Effective
1What this page covers
This policy covers artistplus.io, including our marketing pages, the sign-up flow, and the artist dashboard. It lists every cookie and every browser storage key we set, whether we set it ourselves or a provider sets it for us.
Browser storage that is not technically a cookie is listed too. Local storage and session storage sit on your machine exactly as a cookie does, and a table that quietly left them out would be accurate and misleading at the same time.
How the data these produce is used, and who else sees it, is covered by the Privacy Policy.
2The four categories
- Strictly necessary
- Needed for the site to work at all: keeping you signed in, remembering the choice you made about this banner, and stopping cross-site request forgery. These cannot be switched off, and we do not ask for consent to set them.
- Preferences
- Remember a setting you chose, like light or dark mode. They are set by your own actions and never leave your browser.
- Analytics
- Tell us which signed-in product pages, controls, and features get used so we can improve the product and understand our customers. Optional collection is off until you accept where consent is required, and stops if you decline.
- Advertising
- Let us measure which ads bring people to Artistplus, and reach similar people. If you accept, Meta, TikTok, and Google receive a record that a signup or subscription happened, along with a scrambled (hashed) version of your email and name that lets them recognise an account they already have. They never receive your password, your card, your music, or anything you upload. Declining costs you nothing.
3Strictly necessary
These are set on the basis that the service you asked for cannot be delivered without them, and they are exempt from the consent requirement under the ePrivacy Directive and the UK PECR. They cannot be switched off from the banner.
| Name | Type | Set by | Purpose | Lifetime |
|---|---|---|---|---|
| __session | Cookie | Clerk | Holds your signed-in session so the header can show your account. | Session, refreshed while you are active |
| __client_uat | Cookie | Clerk | Records when your session was last authenticated so it can be refreshed. | Session |
| __clerk_db_jwt | Cookie | Clerk | Carries the signed session token used to authorise your requests. | Session |
| ap_cookie_consent | Local storage | Artistplus | Remembers whether you accepted or declined analytics, so we stop asking. Holds only your choice and the date you made it. | 12 months, then we ask again |
| ap_product_session_id | Session storage | Artistplus | Groups the signed-in consent record and, when analytics is allowed, product activity from one browser tab into a session. It is a random value and contains no account details. | Until you close the browser tab |
| ap_ref | Cookie | Artistplus | Credits the artist whose referral link you followed, if you signed up through one. Set only after you open a /join link. | 30 days |
| sc_oauth_state | Cookie | Artistplus | A one-time value that proves a SoundCloud sign-in came back to us from you and not from an attacker. | Deleted as soon as the connection completes |
| __stripe_mid, __stripe_sid | Cookie | Stripe | Stripe sets these on the payment form to detect card fraud. They only exist once a checkout form has loaded. | 1 year and 30 minutes respectively |
4Preferences
These record a choice you made so that we do not have to ask again. They stay in your browser and are never sent anywhere.
| Name | Type | Set by | Purpose | Lifetime |
|---|---|---|---|---|
| theme | Local storage | Artistplus | Remembers whether you chose light, dark, or system appearance. | Until you clear your browser storage |
| ap:pending-artist-link, ap:pending-domain | Local storage | Artistplus | Carries a link or a domain you typed on the marketing site across sign-up, so onboarding starts where you left off. Cleared once it is used. | Until used, or 24 hours |
5Analytics, and how to say no
We use PostHog and our own first-party product telemetry to understand acquisition, product use, performance, and customer lifecycle. Analytics is optional and has its own toggle on the banner, separate from advertising. Accepting one is never treated as accepting the other.
| Name | Type | Set by | Purpose | Lifetime |
|---|---|---|---|---|
| ph_<project>_posthog | Cookie and local storage | PostHog | Gives your browser an anonymous id so repeat visits count as one person rather than several. Never set unless you accept. | 12 months |
| ap_product_first_touch | Local storage | Artistplus | Remembers the first campaign, referral source, or referring website that brought a signed-in user to the product, so later product activity can be attributed to that source. | 90 days |
What declining actually does
The PostHog library is never initialised, and optional first-party activity, environment, performance, and campaign collection does not start. For a signed-in product user, we make one necessary first-party request when the choice is observed or changed. It records the decision, policy version, privacy signals, a random tab-session id, and basic request security context; a decline produces no marketing event. This evidence is what lets us prove and consistently enforce the choice.
If you accepted before and change your mind, we also stop capturing immediately and clear what the library stored, without waiting for a page reload.
Global Privacy Control
If your browser or an extension sends a Global Privacy Control signal, we treat it as a decision to decline and analytics never loads, whether or not the law where you are requires us to honour it. You can still accept explicitly from the banner if you want to.
6Advertising, and how to say no
If you accept the advertising category, we load the Meta pixel, the TikTok pixel, and the Google Ads tag on artistplus.io, and we send those companies conversion reports, meaning a record that a signup, a checkout, or a subscription happened, together with a scrambled (hashed) version of details like your email that lets them recognise an account they already hold. This is what lets us measure which ads work and reach people similar to our customers. It is described in full in the privacy policy alongside the subprocessor list.
| Name | Type | Set by | Purpose | Lifetime |
|---|---|---|---|---|
| _fbp | Cookie | Meta | Gives your browser an id Meta uses to tell whether an ad on Facebook or Instagram led to a visit here. Never set unless you accept advertising. | 90 days |
| _fbc | Cookie | Meta | Records the id of the specific Meta ad you clicked, so the visit can be attributed to that ad. Only exists after you arrive from a Meta ad. | 90 days |
| _ttp | Cookie | TikTok | Gives your browser an id TikTok uses to tell whether a TikTok ad led to a visit here. Never set unless you accept advertising. | 13 months |
| _gcl_au | Cookie | Stores the id of the Google ad click that brought you here, so a later signup can be attributed to it. Never set unless you accept advertising. | 90 days |
What declining actually does
None of the three tags load, no advertising cookie is set, and no conversion report about you is sent from our servers to any ad network. If you accepted earlier and change your mind, the tags are told to stop immediately, their cookies are removed, and server-side reporting for your account stops with them.
Global Privacy Control
For advertising, a Global Privacy Control signal is final: it switches the category off and the banner cannot switch it back on while the signal is present. That is stricter than the analytics rule, because sending hashed details to an ad network is the kind of sharing the signal exists to stop.
7Artist websites
This policy does not cover the websites we publish for artists. Those sites set no analytics cookies and carry no third-party trackers.
They do store a visitor identifier in your browser's local storage so that repeat visits count as one person rather than several. What that identifier is, what it is used for, and how to avoid it entirely are described in the Privacy Policy.
An artist may add their own embeds to their site, such as a streaming player or a video. Anything those embeds set is governed by the policy of whoever provides them, not by this one.
8Changing your mind, and browser controls
Use the Cookie settings link in the footer of any page to change your choice. It takes effect immediately, without a reload.
Your choice is stored under ap_cookie_consent in local storage and is remembered for 12 months, after which we ask again. Clearing your browser storage for this site clears the choice too, and the banner returns on your next visit.
Every major browser also lets you block or delete cookies and site storage from its own settings. Blocking strictly necessary storage will sign you out and may stop parts of the dashboard from working, which is the trade-off rather than a fault.
9Why you saw the banner you saw
Consent rules differ by country, so the banner behaves in two ways:
- European Economic Area, United Kingdom, and Switzerland
- Analytics does not load until you actively accept. Accept and decline are the same size, the same weight, and side by side. Closing the page without choosing counts as no.
- Everywhere else
- The banner is a notice rather than a gate, and analytics runs unless you decline. Declining is one click and takes effect immediately.
We work out which applies from your browser's reported time zone. We do this rather than looking up your IP address because it needs no request, no third party, and nothing stored, and it is the option that tells us the least about you.
It is deliberately over-inclusive. A time zone is not a legal residence, so anyone whose browser reports a European zone gets the stricter treatment whether or not they are entitled to it. Getting that wrong in the visitor's favour costs us a little data. Getting it wrong the other way costs them a right, and we would rather not.
Questions about any of this go to privacy@artistplus.io.
Revision history
- v1.1Added the signed-in first-party product session and campaign-attribution storage used by user activity and marketing intelligence.
- v1.0First published version. Tables generated from the in-code cookie register.
Every published version of this document is kept. If you need a copy of one that is no longer current, write to support@artistplus.io and we will send it.