Cookie Policy

Cookies and similar technologies

Cookies are stored by the browser and may be sent with requests. STRUCT Call also uses local storage for persistent preferences and session storage for the current browser session. Section 25 TDDDG applies to these storage technologies as well as cookies. STRUCT Call uses no advertising or marketing trackers.

Required browser storage

Language, appearance, device preferences and locally stored meeting access support the functions you use. The exception for strictly necessary storage applies only where needed for a service you expressly request. Optional convenience features must not automatically be treated as necessary. You can remove stored data through your browser's website settings, which may remove meeting access and preferences.

Optional beta diagnostics

Sentry is used for technical errors and diagnostic events where remote diagnostics are configured. Without your consent diagnostics stay off: the SDK is not started and nothing is sent. On your first visit a dialog asks for your choice with “Accept all”, “Necessary only” and “Settings”. The decision is stored in the browser with a policy version; when the categories or recipients change, we ask again.

Fonts and blur files

The Manrope font and the MediaPipe files for background blur are delivered from the STRUCT Call website itself. Loading a page or switching on background blur therefore sends no request to Google Fonts, jsDelivr or Google Cloud Storage. The remaining connections to other providers are listed in this policy.

Protection against automated abuse (Cloudflare Turnstile)

When abuse protection is enabled, registration, login, password reset and creation of a new meeting load Cloudflare Turnstile. Your browser connects to challenges.cloudflare.com and transmits connection and browser data to Cloudflare for the security check. Our API sends the short-lived verification token to Cloudflare for validation. We do not send your email, password, meeting title, participant names or media with this verification request, and do not store or log the Turnstile token. This protection is separate from optional diagnostics and product analytics. Existing calls, reconnections and device changes do not trigger a new check. The legal basis is our legitimate interest in protecting the service against automated abuse (Article 6(1)(f) GDPR). Cloudflare processes data under its Turnstile Privacy Addendum.

Changing settings and removing data

Via “Change privacy choices” in the footer or the cookie settings you can allow or withdraw optional diagnostics at any time. Withdrawing closes sending immediately, including in other open tabs, and stops the diagnostics SDK; data already sent is not automatically erased at the recipient. The choice applies to this browser and website. After you clear browser data, we ask again.

Application storage inventory

struct-call.consent.v2

Necessary

Your privacy choice (policy version, time, optional categories). Replaces the former key struct-call.diagnostics-consent.v1: a refusal stored there is carried over, an earlier grant is not.

Local storage: until removed by you, the app or the browser; no automatic expiry.

struct-call.language · struct-call-theme · struct-call.preferences · struct-call.preview

Necessary

Language, appearance, device and local preview preferences.

Local storage: until removed by you, the app or the browser; no automatic expiry.

struct-call.scheduled-meeting · struct-call.host-token.* · struct-call.meeting-title.* · vc:host-token:*

Necessary

Local scheduled meetings, host access and meeting titles. Access credentials are confidential.

Scheduled meetings in local storage until cleanup or removal; session data in session storage until the browser session ends or earlier cleanup.

struct-call.guest-id · struct-call.connection-id

Necessary

Random, pseudonymous IDs so the server keeps one participation per guest and meeting and lets a reload of the same tab back in. The guest ID stays the same in this browser until you clear the website data.

guest-id in local storage without its own expiry; connection-id in session storage until the tab is closed.

struct-call.admission.* · struct-call.app-access-granted

Necessary

Status of your waiting-room request and, only where a join password is configured, the confirmed entry.

Session storage: until the tab is closed or earlier cleanup.

sc_at · sc_rt (with the __Host- prefix in production)

Necessary

HttpOnly cookies for account sign-in (access and refresh token); only after signing in and not readable by JavaScript.

sc_at: lifetime of the access token issued by the sign-in service; sc_rt: 30 days; signing out deletes both.

struct-call.audioDiag

Testing only

Only read, never set by the app: set manually to “1”, it turns on local audio diagnostics for test calls. Nothing is sent.

Local storage: until removed by you, the app or the browser; no automatic expiry.

Network services and external sources

Which servers your browser contacts, why and what triggers it. Only beta diagnostics depend on consent; the other connections belong to functions you use or are marked as an open review.

Own API · LiveKit · TURN · storage (Hetzner)

Necessary

Account, meetings, waiting room, signalling, audio/video and recordings.

When the app loads and during a call.

checkout.stripe.com · billing.stripe.com

When used

Payment and subscription management with Stripe.

Only when you open payment or subscription management (redirect).

Sentry (ingest endpoint of the configured DSN)

Optional · consent

Optional beta diagnostics: errors, connection and quality metrics, filtered.

Only after consent. Refusing or withdrawing closes sending immediately and stops the SDK.

Sentry Cloud · beta feedback

When used

Your feedback text and ratings; with diagnostics consent also the call's quality category.

Only when you submit the feedback form.

STRUCT Call website · font files

Necessary

Manrope font files from our own server; no request to Google Fonts.

When a page loads.

STRUCT Call website · MediaPipe files

When used

Program files and segmentation model for background blur from our own server; no request to jsDelivr or Google.

Only when you switch on background blur.

challenges.cloudflare.com (Cloudflare Turnstile)

Security

Security check against automated abuse; Cloudflare receives IP address, TLS and browser characteristics. The app stores nothing in your browser for it.

Only for sign-up, sign-in, password reset and meeting creation, when the operator has enabled the protection. Independent of the diagnostics choice; not a marketing or analytics function.

Contact

Telephone: +49 172 628 9359