Cookie Policy
Last updated: July 25, 2026
What Are Cookies?
Cookies are small text files that websites store on your device. They help the site remember your preferences, keep you logged in, and (with your permission) understand how visitors use the site. This policy explains every cookie RhymeFlux uses, why, and how you control them.
Categories We Use
We group cookies into three categories. Two are always on (without them the site can't function); the third only runs if you opt in via the cookie banner.
- Strictly necessary — required for the app to work (login session, security tokens). Cannot be disabled.
- Functional — remember your preferences (theme, layout, language). No tracking.
- Analytics — help us understand which pages get used, how visitors move through the site (including anonymized session replay and heatmaps via PostHog), and where the site is broken. Disabled until you accept via the banner. You can change your mind any time.
Cookies We Set
| Cookie / Storage | Category | Purpose | Duration |
|---|---|---|---|
| sb-access-token | Necessary | Supabase session token — keeps you logged into your RhymeFlux account. | Session |
| sb-refresh-token | Necessary | Supabase refresh token — refreshes your login so you stay signed in. | Up to 30 days |
| rhymeflux-prefs | Functional | Stores your interface preferences (theme, layout, recent songs). | 1 year |
| rhymeflux-consent-v1 | Necessary | Remembers your cookie-banner choice so you don't see the banner every visit. Stored in localStorage. | 12 months |
| _ga | Analytics | Google Analytics 4 — distinguishes unique visitors. Only set after you accept analytics in the cookie banner. | Up to 2 years |
| _ga_G-59P1LBM4DV | Analytics | Google Analytics 4 — measures session activity. Only set after consent. | Up to 2 years |
| ph_…_posthog | Analytics | PostHog (EU-hosted) — stores an anonymous visitor ID, shared across rhymeflux.com and the RhymeFlux app, so we can measure how a visit here leads to using the app. Also powers session replay. Only set after consent. | 1 year |
| Paddle / ProfitWell storage | Necessary (payment) | Set by Paddle.js and its ProfitWell script, which load on our main marketing pages so Paddle Retain can recover a failed payment without making you log in. Not loaded on blog posts or the free tools. Governed by Paddle's privacy policy. | Set and controlled by Paddle |
| IndexedDB (rhymeflux-local) | Necessary | Local-first storage for your lyrics so they survive offline use and browser restarts. Not transmitted unless cloud sync is enabled. | Until you clear it or delete the account |
Vercel Web Analytics is also active on the marketing site. It does not use cookies and does not identify individual visitors, so it appears in this policy for transparency but doesn't appear in the table above.
PostHog is our EU-hosted (posthog.com) product analytics. It uses one first-party cookie shared across rhymeflux.com and the RhymeFlux app so we can see how a visit turns into a signup, and it can record anonymized session replays (the text you type is masked by default) plus aggregate heatmaps of where the site confuses people. It is the same privacy-friendly, EU-hosted analytics the app uses, respects your browser's Do Not Track signal, and only starts after you accept analytics here.
Consent and Google Consent Mode v2
When you visit the site for the first time, you see a banner at the bottom asking whether to accept analytics cookies. Until you accept:
- Google Analytics 4 runs in consent-denied mode (Google Consent Mode v2). It will not set the
_gaor_ga_*cookies and will not collect identifiable analytics data. - PostHog is not loaded at all. Its script and its
ph_…_posthogcookie only begin after you accept, and it honors your browser's Do Not Track setting even then. - No third-party advertising cookies are set. (We do not run ads.)
If you accept, GA4 begins collecting traffic measurement with anonymized IPs. If you reject (or close the banner), GA4 stays in consent-denied mode.
You can change your mind at any time. Use the link in the footer of any page (or the button right here). It clears your saved choice on both rhymeflux.com and the RhymeFlux app, reloads the page so nothing analytics-related is still running, and shows you the banner again.
Third-Party Cookies
Paddle (paddle.com) is our merchant of record. Paddle.js loads on our main marketing pages so Paddle Retain can show a no-login "update your card" form if one of your payments fails. It does not load on blog posts or the free tools. Paddle.js also pulls in ProfitWell, Paddle's own subscription-analytics script.
Both of those load as part of the payment service, before the cookie banner is answered, and anything they store is governed by Paddle's privacy policy rather than ours. They are not part of the analytics you accept or reject here, and we receive no analytics data from them about your visit.
If you continue to checkout, Paddle may set additional cookies during the transaction to prevent fraud and complete the payment.
What We Do Not Do
- We do not run advertising and do not set advertising cookies.
- We do not sell or share cookie data with third parties for marketing.
- We do not use third-party cross-site tracking or advertising trackers. For our own conversion measurement, analytics may link a visit on this marketing site (rhymeflux.com) with the RhymeFlux app (app.rhymeflux.com) - both our own first-party properties.
- We do not load Facebook Pixel, TikTok Pixel, or any social-media trackers.
Managing Cookies in Your Browser
In addition to our cookie banner, your browser lets you block or delete cookies entirely. Note that blocking strictly necessary cookies will prevent you from logging in or using the app.
Cookie settings for popular browsers:
Changes to This Policy
We update this policy whenever we add or remove cookies. The "Last updated" date at the top reflects the most recent version. Material changes will be highlighted on the site.
Contact
If you have questions about our use of cookies, email support@rhymeflux.com. For broader privacy questions, see our Privacy Policy.