Cookies & analytics

1. Current browser storage

demotapes_session

First-party authentication cookie containing a random session token. It keeps access to your private workspace and is HttpOnly, SameSite=Strict and Secure on HTTPS. The cookie lasts up to 30 days; it can be cleared or replaced sooner. The server stores a hash and checks its expiry. Blocking it prevents private session features from working.

demotapes_owner

Essential random owner-library cookie for My tapes. HttpOnly, SameSite=Strict and Secure on HTTPS, lasting up to 90 days. The server stores its hash and permitted project memberships. A separately saved recovery key can restore the library; only its hash is stored. Locking this browser removes its access cookies; recovery ends previous sessions for that library. Neither credential is used for listener tracking or stored in localStorage.

demotapes-stash-v1

Local album/song bookmarks and display metadata saved at your request without an account. No audio, passwords or playback grants are stored here. Clearing site data removes these bookmarks. Signing in is optional; copying bookmarks to Dots requires the sync action.

demotapes-player-style

Your chosen deck, CD or cassette, shared between players on this browser. It lasts until changed or cleared. Explicit player-style parameters in a shared link take priority. This preference does not identify listening sessions.

demotapes-theme

Local storage for the light/dark preference you choose. It has no programmed expiry and remains until changed or cleared in your browser. It does not count plays or identify a listener for analytics.

demotapes_commenter and demotapes-commenter-v1

Created when you request an anonymous comment handle, not when you merely play a tape. A random first-party cookie (HttpOnly, SameSite=Lax, Secure on HTTPS) and a localStorage fallback remember your generated handle. The server stores only a hash of the credential and renews its expiry for 90 days after use. These credentials authorize use of the handle; they are separate from visitor counts and playback reports. When you sign in, a private keyed account mapping syncs the handle without showing your profile name to listeners. Generated handles remain reserved to avoid reuse. Blocking or clearing storage may create a new handle; an existing account can restore its connected handle.

demotapes_dots

Optional sign-in session for the requested Dots stash feature. A random HttpOnly, SameSite=Lax cookie, Secure on HTTPS, lasts up to 90 days. The server stores its hash and verified Dots subject. Sign-out removes this device session. It is not a playback analytics identifier and does not unlock private tapes.

demotapes_listener

Essential random access token for one listening page. HttpOnly, SameSite=Lax, Secure on HTTPS, scoped to that tape’s API path; expires after 24 hours. The server stores a hash and checks the current password generation.

Listening session ID

A random ID held only in page memory after playback starts. It groups playback actions in that page visit, expires server-side after eight hours and is replaced after a reload. No playback analytics ID is written to cookies or localStorage. The access cookie still authorizes requests; it is not shown in reports or used to recognize returning listeners.

dt_device_<tape-id> (legacy)

Earlier players set this optional 90-day browser ID after consent. The current player's session endpoint clears it and does not use it. Previously collected reports remain subject to retention.

dub_id link parameter

The current player removes and discards it. It does not attach automatic listening reports to a Dub click, and embeds no Dub script.

Dots sign-in may use a short-lived essential transaction cookie, and private preview deployments may use an essential preview-access cookie. Optional lyrics processing is separate from analytics consent.

2. Short-link analytics

A Dub short link first sends a request to Dub’s redirect service. That service may process and record click information before the destination page loads, before its password is entered, and before any consent control displayed on that page. A choice shown after the redirect cannot undo collection that already happened.

Before launch, the operator must verify redirect-side tracking, applicable legal requirements, provider controls, link decoration such as dub_id, and any storage used to retain attribution. A claim that a link is “untracked” must be verified for the whole redirect path. An alternative direct link may avoid Dub but still involves ordinary connection and security processing by the host.

Tape visitor counter

The public counter estimates distinct browsers on each device opening a tape, separately from playback. demotapes_visit is a signed random first-party cookie, scoped to one tape's API path, HttpOnly, SameSite=Lax and Secure on HTTPS. demotapes-visit-v1:<tape-id> in localStorage holds the same tape-specific random ID and its expiry. Either storage mechanism can recognize a returning browser; simultaneous tabs coordinate when the browser supports Web Locks. Changing song, player style or short-link parameters does not create another visitor. Recognition renews for 90 days after a counted visit; expired local IDs are removed when that tape is next opened. The server retains only a tape-specific keyed hash and expiry. Expired hashes are removed on the next visitor-counter request; the cumulative total remains for the tape.

These IDs are not joined to listening sessions, accounts, IP addresses or source links, and visitor records are not sent to Dub. No hardware, canvas, font or audio fingerprint is collected. The counter does not count ordinary social-preview crawlers or prove a person listened. Global Privacy Control or Do Not Track disables recognition and counting, and removes that tape's cookie and local ID when its counter is next requested. Browsers blocking both cookies and localStorage display the aggregate without adding a visitor, to avoid counting every reload. Clearing all site data, using another browser or returning after 90 days of inactivity can count again. These are browser estimates, not verified people or physical devices. Counts start when the feature is enabled; no historical visits are inferred. We also count measured tape-page loads separately from plays. A fresh random ID held in page memory deduplicates the cookie handshake and retries; its tape-specific hash and timestamp expire after 90 days. It does not recognize a returning browser or link to accounts or listening sessions. Counts per minute retain page loads and newly recognized visitors without browser or page IDs. Page-load history begins when this feature is used; older loads are not reconstructed.

3. Playback reports

When the uploader enables listening stats, playback automatically starts a temporary reporting session. Reports include track starts, qualified plays, listening seconds, pauses, resumes, seeks, skips, finishes, and speed/volume changes. A play qualifies after 30 seconds of eligible playback or 80% of a shorter track. Pauses, buffering, muted playback and seeking distance do not count as listening.

Only the uploader's authorized editor and the operator can access reports. These are session estimates, not identified or unique people. Individual session and event records are stored in SQLite/Turso for 90 days, removed on the next access-triggered cleanup. Tape/song counts per minute remain without session, browser, account or access-token IDs for year and available-history reports. These aggregate listening and page-load totals have no automatic expiry; deletion requests go to the privacy contact. Already expired historical activity cannot be reconstructed. Automatic reports do not go to Dub and do not identify repeat visits. Hosting and access-security processing are separate.

4. Reporting controls

The uploader can disable listening stats. Playback reports use no permission prompt or persistent identifier. The separate visitor-counter cookie recognizes browsers opening that tape; it is not used for playback reports. Browser Global Privacy Control or Do Not Track signals disable listening reports; playback remains available. Existing reports are not automatically deleted by a browser setting. Contact the privacy address for requests.

Older player versions may still offer optional persistent recognition and Dub play attribution through the legacy consent endpoint. Those features require that older player's opt-in and are not enabled by the current player's automatic session reports.

5. Browser privacy signals

Global Privacy Control and Do Not Track disable listening measurement in the current player and API. We do not use hardware fingerprints, canvas/font probing or cross-site advertising trackers. The temporary session ID is not reused after a reload. Necessary hosting, access and security processing continues.

6. Managing this prototype

You can change the theme in the player and clear this site’s cookies/local storage through browser settings. Doing so may remove access to a workspace without a recovery method. It does not delete uploaded media.

A browser privacy signal cannot undo a prior Dub redirect click. The uploader can provide a direct listening link if you prefer to avoid the Dub redirect. Privacy requests go to help@🗣.fm.

References

Dub privacy policy describes its processing. The UK ICO’s storage/access exceptions guidance explains conditional exceptions; it is not a statement that our proposed use qualifies. Requirements depend on the deployment and applicable law.