Cookie Policy
Last updated: April 29, 2026
What Are Cookies?
Cookies are small text files that websites store on your device. They help the site remember your preferences, keep you logged in, and (with your permission) understand how visitors use the site. This policy explains every cookie RhymeFlux uses, why, and how you control them.
Categories We Use
We group cookies into three categories. Two are always on (without them the site can't function); the third only runs if you opt in via the cookie banner.
- Strictly necessary — required for the app to work (login session, security tokens). Cannot be disabled.
- Functional — remember your preferences (theme, layout, language). No tracking.
- Analytics — help us understand which pages get used and where the site is broken. Disabled until you accept via the banner. You can change your mind any time.
Cookies We Set
| Cookie / Storage | Category | Purpose | Duration |
|---|---|---|---|
| sb-access-token | Necessary | Supabase session token — keeps you logged into your RhymeFlux account. | Session |
| sb-refresh-token | Necessary | Supabase refresh token — refreshes your login so you stay signed in. | Up to 30 days |
| rhymeflux-prefs | Functional | Stores your interface preferences (theme, layout, recent songs). | 1 year |
| rhymeflux-consent-v1 | Necessary | Remembers your cookie-banner choice so you don't see the banner every visit. Stored in localStorage. | 12 months |
| _ga | Analytics | Google Analytics 4 — distinguishes unique visitors. Only set after you accept analytics in the cookie banner. | Up to 2 years |
| _ga_G-59P1LBM4DV | Analytics | Google Analytics 4 — measures session activity. Only set after consent. | Up to 2 years |
| IndexedDB (rhymeflux-local) | Necessary | Local-first storage for your lyrics so they survive offline use and browser restarts. Not transmitted unless cloud sync is enabled. | Until you clear it or delete the account |
Vercel Web Analytics is also active on the marketing site. It does not use cookies and does not identify individual visitors, so it appears in this policy for transparency but doesn't appear in the table above.
Consent and Google Consent Mode v2
When you visit the site for the first time, you see a banner at the bottom asking whether to accept analytics cookies. Until you accept:
- Google Analytics 4 runs in consent-denied mode (Google Consent Mode v2). It will not set the
_gaor_ga_*cookies and will not collect identifiable analytics data. - No third-party advertising cookies are set. (We do not run ads.)
If you accept, GA4 begins collecting traffic measurement with anonymized IPs. If you reject (or close the banner), GA4 stays in consent-denied mode. You can change your choice at any time by clearing your browser's site data for rhymeflux.com — the banner will reappear on your next visit.
Third-Party Cookies
If you proceed to checkout, our merchant of record Paddle (paddle.com) may set cookies during the transaction to prevent fraud and complete payment. Those cookies are governed by Paddle's privacy policy, not ours. Paddle's checkout opens in a separate context — no Paddle cookies are set on rhymeflux.com itself.
What We Do Not Do
- We do not run advertising and do not set advertising cookies.
- We do not sell or share cookie data with third parties for marketing.
- We do not use cross-site or cross-device tracking.
- We do not load Facebook Pixel, TikTok Pixel, or any social-media trackers.
Managing Cookies in Your Browser
In addition to our cookie banner, your browser lets you block or delete cookies entirely. Note that blocking strictly necessary cookies will prevent you from logging in or using the app.
Cookie settings for popular browsers:
Changes to This Policy
We update this policy whenever we add or remove cookies. The "Last updated" date at the top reflects the most recent version. Material changes will be highlighted on the site.
Contact
If you have questions about our use of cookies, email welcome@rhymeflux.com. For broader privacy questions, see our Privacy Policy.