Cookies and browser storage

Advertising cookies — your choice

• Google Ads loads only after you accept advertising cookies, on the public site. Accept and Reject have equal prominence. You can change your choice using the button on this page. We remember that choice in lyrik:ads-consent:v1 for 180 days; clearing site data removes it.
• After acceptance, Google can set _gcl_ advertising cookies to connect an ad click with a payment, with a configured 90-day lifetime. We keep up to 100 payment references in lyrik:ads-purchases:v1 to avoid sending the same payment twice. Rejecting later removes this list and accessible _gcl_ cookies and stops our purchase events. This does not undo information already sent to Google. We leave sign-in cookies alone.
• We keep the advertising tag off partner embeds, admin and sign-in routes, development and preview deployments. The tag receives no song files, lyrics, artwork or account email. We use it for measurement, with advertising personalisation disabled.

Your currency

• When local prices are enabled, lv_cur holds the currency detected for your current region. If you choose a currency on the pricing page or when adding credits, lv_cur_choice remembers that choice instead. Both cookies last up to one year and contain only GBP, USD, EUR, CAD or AUD, not a location or account identifier. They are readable by the page, scoped to this site, SameSite=Lax and Secure on HTTPS. Inside a partner’s website they use SameSite=None, Secure and Partitioned. Clearing site data removes the choice.

Signing in safely

• lv_sid keeps your account signed in for up to 30 days. It is HttpOnly and scoped to the site. On HTTPS it is Secure; standalone pages use SameSite=Lax. When lyrik.fm runs inside a partner’s website, it uses SameSite=None and Partitioned so the session stays in that website’s browser partition.
• lv_pre lasts 15 minutes and is limited to /api/auth. It connects an emailed sign-in link to the standalone browser that asked for it. It is HttpOnly, SameSite=Lax and Secure on HTTPS. These cookies support authentication and account security.
• Signing in with Google or Apple, where offered, sets an lv_oauth_… cookie for up to 10 minutes. It ties the provider’s reply to the browser that started the sign-in. It is HttpOnly, Secure, SameSite=None (Apple returns by a cross-site form post) and limited to that provider’s sign-in callback path. It is cleared when the reply arrives.

Robot checks

• Cloudflare Turnstile checks upload, sign-in and report forms, and feedback sent while signed out. It normally returns a short-lived token. A cf_clearance cookie may also be issued if pre-clearance is enabled for the deployed widget or site.

Optional cookieless measurement

• We keep Vercel Web Analytics for optional cookieless traffic measurement on public pages. Vercel acts as our processor for this measurement. The current allowlist is the homepage, Terms, Privacy and Refunds. Analytics is kept off app routes and /embed, including when opened directly. Query values are removed, except campaign tags on the homepage (utm_source, utm_medium, utm_campaign and utm_content), and hash URLs are excluded. This is separate from the cookies needed to sign in.
• This cookieless measurement is separate from the advertising-cookie choice. “Cookieless” does not mean that no information is processed.

Storage on your device

• The app can keep lv:last (last project), lv:recent (up to 12 recent songs), lv:more (studio display preference), lv:tried (an interaction hint) and lv:tour (whether this browser has seen the studio tour) in localStorage. These have no automatic time-based expiry; clearing site data removes them. They are separate from authentication cookies.
• The studio can also keep lv:cover-nudge:<project>, lv:detect-note:<project> and lv:styled:<project> in localStorage. Each records that this browser has been shown one song’s suggestion to add a cover, its note about lyrics we detected, or its styles to pick from, so it is not shown again. On a phone, lv:fine-tune records that this browser has been shown the hint about fine-tuning a clip. They hold nothing else, have no automatic time-based expiry, and clearing site data removes them.
• Preview-only showcase builds also keep lv:showcase:<project> and lv:showcase:wallet for simulated edits and credits. Development builds can hold lv:devlink:<project> in sessionStorage for that tab session. Help articles keep lv-help:read:<article> and lv-help:vote:<article> in sessionStorage: a random ID for that tab, sent with read and vote counts so one visit is counted once. They are removed when the tab closes. These are not production payment records.
• lyrik:first-touch keeps the campaign tags and referring website’s name from a visit through an ad or link, for up to 30 days in localStorage. It is sent when you start to sign in, and removed once you are signed in. It is not kept inside a partner’s website, or when your browser sends Global Privacy Control or Do Not Track.
• lyrik:funnel keeps the names of the steps this tab has already counted (such as landed or picked) in sessionStorage, so each step of a visit is counted once. It holds no identifier and is removed when the tab closes. It is not used inside a partner’s website, or when your browser sends Global Privacy Control or Do Not Track.
• While you pay on the secure payment page, lyrik:pending-order keeps the download you chose (the song and the choice), and lyrik:left-topup keeps that you added credits from a song’s ready page, in sessionStorage, so you come back to it. Neither holds your name, email or payment details. Each is used once, within an hour, and removed when the tab closes. Neither is kept inside a partner’s website.
• lyrik:offer-hidden keeps the name of an offer whose banner you closed, in localStorage, so that banner stays closed; a later offer’s shows again. It holds nothing else, has no automatic time-based expiry, and clearing site data removes it.

Other services and controls

• Sentry error reporting is optional. Its checked-in configuration disables replay, tracing, breadcrumbs, logs and browser session tracking. Stripe’s hosted checkout is a separate service with its own cookie information.
• You can clear or block site data in your browser. Blocking authentication cookies can prevent sign-in.

Referral links

• When referrals are offered, visiting a personal link sets lv_ref for 30 days to remember the first valid link you followed. lv_ref_device is a random first-party browser cookie, also lasting 30 days, used to check repeat claims. It is set when you follow a personal referral link, or when you are signed in while referrals are offered. Both are HttpOnly, SameSite=Lax and Secure on HTTPS. They do not use third-party tracking or browser fingerprinting. Clearing or blocking them may prevent a referral reward.

Seller and contact

lyrik is an independent business based in the UK.

hello@lyrik.fm · Account settings: export or delete