Cookie Policy

1. Introduction

This Cookie Policy explains how Psalmix ("we," "our," or "us") uses cookies and similar tracking technologies on our website and mobile application. This policy should be read together with our Privacy Policy and Terms of Service.

Essential cookies are always active because the service cannot function without them. Non-essential cookies (such as analytics) are used only if you opt in through our cookie consent banner. You can change your choice at any time through the Cookie Preferences option or in Settings → Privacy.

2. What Are Cookies?

Cookies are small text files that are stored on your device (computer, smartphone, or tablet) when you visit a website or use an application. They help websites and apps recognize your device and remember information about your visit or preferences.

Cookies can be "session cookies" (which expire when you close your browser or app) or "persistent cookies" (which remain on your device for a set period or until you delete them).

3. Types of Cookies We Use

We use different types of cookies to provide and improve our service:

3.1 Essential Cookies (Strictly Necessary)

These cookies are necessary for our service to function and cannot be disabled in our systems. They are usually set in response to actions you take, such as logging in, setting preferences, or filling in forms.

• Authentication: Keeps you logged in as you navigate between pages
• Security: Protects your account from unauthorized access and helps prevent fraud
• Session Management: Maintains your active session while using Psalmix
• Load Balancing: Distributes traffic efficiently across our servers

3.2 Functional Cookies

These cookies enable enhanced functionality and personalization. They may be set by us or by third-party providers whose services we use. If you do not allow these cookies, some features may not function properly.

• User Preferences: Remembers your theme settings, maturity level preferences, and content filters
• Language Settings: Stores your preferred language
• Playback Settings: Saves your audio quality preferences and playback settings
• Parental Controls: Maintains your family account settings and content restrictions

3.3 Analytics Cookies (Performance)

These cookies help us understand how visitors interact with our service by collecting and reporting information anonymously. This helps us improve our service and user experience.

• Usage Analytics: Tracks which features are most used and how users navigate the app
• Performance Monitoring: Measures page load times and app performance
• Error Tracking: Helps us identify and fix technical issues
• A/B Testing: Allows us to test improvements to the user experience
• Session Recording: On our public marketing and signup pages only, a replay of how the page was used — mouse movement, clicks, and scrolling — so we can find where people get stuck. All text is masked in your browser before the recording is sent, so we receive a wireframe rather than readable words, and recording never runs on the pages where you listen, browse your library, or manage your account. See Section 4.4
• Heatmaps: On those same public pages only, where on a page people click and how far down they scroll, added up across visitors. A click is stored as a position on the page, never as what you clicked on, so no words are collected. Like recording, it never runs on the pages where you listen, browse your library, or manage your account. See Section 4.4

3.4 Advertising Cookies

Advertising cookies are off by default and load only if you opt in. If you choose "Accept all" in our cookie banner, we load the Meta (Facebook) advertising pixel on our public marketing pages. Its job is measurement: telling us which ads actually brought people to Psalmix, so we can stop paying for the ones that don't work.

What it can see: that a visit or a signup happened, your IP address, your browser, and which marketing page you were on.

We also report some conversions from our own servers. If you opted in to advertising cookies and you reached us by clicking one of our ads, we store that ad's click identifier on your account. When you then create an account (including with Google or Apple), begin a checkout, start a trial, or pay for a subscription, our server tells Meta that the conversion happened — sending that click identifier, a scrambled (one-way hashed) version of your email address, and, for payments, the amount paid. Your email address is never sent in readable form, and nothing here is sent from your browser or requires a cookie on the page where you converted.

We do this because the events that matter do not happen in a web page: a payment is confirmed by our payment provider afterwards, and a signup with Google or Apple finishes on a part of our site the pixel is never loaded on. Without server-side reporting we cannot tell which ads bring people who actually subscribe — only which ads bring clicks. The same opt-in governs both. If you did not opt in to advertising, no conversion is reported from our servers either. If you turn advertising off later, the click identifier stored in your browser is deleted immediately, and our servers stop reporting for your account as soon as the withdrawal is connected to it — which is immediate when you make the change while signed in. If you withdraw while signed out, sign in and confirm the setting so we can attach the choice to your account.

What it can never see — and these are hard limits, not intentions:

• Your listening history, playlists, or any song or artist data. We do not send music information to advertising networks, whether or not you opted in — not from the pixel, and not from our servers either. A conversion report says that a signup, a checkout, a trial or a payment happened. It carries no song, artist, playlist, station or genre, and there is no field in it that could.
• Anything you do in the app. The pixel loads only on our public marketing pages — the ones anyone can read without an account, like this one. It is never loaded on the pages where you listen, browse your library, or manage your account. Server-side reporting does not change that: it reports the fact of a subscription or trial, never any activity inside the product.
• Automatically-collected form and button activity. Meta's Automatic Configuration, which would otherwise gather interactions with page elements on its own, is explicitly turned off.

Accepting analytics cookies does not accept advertising cookies. When you first arrive, choose "Customize" in the banner to allow measurement of the product without advertising, or "Essential only" to decline both. Afterwards you can change your mind at any time — in Privacy Settings, or via "Cookie Settings" in the footer of our public pages — and a Global Privacy Control signal from your browser turns advertising cookies off without you having to do anything.

We do not build advertising profiles of our users, and we do not sell your personal information. Note that California law treats the use of an advertising pixel as "sharing" personal information for cross-context behavioral advertising even where no money changes hands — see our Privacy Policy for your rights and how to opt out.

4. Third-Party Cookies

We work with trusted third-party service providers who may also set cookies on our behalf:

4.1 Authentication & Database (Supabase)

• Purpose: Secure authentication and session management
• Type: Essential cookies
• Data Processing: Secure, encrypted storage

4.2 Payment Processing (Creem)

• Purpose: Secure subscription checkout and fraud prevention
• Type: Essential cookies (set during checkout; cannot be disabled)
• Details: Creem processes our web subscription payments and may use cookies and browser storage for payment security and fraud prevention. See creem.io/privacy

4.3 Hosting & Performance (Vercel)

• Purpose: Website hosting, performance optimization, and analytics
• Type: Essential and performance cookies
• Data Processing: Anonymized traffic and performance metrics

4.4 Analytics Tools

Analytics cookies are loaded only after you opt in through our cookie consent banner. Until you consent (and whenever a Global Privacy Control signal is detected), no analytics scripts run.

• PostHog (product analytics and session replay): Records how our public marketing and signup pages are used and lets us replay it, so we can see where people get stuck before they ever create an account — and counts a short list of named steps, both on the signup form itself and inside the app once you are signed in, so we can see the same thing after signup.
  • Scope of session replay: Public marketing and signup pages only — never on the pages where you listen, browse your library, or manage your account
  • Scope of named events: Anywhere in the app while you are signed in, and on our public marketing and signup pages before you have an account. A shared song link opened without an account is neither — nothing is counted there. The list is short and fixed: completing signup, being shown a price, starting checkout, your browser seeing the subscription confirmed when you return from the payment provider, starting playback for the first time (counted once for each identity in a visit — so signing in, or out, and playing again counts again, because those stretches are deliberately not joined), and the steps of the signup form itself — opening it, moving between fields, a validation message, choosing Google or Apple, submitting. Where a step fails we record a fixed category such as "already registered", never the error text and never the address you typed
  • One extra cookie, named: if you sign up with Google or Apple, our server sets a short-lived first-party cookie called psx_signup_completed on the redirect back. It holds one word — which provider you used — expires after five minutes, and exists only so the browser can count the signup, because the account is created on our server where the analytics code does not run. It contains no identifier. If you have not opted in to analytics it is read and discarded without sending anything
  • The two are not joined: when you sign in we start a fresh, unlinked identity, so what you did before you had an account — including the masked recording of you filling in the signup form — is not attached to your account and cannot be retrieved from it
  • What a recording contains: mouse movement, clicks, scrolling, page changes, your browser and screen size, and the pages you viewed
  • What it can never contain: readable text of any kind. Every piece of text is masked in your own browser before the recording is sent — not only what you type into a form, but any text the page shows back to you, such as an email address on a confirmation screen. What we receive is a moving wireframe with blocks where the words were. Recordings also carry no listening history, playlists, or song data, because recording never runs where that exists
  • What a named event can never contain: anything identifying what you listened to. No song, playlist, artist, or station is attached to any event — "playback started" records that you pressed play, never what you pressed play on — and the address of any page inside the app is replaced with a placeholder before it is sent. Our catalogue includes worship and gospel music, so a listening history could suggest something about your religious beliefs; we do not collect it
  • Role: PostHog is our data processor under a Data Processing Agreement. It processes this only on our instructions and does not use it for its own purposes or for advertising — unlike an advertising network, it is not a separate controller of your data
  • Storage and retention: Stored in the United States; recordings are deleted after 30 days. Named events are kept for no longer than 12 months, and the ones tied to your account are erased when you delete your account
  • Cookies and browser storage: first-party only — a cookie and an entry in your browser's local storage, holding a random ID so page views in one visit can be joined into one recording. No third-party cookies, no advertising cookies, and no tracking across other websites. Withdraw consent in Settings → Privacy or via "Cookie Settings" in our footer. See posthog.com/privacy
• Google Tag Manager (GTM): We use GTM with Google Consent Mode to manage our analytics scripts. GTM itself does not collect data; it loads the analytics tools listed above only after consent. See policies.google.com/privacy

4.5 Advertising (Meta / Facebook)

Loaded only if you opt in to advertising cookies — a separate choice from analytics, and off by default.

• Purpose: Measuring whether our ads brought people to Psalmix
• Type: Advertising cookies (never essential; always optional)
• Scope: Public marketing pages only — never on the pages where you listen, browse your library, or manage your account. Conversions (signups, checkout starts, trials and payments) are additionally reported from our servers, which is described below
• Data Processing: IP address, browser information, and which marketing page you viewed. Never listening history, playlists, or song data. Meta's Automatic Configuration is turned off, so it does not gather page interactions on its own. See facebook.com/privacy/policy
• Server-side reporting (Conversions API): For opted-in users who arrived from one of our ads, we report account signups (including Google/Apple), checkout starts, trial starts and payments directly from our servers, sending the ad click identifier, a one-way hashed email address, and, for payments, the amount paid. No IP address or device information is sent with these. This runs only on an advertising opt-in and stops when you withdraw it (immediately, when the withdrawal is made while signed in)

We carefully vet all third-party providers to ensure they meet our privacy and security standards. For more details on how these providers use cookies, please refer to their respective privacy policies.

5. How to Manage Cookies

You have several options to manage or disable cookies:

5.1 Browser Settings

Most web browsers allow you to control cookies through their settings. You can:

• Block all cookies
• Block third-party cookies only
• Delete cookies when you close your browser
• Accept cookies from specific websites only

5.2 Mobile App

The Psalmix mobile app does not use cookies or third-party analytics or advertising trackers. You can manage app permissions and data storage through your device settings.

5.3 Consent Withdrawal

To withdraw consent for non-essential cookies at any time: (1) open Settings → Privacy in your account and turn off analytics, (2) clear cookies in your browser settings, or (3) email hello@psalmix.com with subject 'Cookie Opt-Out'. Withdrawing consent will not affect your ability to use Psalmix but may affect personalization features.

Important Note: Blocking or deleting essential cookies may affect your ability to use Psalmix. You may not be able to log in, save preferences, or access certain features if essential cookies are disabled.

6. Psalmix Age Requirements & Privacy

Psalmix is intended for users 13 years of age and older. We do not knowingly collect information from users under 13. For more information about our age requirements and privacy protections, see our Privacy Policy.

7. Do Not Track & Privacy Signals

Some browsers include a Do Not Track (DNT) feature. Currently, our website does not respond to browser DNT signals.

Global Privacy Control (GPC): We honor GPC browser signals for all users, not just California residents. Analytics cookies are disabled when a GPC signal is present unless you have explicitly opted in through our cookie banner. Advertising cookies are disabled whenever a GPC signal is present, with no exception — a prior opt-in does not override it, because under CPRA the signal is itself a valid opt-out of sharing.

8. Updates to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will notify you of any material changes by:

• Posting the updated policy with a new "Last Updated" date
• Sending an email notification (for significant changes)
• Displaying a prominent notice on our website or in the app

We encourage you to review this Cookie Policy periodically to stay informed about how we use cookies.

9. Contact Us

If you have questions about this Cookie Policy or how we use cookies: