Cookie Policy

Effective date: October 4, 2026

In short: Necessary website technologies support sign-in, security and your privacy choices. Optional attribution and marketing tracking stay off until you choose them. Limited cookieless analytics may run before a choice for visitors in the United States, where the applicable rules permit it, and otherwise waits for your choice; you can turn it off at any time. Newsletter subscription is a separate choice from website tracking. You can reopen Cookie settings in the footer. This policy also explains relevant local storage; 'cookieless' does not mean 'no data processing'.

1. Scope

1.1 This policy covers the website at https://tonamorph.com, operated by Tonamorph — that is, the operator identified in section 1.1 of the Terms of Service (“we”, “us”). The Privacy Policy describes the use of associated personal information.

1.2 The plugin is not a browser. It stores local settings, tokens and downloaded results as explained in the EULA. The absence of browser cookies does not remove data-protection or device-storage obligations. Independently operated checkout and identity-provider pages have their own notices and necessary technologies.

2. Cookies and similar technologies

Cookies store information associated with a browser. Local or session storage can hold information without sending it automatically with every request. Scripts can process request or device information without setting a cookie. The purpose and operation, not just the technology's name, determine the relevant privacy requirements.

3. Categories and choices

3.1 Necessary

Sign-in, session security and recording a privacy preference can require storage necessary to provide a function you request. These functions are not used as a pretext for advertising. Blocking them may prevent sign-in or saving a preference.

3.2 Optional referral and campaign attribution

A referral code or campaign parameter can be saved to associate a later registration with a link. Under this configuration, persistent attribution waits for the functional/attribution choice. A code may identify a referrer or become linked to an account; it is not automatically anonymous merely because it contains no name.

You may still enter a referral code yourself where that feature is available. Reading current-page parameters, attributing a transaction and saving a 30-day browser history are different actions and require their own appropriate handling.

3.3 Limited website analytics

We use Vercel Web Analytics to measure visits to our website and improve its operation. This analytics configuration does not set analytics cookies or use an identifier to follow you across different websites. We configure page information and permitted events to avoid sending account identifiers, email addresses, audio, payment details or access tokens to analytics: page addresses are recorded without their query strings, and pages that exist only for a signed-in person are not counted. Limited technical request information is used to produce website statistics; the absence of analytics cookies does not mean that no information is processed.

For visitors identified as being in the United States, this limited analytics may operate before a banner choice where the applicable rules permit it. It remains off if you have already declined analytics. You can stop future analytics collection through Cookie settings in the website footer, and you can object to this processing at privacy@tonamorph.com.

For visitors in other locations, or where the applicable regime cannot be determined, our initial configuration waits for your analytics choice. If we later rely on a specific audience-measurement exception in another jurisdiction, we will first document that the configuration meets that exception and update this notice to describe the applicable operation and objection mechanism.

Declining does not prevent ordinary account use. Provider-side visitor processing is distinct from cookie expiry.

3.4 Optional marketing tracking

Where enabled, Klaviyo can recognise a browser and associate permitted activity with a marketing profile. It loads only after the website marketing-tracking choice. Subscribing to an email list does not, by itself, turn on this script, email-open tracking or unrelated profiling. Essential account emails remain separate. You may withdraw website-tracking consent in Cookie settings, without automatically changing your email subscription.

We do not introduce advertising-network or retargeting pixels under an existing generic 'functional' permission. Any such change requires the applicable disclosures and choices before activation.

4. Website inventory

This table lists the cookies and similar technologies our website uses. Optional entries operate only when that integration is active and you have given the relevant permission.

On the checkout page, Paddle's script runs the payment overlay and may set its own cookies, described in its notice; external sign-in pages (Google, Apple) have their own notices.

5. Other local storage

The attribution local-storage record contains a referral code, relevant utm_* parameters and capture time. Persistent storage is allowed only after the attribution choice. It is used for no longer than 30 days and cleared through the site's withdrawal mechanism or browser data controls. A website that is not opened cannot actively run a cleanup script, so removing browser data remains an additional option.

Where a sign-in or display feature keeps something in your browser's local storage, it is used only for that feature. Klaviyo's script, once you enable marketing tracking, may keep its own entries in local storage; they stop being used when you withdraw that choice and are removed with your browser data.

6. Making and withdrawing a choice

6.1 Our banner offers Accept all, Reject all and category controls without preselected optional categories. Rejecting does not prevent use of the core Service. Strictly necessary technologies operate without a cookie-consent choice where permitted by law. Optional technologies for which we require consent remain off until you enable the relevant category. The limited United States analytics described in section 3.3 may operate before that choice where permitted, but you can disable it through Cookie settings. Where analytics consent is required or our configuration waits for it, analytics does not start before you enable it.

The controls distinguish analytics, optional functional storage and website marketing tracking. Email-marketing subscription is managed separately. Reject all disables the optional categories offered by the controls, including future analytics collection, even where we could otherwise operate limited analytics without prior consent. It does not retrospectively prevent a permitted request sent before that choice. A stored refusal is not turned into acceptance merely because this policy or our software is updated. "Reject all" is as easy as "Accept all", and you can accept or reject each category separately.

6.2 Open Cookie settings in the footer to change a choice. Withdrawal stops future optional collection for that choice, not just new cookie writes. We remove controlled identifiers where possible and stop or reset already loaded optional integrations. Browser controls can remove residual provider storage. Server-side marketing preferences must also be enforced where they govern server-side events; a browser switch alone is not treated as controlling every server transmission.

6.3 We record the choice, time and relevant policy version. This is not consent to all future purposes. When consent is the legal basis, withdrawal does not affect prior lawful processing but stops processing dependent on that consent going forward, subject to narrow accountability or suppression records.

6.4 Global Privacy Control. We process a recognised Global Privacy Control signal as an opt-out of the sale or sharing of personal information and targeted advertising to the extent covered by applicable law. Our current model does not involve selling personal information or sharing it for cross-context behavioural advertising. We do not treat a general Accept all choice as permission to disregard a statutory opt-out: under the signal, website marketing tracking stays off unless you turn on that category yourself, and a signal that starts after you accepted all categories switches website marketing tracking off again.

GPC does not, by itself, unsubscribe you from our own emails to which you have separately subscribed, prevent necessary service messages, or disable website functions and analytics that fall outside the processing covered by the signal. Separate refusals or withdrawals you make in Cookie settings or through an email unsubscribe route continue to apply. Website tracking is not enabled merely because you subscribe to email marketing. Any change of an applicable opt-out must follow the required process.

6.5 You may also block or delete storage through browser settings. Necessary sign-in features can stop working when their required storage is blocked. Choices may need to be repeated in a different browser, after deleting site data or on a different device.

7. Changes

We update this policy and the controls when relevant technologies or purposes change. Material changes requiring a new choice are not authorised by passive continued use alone. The Privacy Policy explains notice of changes and associated rights.

8. Contact

Tonamorph · Cookie and tracking questions: privacy@tonamorph.com · https://tonamorph.com
Operator details: Terms of Service, section 1.1