Cookie Policy
Effective date: September 9, 2026
In short: The Tonamorph website uses a handful of cookies. Strictly necessary ones keep you signed in and remember your cookie choices; they need no consent. Our web analytics (Vercel Web Analytics) are cookieless — they set nothing on your device. Marketing cookies from our email provider (Klaviyo) are set only after you opt in. The plugin and the API use no cookies at all. You can change your mind at any time through "Cookie settings" in the website footer.
1. Scope
1.1 This policy applies to the website at https://tonamorph.com and its subdomains, operated by Tonamorph Audio, .
1.2 The Tonamorph plugin does not use cookies. It keeps your session tokens and cached results in a settings folder on your computer, as described in the EULA (/legal/eula). The API uses no cookies; it is authenticated with a bearer token or an API key.
1.3 How we use personal data collected through cookies is described in the Privacy Policy (/legal/privacy).
2. What cookies are
Cookies are small text files a website stores in your browser. "First-party" cookies are set by our domain; "third-party" cookies are set by another company's domain through code on our pages. Similar technologies (local storage, session storage) store data in the browser without being sent automatically to a server; we mention them where we use them.
3. Categories we use
3.1 Strictly necessary
Required for the website to work and to honour your choices. They are set without consent because the site cannot function without them (ePrivacy Directive Art. 5(3) exemption).
- Authentication session. When you sign in, our authentication provider's library (
@supabase/ssr) stores your session in first-party cookies namedsb-<project-ref>-auth-token. Because a session can exceed the size of a single cookie, it is split into numbered chunks:sb-<project-ref>-auth-token.0,sb-<project-ref>-auth-token.1, and so on.<project-ref>is the identifier of our authentication project. During a magic-link sign-in a short-lived cookiesb-<project-ref>-auth-token-code-verifierholds the PKCE code verifier and is removed when sign-in completes. - Cookie consent. A first-party cookie
cookie-consentrecords which categories you accepted or rejected so that we do not ask again and do not load anything you declined.
3.2 Functional
Remember choices that improve your experience but are not essential.
- Referral attribution. If you arrive through a referral link (
?ref=…) or a campaign link, a first-party cookierefstores the code so that the person who referred you gets credit when you sign up. Without it the referral is lost, so we treat it as functional; it contains no personal data.
We may also keep display preferences (for example a dark/light theme) in your browser's local storage. This data is never sent to our servers.
3.3 Analytics — cookieless
We use Vercel Web Analytics to count page views and referrers. It does not set cookies and does not store anything on your device. It derives a short-lived visitor hash from your request that is discarded within 24 hours and cannot be used to track you across sites. Because nothing is stored on your device, no consent banner choice is required for it; you can still object to this processing at support@tonamorph.com.
3.4 Marketing — only after you opt in
If you accept marketing cookies, or sign up to our newsletter, we load Klaviyo's onsite script, which sets a first-party cookie (__kla_id) to recognise your browser, connect your visits with your email subscription and measure whether our emails and sign-up forms work. If you do not opt in, the script is never loaded and no Klaviyo cookie is set.
We do not use advertising networks, social-media pixels or cross-site tracking cookies on the website.
4. Table of cookies
| Name | Set by | Category | Purpose | Duration |
|---|---|---|---|---|
sb-<project-ref>-auth-token (and .0, .1, … chunks) | Our authentication provider (Supabase), first-party | Strictly necessary | Keeps you signed in; carries your session tokens | Session, refreshed while you use the site; expires with the refresh token (default 1 year of inactivity) |
sb-<project-ref>-auth-token-code-verifier | Our authentication provider (Supabase), first-party | Strictly necessary | Completes a magic-link sign-in securely (PKCE) | Removed when sign-in completes; at most a few minutes |
cookie-consent | Us, first-party | Strictly necessary | Stores your consent choices | 12 months |
ref | Us, first-party | Functional | Referral attribution for the account you create | 30 days |
| (none) | Vercel Web Analytics | Analytics | Cookieless page-view counting | No cookie; visitor hash discarded within 24 hours |
__kla_id | Klaviyo, first-party (set by its script) | Marketing | Recognises your browser for email marketing and form tracking | Up to 2 years |
5. Consent and how to withdraw it
5.1 On your first visit from a country where consent is required (the EU/EEA, the UK, Switzerland and others), the site shows a banner. Nothing other than strictly necessary cookies is loaded until you make a choice. "Reject all" is as easy as "Accept all", and you can accept or reject each category separately.
5.2 You can change or withdraw your choice at any time by clicking "Cookie settings" in the website footer. Withdrawing consent stops future setting of that category; already-set cookies are deleted when possible, and otherwise expire.
5.3 If your browser sends a Global Privacy Control signal, we treat it as a rejection of marketing cookies.
5.4 You can also delete or block cookies in your browser settings. Blocking strictly necessary cookies will prevent you from signing in to the website.
6. Changes
We will update this policy when we add or remove cookies. The effective date at the top tells you when it last changed. Material changes are announced on the website before they take effect.
7. Contact
Questions about cookies: support@tonamorph.com · Tonamorph Audio, · https://tonamorph.com