Cookie Policy

What we store on your device — cookies and browser storage — why, and how you control it. We run no advertising.

1. What this policy covers — cookies *and* browser storage

Websites can store information on your device in more than one way. A cookie is a small file a site or a service sets in your browser. But sites can also use browser storage (called localStorage and sessionStorage) to keep information on your device.
Austrian law (the Telecommunications Act, TKG 2021 §165(3)) treats all of these the same way: storing information on, or reading it from, your device needs either a genuine reason tied to a service you asked for, or your consent. This policy therefore lists both cookies and browser storage, and every table below has a Type column identifying which is which. Browser-storage items are labelled as such and are not called "cookies".

2. The two categories

We use two categories:
  • Necessary — always on. These make the site work for what you asked it to do: keeping you logged in, holding your cart, remembering your own preferences (like player volume or catalog filters), recording your cookie choice, and protecting payments and forms from fraud and bots. Without these, core features simply would not work, so they are not subject to consent.
  • Analytics — off by default, on only if you accept. These help us understand how the site is used — visitor and session counts, where visitors came from, and (optionally) session replay. You choose whether to allow them.
There is no advertising category, and no targeting or ad cookies, because we do none of that.

3. What we store

3.1 Cookies
NameTypeSet byPurposeDurationCategory
as_refreshCookieAudio SanctumKeeps your login session active (session refresh token). HttpOnly.30 daysNecessary
as_consentCookieAudio Sanctum (cookie banner)Stores your cookie choice and a random consent identifier.182 daysNecessary
__stripe_midCookie (Stripe)StripePayment-fraud detection (identifies the device). Only set if you open the cart, checkout or payment settings.1 yearNecessary
__stripe_sidCookie (Stripe)StripePayment-fraud detection (identifies the session). Only set once you start a purchase.30 minutesNecessary
mCookie (Stripe, on m.stripe.com)StripePayment-fraud detection. HttpOnly. Only set once you start a purchase.~400 daysNecessary
as_sidCookieAudio SanctumAnonymous device identifier that links your page views, searches and media events for analytics. HttpOnly. Once you are logged in it is linked to your user account, so it can identify you.1 yearAnalytics
Stripe
Our payment provider, Stripe, loads only when you open the cart, the checkout, or the payment settings in your account — not on ordinary browsing. If you never start a purchase, Stripe is never loaded and the cookies above are never set. Where they are set, they are necessary: payment cannot be offered securely without Stripe's fraud protection.
Form protection
To protect our forms (sign-up, checkout, contact, and others) from bots, we use a self-hosted verification check: your browser solves a small cryptographic challenge that our own server verifies. It sets no cookie, involves no third party, and sends no data to any external provider.
3.2 Session replay storage (analytics — consent only)
If you accept analytics, we use OpenReplay to record how the site is used so we can find and fix problems. OpenReplay sets no cookies — it uses browser storage only:
KeyTypeSet byPurposeDurationCategory
__openreplay_uuidBrowser storage (localStorage)OpenReplayPersistent device identifier so repeat visits are recognised.Until you clear itAnalytics
__openreplay_tokenBrowser storage (sessionStorage)OpenReplayIdentifies this visit's recording.Until the tab is closedAnalytics
__openreplay_token_versionBrowser storage (sessionStorage)OpenReplayToken format.Until the tab is closedAnalytics
__openreplay_tabidBrowser storage (sessionStorage)OpenReplayIdentifies which browser tab.Until the tab is closedAnalytics
__openreplay_pagenoBrowser storage (sessionStorage)OpenReplayCounts pages within the recording.Until the tab is closedAnalytics
What session replay does and does not record is explained in Section 4.
3.3 First-party browser storage
These are set by Audio Sanctum only and cannot be read by any third party.
KeyTypePurposeCategory
accessToken, refreshTokenBrowser storageYour login session.Necessary
as-cartBrowser storageThe contents of your cart (things you added).Necessary
as_cached_userBrowser storageA cached copy of your logged-in profile.Necessary
i18nextLngBrowser storageYour language preference.Necessary (functional)
TRACK_VOLUME, TRACK_MUTEDBrowser storagePlayer volume and mute setting.Necessary (functional)
CatalogLocalStorage.*Browser storageYour catalog filters, tab, sort, and loaded tracks.Necessary (functional)
as-claims-intro-seen, cancelled-banner-dismissed-*, switch-banner-dismissed-*, account-recovered-banner-dismissed-*, downgrade-success-banner-dismissed-*, orders-alert-dismissed, pending-email-modal-closed, dismissed-claim-warningsBrowser storageRemembers "don't show me this again" choices.Necessary (functional)
shuffleSeedBrowser storageKeeps shuffle order stable within a session.Necessary (functional)
TRACK_INFOBrowser storageThe track currently loaded in the player.Necessary (functional)
as_attrBrowser storageFirst-touch referrer and campaign (UTM) information.Analytics
as_identifiedBrowser storageMarks the session as linked to a user.Analytics
as_active_searchBrowser storageAttributes a result click to the search that produced it. Held only in memory if you decline, so basic click quality still works anonymously.Analytics

4. Session replay — what it records, and what it never records

If you accept analytics, session replay captures how pages are used — clicks, navigation, and layout — so we can reproduce and fix issues. Because privacy matters here, we configured it strictly:
  • Whatever you type into a form is not captured at all. Form inputs are fully hidden, which is stricter than the tool's own default.
  • Email addresses shown in page text are masked.
Other numbers that appear as page text (such as prices or track durations) are not masked, because on a music catalog they are not sensitive.

5. Your choice

  • When you first visit, a banner lets you Accept or Decline analytics, with equal-weight buttons and no pre-ticked boxes.
  • You can change your choice at any time through the cookie-preferences link (in the banner and in the site footer).
  • Declining leaves the site fully usable. Everything in the Necessary category keeps working; you are simply not measured by analytics.
Anonymous counting
We also keep some purely anonymous counts — such as total page views and search terms — that have no identifier attached to them. This happens whether or not you accept the banner, because it stores nothing on your device and identifies no one, so it falls outside the consent rules. It is aggregate information (how busy the site is, what people search for), not a record about you.

6. How we prove your choice

When you accept or decline, we record the decision against a random consent identifier kept in your own as_consent cookie. Our audit record of that decision stores no IP address and no browser (user-agent) information — only that identifier, the categories you chose, and the time. We record refusals too, so that a "no" is properly logged. This is explained further, alongside the record we keep when you accept our Terms of Use and Privacy Policy, in the Privacy Policy (Consent records).

7. Changes & contact

We may update this policy — for example if we add or remove a tool. We will post the current version here with its version number. Questions about cookies or device storage:
Make Audio Sanctum betterReport a bug