Cookie Policy

These technologies provide authentication, security, transaction continuity, or your saved privacy choice. The Platform cannot provide the relevant function without them, so they are not controlled by the marketing switch.

• Account session cookie: authenticates your account and associates requests with a server-side session. It is HttpOnly, Secure in production, and SameSite Strict. Without Remember me, it is a browser-session cookie with a renewable 24-hour authentication window. With Remember me, it is persistent with a renewable 90-day window. Authenticated requests after the midpoint renew the window; there is no fixed maximum measured from your original login. If the window expires before renewal, you must sign in again. Browsers may restore session cookies when reopening, so use Sign out on shared devices. Signing out revokes that server-side session.
• Security cookie: helps prevent cross-site request forgery on authenticated actions. It is HttpOnly, Secure in production, SameSite Strict, and normally lasts for the browser session.
• Privacy preference cookie: stores a protected random preference reference, the latest marketing choice, its policy version, decision time, and consent-record reference. It is HttpOnly, Secure, SameSite Lax, and expires 365 days after it is last written.
• Signed-out privacy choice cookie: remembers an explicit marketing choice made while signed out so it can be associated with your account if you sign in during this browser session. This protected, HttpOnly, Secure, SameSite Lax session cookie is consumed on sign-in; a decision more than 24 hours old is not carried into an account.
• Checkout session storage: remembers the selected Drop package or custom amount in the current browser tab while Stripe checkout is completed. It is removed after use or when the tab session ends.
• Stripe checkout technologies: Stripe may use cookies or similar data necessary to securely render checkout, prevent fraud, remember an eligible payment method, and complete the transaction.
• reCAPTCHA technologies: registration, login, and password recovery use Google reCAPTCHA to assess automated abuse without a visual challenge. When reCAPTCHA runs, Google receives browser and device information, your IP address, and a verification token. It sets the necessary _GRECAPTCHA cookie for risk analysis. These security technologies are independent of the marketing choice.

The privacy cookie is not an advertising identifier and is not used for fingerprinting. Deleting it creates a new random browser reference and may require you to make a new choice. When signed in, the latest account-associated choice may be restored.

• Support chat: for authenticated users, our self-hosted Chatwoot widget may use a cw_user_<website-token> cookie and related browser storage to maintain an identified support session and conversation. It receives your Squeeze My Music user ID, email, name, optional avatar, role, profile status, and country. Duration follows the support-system configuration and conversation needs.
• Spotify playback: in the submission review and campaign preparation screens, the player for the selected track loads automatically to make listening available. Loading the player does not start the audio. On public curator profiles, the player loads when you choose an item to play. Loading connects your browser to Spotify before audio starts: Spotify receives your IP address, browser and device information, and the requested content identifier, and may set or read its own and third-party cookies. These technologies may serve purposes beyond playback, as described in Spotify’s Cookie Policy and Privacy Policy. Squeeze My Music’s marketing setting controls our marketing integration; it does not configure Spotify’s player or its cookies. Provider and browser settings offer controls over third-party cookies; blocking them may affect playback.

These functions connect to services that may act independently for their own security, compliance, and service-improvement purposes. Their cookies and retention are governed by their policies and browser controls.

When marketing measurement is allowed, Meta Pixel may load in your browser and Meta may set or read _fbp (a browser identifier) and _fbc (a click identifier). Meta receives limited page and conversion events described in the Privacy Policy. Squeeze My Music also uses per-tab session-storage markers to avoid sending the same checkout event repeatedly. After marketing is allowed, Squeeze My Music can preserve an incoming ad click in an _fbc cookie for up to 90 days. Before that choice, a click identifier from the entry URL is held only in page memory. Meta may also manage these cookies and other storage; their effective duration can vary by browser and configuration.

If you disable marketing, Squeeze My Music stops new Pixel and server-side conversion events associated with your choice and attempts to remove known _fbp and _fbccookies from the Squeeze My Music domain. This cannot delete information or cookies controlled by Meta on another domain or undo processing that lawfully occurred before your choice.

When you select Save for later on an invitation, you allow us to store a first-party invitation cookie for up to 30 days on this browser. The protected cookie contains the inviter’s internal account reference and role, expiry, and the time and wording version of your saving choice. It is HttpOnly, Secure in production, and SameSite Lax. It is used to apply the invitation if you register later, including eligible referral benefits under our Terms. It does not enable Meta advertising or newsletter subscriptions.

Opening a link alone does not save this cookie. Join now carries the invitation into registration without requiring the 30-day cookie. Saving a different invitation replaces the previous one and starts a new 30-day window. Reopening or saving the same invitation does not extend its existing expiry. You can withdraw your saving choice through Remove saved invitation in the invitation banner. We also remove the cookie after successful registration or sign-in. Removing it does not undo referral attribution already recorded on an account. Browser settings can also delete the cookie.

We use IP-derived country information to select a privacy mode. In the EEA, United Kingdom, and Brazil, Meta marketing technologies remain off unless you affirmatively allow them; an approval must be renewed after 180 days. In the United States and Switzerland, they may be on unless you opt out. In other countries, they may be on by default unless you previously opted out or Global Privacy Control is active. Applicable local law may provide additional rights.

If we cannot determine a country, we apply the opt-in mode. Geolocation is approximate, so contact us if the wrong mode is shown. A browser choice does not override technologies that are strictly necessary for authentication, security, or a transaction you request.

• Open Your Privacy Choices to allow or disable Meta marketing and view the reference for your current decision.
• Enable Global Privacy Control; the Platform treats a detected signal as a marketing opt-out in every region and records it for a signed-in account where applicable.
• Use browser settings to block or delete cookies and site data. Blocking necessary storage may prevent sign-in, checkout, fraud checks, support chat, or embedded playback.
• Use provider or browser controls for information stored on third-party domains.

While signed in, an explicit marketing choice applies to your account across devices. The latest explicit decision takes precedence. If you explicitly choose while signed out and sign in during the same browser session, within 24 hours, we associate that choice with your account and compare its original time with your account’s latest choice. Without such a choice, your saved account preference applies. Signing in is not consent and does not renew a permission’s expiry. We do not transfer another account’s choice or turn a regional default into an explicit permission. Global Privacy Control continues to disable marketing. Connected browsers receive account changes when they next refresh their privacy context; queued server events check the current choice before dispatch.

Browsers may send “Do Not Track” signals that do not have a uniform legal or technical meaning. We do not respond to those signals unless required, but we do respond to Global Privacy Control as described above.

To apply and demonstrate a marketing choice, we record the random browser preference reference, choice, time, legal-policy version, approximate country, IP address, browser User-Agent, and, when signed in, user ID. This evidence is used for privacy compliance, not to fingerprint you or create a music-interest profile. A denial remains effective until you change it, the applicable account choice changes, or the preference is no longer available under our retention rules.

We may update this Policy when technologies, providers, or laws change. Material changes will be published as a new dated version and, where required, presented for a new choice. Questions about cookies or privacy choices may be sent to support@squeezemymusic.com or mailed to Squeeze My Music LLC, 30 N Gould St, Ste N, Sheridan, Wyoming 82801, United States.