1. Current position
The StringPitch presentation website does not intentionally set advertising, marketing or cross-site tracking cookies. The browser app uses local and session storage needed to remember settings, maintain accounts, recover safe pending operations and provide requested functions. Because the current release does not use optional analytics or advertising trackers, no optional-tracking consent banner is shown.
2. App storage
Local app storage may contain settings, notation and instrument choices, custom tunings, valid practice statistics, graph/tuner takes, interface preferences, trial state, pending synchronization or account-deletion operations and a non-authoritative cached entitlement. Clearing this storage may remove unsynchronized local information or process-recovery state.
3. Authentication storage
If you sign in, Supabase or an enabled identity provider may use cookies, local storage or secure session tokens to authenticate you, refresh the session, complete OAuth return flows and prevent account misuse. This storage is necessary for the account feature requested by the user.
4. Cloudflare Turnstile security processing
Protected account forms load Cloudflare Turnstile from challenges.cloudflare.com. Turnstile may use necessary browser storage and processes technical browser, device, network and challenge-interaction signals, which can include the IP address and browser characteristics, to identify automated abuse and issue a short-lived challenge token. StringPitch sends the token to Supabase Auth for server-side validation and does not use Turnstile for advertising or analytics. Blocking Turnstile prevents the protected account action from being completed.
5. Stripe checkout and billing
Selecting a plan or choosing a donation amount opens Stripe Checkout; no payment is made by that StringPitch button itself. Stripe may then use its own cookies, payment identifiers, device signals and fraud-prevention storage under its policies. Stripe storage is used to review and confirm the payment or voluntary contribution, process it, manage billing and help prevent fraud, not for StringPitch advertising. A donation does not activate Premium.
6. Feedback rate limiting
The in-app feedback endpoint does not require a tracking cookie. It uses a short-lived pseudonymous token derived from the request IP address in temporary server storage to limit repeated messages and spam. That temporary data is pruned after approximately two hours.
7. Your controls
You can clear website storage in browser settings, sign out to end the current account session, or use in-app reset controls where available. Blocking essential storage or Turnstile may prevent account, trial, synchronization, checkout-return, purchase or donation functions from working. Clearing storage does not cancel a Stripe subscription, submit a withdrawal statement, refund a donation or delete cloud account data.
8. Future changes
If optional analytics, advertising, chat widgets, additional payment providers or native mobile SDKs are introduced, this Notice, the Privacy Policy and any required consent controls will be updated before those technologies are enabled.