Cookies — SingAlong

The short version

SingAlong sets only strictly necessary storage and uses no analytics or advertising storage. The only cookies are the sign-in cookies written by our authentication provider (Supabase); everything we keep in your browser is listed below and is strictly necessary to give you the Service you asked for, which is why you will never see a cookie banner: under the UK Privacy and Electronic Communications Regulations (PECR), strictly necessary storage does not require consent, and putting a fake accept/reject banner in front of you would be misleading rather than protective.

Every piece of storage we use

Storage key	Where	Purpose	How long it lasts	Category
`sb-*`	localStorage	Sign-in session kept by our authentication provider (Supabase) so you stay logged in between visits. Contains only your authentication tokens — nothing about your songs.	Cleared on sign-out; tokens rotate per the auth provider settings.	Strictly necessary
`sb-*-auth-token`	cookie	Your sign-in session, kept by our authentication provider (Supabase) as a first-party cookie so that every page and request — including pages rendered on our servers — knows you are logged in. Contains only your authentication tokens; long values are split into numbered chunks (sb-…-auth-token:0, :1, …). Nothing about your songs.	Refreshed on every visit and removed on sign-out; without any visit the provider lets it lapse after at most 400 days.	Strictly necessary
`sb-*-auth-token-code-verifier`	cookie	A one-time security code (PKCE verifier) that our authentication provider writes in the browser during sign-up and sign-in so it can verify the sign-in finished in the same browser. It exists only for the seconds the sign-in flow takes.	Removed by the provider the moment sign-in completes or is abandoned; never reused.	Strictly necessary
`singalong-previous-songs:*`	localStorage	The “previous songs” list for your account, keyed by your user id so the list follows the account, not the browser. It holds song titles, opaque audio-asset identifiers (UUIDs), the analysis job id, and the pitch/key practice results. It deliberately NEVER stores playable audio links: every playback mints a short-lived signed URL server-side and keeps it in memory only. A copy taken from this device therefore signs nothing.	Cleared on sign-out, on account deletion, and when the entry’s assets are deleted server-side. Legacy copies from older releases (which did contain signed URLs) are destroyed on first read and never restored.	Strictly necessary
`singalong-daily-song-usage`	localStorage	A convenience mirror of your daily song-processing counter so the app can show how many songs you have left today. The binding limit is enforced server-side per account; clearing this key gains you nothing.	Overwritten each UTC day; cleared when browser storage is cleared.	Strictly necessary
`singalong-guest-job-limit`	localStorage	Counts the free guest demo job in this browser so the trial is one job per browser rather than unlimited. Not used for advertising or cross-site identification.	A small integer; persists until browser storage is cleared.	Strictly necessary
`sing.vocalMuteHintDismissed`	localStorage	Remembers that you already saw (and dismissed) the one-time “mute the vocal stem?” hint so the bubble never nags you twice.	Persists until browser storage is cleared.	Strictly necessary
`sing-session-result`	sessionStorage	Keeps your just-finished Sing practice result alive across a page refresh in the same tab, using account-scoped asset identifiers, never signed audio URLs. Playback is reauthorized after refresh.	Cleared on sign-out/account change and account deletion; otherwise removed when the tab closes.	Strictly necessary

There are currently no optional-storage entries — the table above is the complete list, and nothing in it needs your consent.

Your recent songs — what the cache does and does not hold

The singalong-previous-songs:<your-id> cache is the list that lets you reopen songs you processed. It stores song titles, job identifiers, opaque audio-asset identifiers (random UUIDs that are meaningless without your logged-in session) and your practice results (pitch and key data). It never stores playable audio links: signed playback URLs are fetched fresh from our servers for each playback and are kept in memory only. Deleting a song (or your account) removes the server-side audio, and the cache entry stops working even if it still sits on the device. The cache is cleared when you sign out and on account deletion; the audio it points to is covered by the Privacy Notice retention schedule.

What we do NOT do

No cookies other than the sb-*-auth-token* sign-in cookies set by our authentication provider (listed in the table above).
No third-party analytics, marketing pixels, or advertising storage — before or after consent.
No cross-site or cross-device tracking.
No content-detection or fingerprinting scripts; media files are served from our storage host with no tracking parameters.

Controlling storage

Your browser can clear site storage at any time (usually Settings → Privacy → site data). Clearing it signs you out and resets the cosmetic counters; it does not delete anything on our servers. Your account data — including the audio we hold — is described in the Privacy Notice, and you can delete it all from My account.

Note on versioning