Cookie/Storage Notice
Version draft-task-13-provider-consent. Last updated 2026-09-19. This draft describes cookies, local/session storage, embedded content, and similar storage/access technologies used by the private alpha.
| Technology | Category | Purpose | Default |
|---|---|---|---|
| Supabase auth cookies/session storage | Strictly necessary | Keep signed-in sessions working | On when auth is configured |
| Practice workspace browser state | Strictly necessary/local app state | Run the practice workspace and preserve unsaved screen state | On |
| YouTube IFrame API and iframe | Optional third-party content | Play saved YouTube practice resources | Blocked until YouTube permission |
| YouTube metadata lookup | Optional third-party request | Fetch video/playlist titles when saving a YouTube resource | Blocked until explicit YouTube lookup or persistent permission |
| Deezer API and cover images | Optional third-party search/content | Search catalog metadata and show selected artwork | Blocked until Deezer permission |
| Uploaded file signed URLs | Strictly necessary account storage | Show private uploaded PDF/Guitar Pro files | On for uploaded resources |
| Next/font Google font assets | Static app asset | Serve app typography | Self-hosted by the production build; no browser request to Google Fonts is expected |
| Analytics | Optional analytics | Product improvement | Off for private alpha unless a later consent task enables it |
We store separate YouTube and Deezer preferences in your account when signed in, or in this browser when signed out. Both start blocked. Previous shared third-party permissions do not authorize either provider; we ask again. Load Once is not stored as a persistent permission. You can withdraw either provider's permission separately in Settings. Consent history records the provider or legacy category, action, notice version, source screen and time, and is included in your account export.
Third-Party Content
Loading YouTube or Deezer content may contact those providers and share request metadata such as IP address, browser/device information, and any provider cookies already present in the browser. You must explicitly allow these providers before any content or tracking from them is loaded.
What Is Off For Private Alpha
Analytics, payments, marketing email, AI provider sharing, support chat, and unreviewed third-party embeds are off unless a later reviewed task enables them with updated notices and controls.