recordings of page interactions to diagnose problems and improve the Service. After you sign in, your activity is linked to your Broc account and labelled with your email address, and with your name where your sign-in provider gave us one. | Yes (for example a distinct-ID/session identifier); set only after you opt in. |
Enhanced analytics include session replay (PostHog): recordings of on-page interactions used to diagnose problems and improve the Service. To protect your privacy, recordings mask what you type — and in the signed-in product (app.trybroc.io) they also mask on-screen text, so the prices and figures, anything you type and your account details stay hidden. A recording does show the fixed wording of the interface (menus, buttons, questions and the answer options offered), and so it shows which option you picked; it also shows the address of the property you are analysing, which the page's own web address already contains. PostHog hosts the data in the EU. Replay and persistent analytics run only with your consent. In the signed-in product you can change this under Settings → Privacy & analytics; on the marketing site use the controls above (or email support@trybroc.io).
Advertising cookies (separate consent required)
Broc advertises on Google. With your consent — and only with it — we load Google’s advertising tag so that Google can show you our ads again on other sites after you leave. This is called remarketing. It is a different purpose from the analytics above and asks you separately, because allowing us to measure how the site is used is not the same as allowing an advertising network to recognise you elsewhere.
What is shared. On trybroc.io, the page address you are on, without its query string — so campaign tags and Google’s own gclid click identifier are removed — the page title, and the site you arrived from. On app.trybroc.io we send less: only that a visit happened, plus which of four points in the purchase journey you reached. The web address, the page title and the property you are looking at are not sent from the product at all.
The four points are: a free estimate was shown to you, you reached the page that states the price, you started a checkout, and a purchase completed. The last exists so we can stop advertising to people who have already bought. None of them carries the property, the address, the price or anything you typed.
What we never send. Your name, your email address, the property you are analysing, your answers, and the contents of any report — none of these reach Google through this tag. We do not use Google’s enhanced conversions, and we do not upload customer lists to Google.
Google acts as an independent controller for advertising data. Its handling is governed by Google’s Business Data Responsibility notice and you can control ad personalisation in Google My Ad Center. Separately from anything we do, that is where you can switch personalised advertising off across Google.
| Name | Type | Purpose | Duration |
|---|---|---|---|
broc-ads-consent | Local storage & cookie | Remembers your advertising choice — kept separately from the analytics one so each can be given or withdrawn on its own. Also set as a cookie shared with app.trybroc.io so your choice applies across the Service. It is set whichever way you answer, including when you decline, so that a refusal is not mistaken for never having been asked. | Cookie: about 180 days. Local storage: until replaced or cleared. |
_gcl_au (and other _gcl_* cookies) | Cookie, set by Google’s tag on our domains | Used by Google Ads to recognise a returning visitor so we can advertise to you again, and to link an ad click to a later visit. Set only after you allow advertising; turning advertising off with the controls above deletes them. | Up to 90 days, or until you turn advertising off. |
Until you allow advertising, nothing is requested from Google at all — the tag is not downloaded, no cookie is set and no request leaves your browser for it. Leaving the question unanswered has the same effect as declining.
Managing analytics choices
Use the controls above to allow enhanced analytics or advertising, or to turn either off. The advertising question is asked only on trybroc.io — app.trybroc.io never asks it, and simply honours whatever you chose here — so the controls above are also where you withdraw it, from either site. Anonymous visitors on app.trybroc.io are additionally shown a direct Turn off control while the limited statistical mode is active. You can also block or delete cookies through your browser settings, and most browsers offer a “do not track” or private- browsing mode. Blocking strictly necessary storage may stop parts of the Service working.
Changes
As our tooling evolves we may update this policy and the table above. We will revise the “last updated” date when we do.