Cookie Policy

Effective date: September 9, 2026

This page shows this edition as last amended on 3 October 2026; earlier wordings are kept and available on request.

In short: The Tonamorph website uses a handful of cookies. Strictly necessary ones keep you signed in and remember your cookie choices; they need no consent. Our web analytics (Vercel Web Analytics) are cookieless — they set nothing on your device; for visitors in the United States they may run before you choose, and you can turn them off at any time. Marketing cookies from our email provider (Klaviyo) are set only after you opt in to website marketing tracking; subscribing to our emails does not turn them on. The plugin and the API use no cookies at all. You can change your mind at any time through "Cookie settings" in the website footer.

1. Scope

1.1 This policy applies to the website at https://tonamorph.com and its subdomains, operated by Gregory Diachenko, 36 Brodetsky Street, Tel Aviv-Yafo 6905155, Israel.

1.2 The Tonamorph plugin does not use cookies. It keeps your session tokens and cached results in a settings folder on your computer, as described in the EULA (/legal/eula). The API uses no cookies; it is authenticated with a bearer token or an API key.

1.3 How we use personal data collected through cookies is described in the Privacy Policy (/legal/privacy).

2. What cookies are

Cookies are small text files a website stores in your browser. "First-party" cookies are set by our domain; "third-party" cookies are set by another company's domain through code on our pages. Similar technologies (local storage, session storage) store data in the browser without being sent automatically to a server; we mention them where we use them.

3. Categories we use

3.1 Strictly necessary

Required for the website to work and to honour your choices. They are set without consent because the site cannot function without them (ePrivacy Directive Art. 5(3) exemption).

• Authentication session. When you sign in, our authentication provider's library (@supabase/ssr) stores your session in first-party cookies named sb-<project-ref>-auth-token. Because a session can exceed the size of a single cookie, it is split into numbered chunks: sb-<project-ref>-auth-token.0, sb-<project-ref>-auth-token.1, and so on. <project-ref> is the identifier of our authentication project. During a magic-link sign-in a short-lived cookie sb-<project-ref>-auth-token-code-verifier holds the PKCE code verifier and is removed when sign-in completes.
• Cookie consent. A first-party cookie cookie-consent records which categories you accepted or rejected so that we do not ask again and do not load anything you declined.

3.2 Functional

Remember choices that improve your experience but are not essential.

• Referral attribution. If you arrive through a referral link (?ref=…) or a campaign link, a first-party cookie ref stores the code so that the person who referred you gets credit when you sign up. Without it the referral is lost, so we treat it as functional; it contains no personal data.

We may also keep display preferences (for example a dark/light theme) in your browser's local storage. This data is never sent to our servers.

3.3 Limited website analytics

We use Vercel Web Analytics to measure visits to our website and improve its operation. This analytics configuration does not set analytics cookies or use an identifier to follow you across different websites. We configure page information and permitted events to avoid sending account identifiers, email addresses, audio, payment details or access tokens to analytics: page addresses are recorded without their query strings, and pages that exist only for a signed-in person are not counted. Limited technical request information is used to produce website statistics; the absence of analytics cookies does not mean that no information is processed.

For visitors identified as being in the United States, this limited analytics may operate before a banner choice where the applicable rules permit it. It remains off if you have already declined analytics. You can stop future analytics collection through Cookie settings in the website footer, and you can object to this processing at privacy@tonamorph.com.

For visitors in other locations, or where the applicable regime cannot be determined, our initial configuration waits for your analytics choice. If we later rely on a specific audience-measurement exception in another jurisdiction, we will first document that the configuration meets that exception and update this notice to describe the applicable operation and objection mechanism.

3.4 Marketing — only after you opt in

If you enable website marketing tracking in the banner or in Cookie settings, we load Klaviyo's onsite script, which sets a first-party cookie (__kla_id) to recognise your browser, connect your visits with your email subscription and measure whether our emails and sign-up forms work. Subscribing to our newsletter or receiving a necessary service email does not by itself enable the script: website tracking is not a newsletter subscription. If you do not enable it, the script is never loaded and no Klaviyo cookie is set. You may withdraw website-tracking consent in Cookie settings without automatically changing your email subscription.

We do not use advertising networks, social-media pixels or cross-site tracking cookies on the website.

4. Table of cookies

5. Other storage on your device

Cookies are not the only way a website can keep something on your computer. Browsers also offer local storage, which is not sent with every request and is not cleared when you close the tab. Rules on consent apply to it in the same way, so it belongs on this page.

• It is written only after you have accepted functional cookies. Decline them and nothing is written; the sign-up page then reads those parameters from the address bar alone, which is enough when you sign up in the same visit.
• It holds no name, no email address and no audio.
• Clearing site data in your browser removes it, as does withdrawing functional consent in the banner (section 6).

We use no other local storage, no session storage and no IndexedDB, and we do not fingerprint your device.

The plugin is not a browser and has no cookies. It keeps your session tokens and cached results in a settings folder on your own computer; what is kept and how to remove it is in the End-User Licence Agreement.

6. Consent and how to withdraw it

6.1 Strictly necessary technologies operate without a cookie-consent choice where permitted by law. Optional technologies for which we require consent remain off until you enable the relevant category. The limited United States analytics described in section 3.3 may operate before that choice where permitted, but you can disable it through Cookie settings. Where analytics consent is required or our configuration waits for it, analytics does not start before you enable it.

The controls distinguish analytics, optional functional storage and website marketing tracking. Email-marketing subscription is managed separately. Reject all disables the optional categories offered by the controls, including future analytics collection, even where we could otherwise operate limited analytics without prior consent. It does not retrospectively prevent a permitted request sent before that choice. A stored refusal is not turned into acceptance merely because this policy or our software is updated. "Reject all" is as easy as "Accept all", and you can accept or reject each category separately.

6.2 You can change or withdraw your choice at any time by clicking "Cookie settings" in the website footer. Withdrawing consent stops future setting of that category; already-set cookies are deleted when possible, and otherwise expire.

6.3 Global Privacy Control. We process a recognised Global Privacy Control signal as an opt-out of the sale or sharing of personal information and targeted advertising to the extent covered by applicable law. Our current model does not involve selling personal information or sharing it for cross-context behavioural advertising. We do not treat a general Accept all choice as permission to disregard a statutory opt-out: under the signal, website marketing tracking stays off unless you turn on that category yourself, and a signal that starts after you accepted all categories switches website marketing tracking off again.

GPC does not, by itself, unsubscribe you from our own emails to which you have separately subscribed, prevent necessary service messages, or disable website functions and analytics that fall outside the processing covered by the signal. Separate refusals or withdrawals you make in Cookie settings or through an email unsubscribe route continue to apply. Website tracking is not enabled merely because you subscribe to email marketing.

6.4 You can also delete or block cookies in your browser settings. Blocking strictly necessary cookies will prevent you from signing in to the website.

7. Changes

We will update this policy when we add or remove cookies. The effective date at the top tells you when it last changed. Material changes are announced on the website before they take effect.

8. Contact

Questions about cookies: privacy@tonamorph.com · Gregory Diachenko, 36 Brodetsky Street, Tel Aviv-Yafo 6905155, Israel · https://tonamorph.com