Cookie Policy
Last updated: October 27, 2026
1. Cookies and browser storage
BeatLark uses cookies and browser storage for sign-in security, returning you after login, temporarily saving a song form, and reopening your last creation. Cookies are sent to the website with relevant requests. localStorage and sessionStorage stay in the browser unless a feature reads and submits their contents.
Our traffic statistics use daily counters rather than analytics cookies or visitor identifiers. They are separate from the storage needed to sign in or create music. We do not use third-party advertising pixels in the current website.
2. Storage used by the website
Some items appear only when you use the relevant feature or sign-in method. A long session token may be split across numbered cookies with the same base name.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| musicagent.session-token | Cookie | Keeps you signed in through the session-based sign-in flow. | Up to 7 days; may be renewed while you use the service. |
| musicagent.auth-token | Cookie | Keeps you signed in after email and password login. | Up to 7 days. |
| musicagent.csrf-token / musicagent.callback-url | Cookies | Protects sign-in requests and returns you to the sign-in destination. | Browser session or until cleared by the sign-in flow. |
| musicagent.pkce-code-verifier / musicagent.state / musicagent.nonce | Cookies | Verifies an OAuth sign-in attempt and helps prevent replay or request tampering. | Short-lived sign-in values; PKCE and state expire after 15 minutes. |
| musicagent:login-return-url | sessionStorage | Remembers where to return after sign-in. | Tab session, subject to browser session-restoration settings. |
| beatlark:pending-song:<locale> | sessionStorage | Temporarily saves your description, lyrics, and settings when generation requires sign-in. | Tab session; removed after an accepted submission or when you start a new song. |
| musicagent:conversation:<account ID> | localStorage | Remembers the identifier of your last opened creation. The song itself is stored on the server. | Until cleared or replaced with a different creation identifier. |
3. Aggregate traffic statistics
For the homepage and public policy pages, we count page views by date, page, and a broad traffic channel such as direct, Google, or Reddit. Dates use UTC. Unknown sources are grouped as other. The browser sends only the public-page category and channel; the statistics request omits cookies and the referring URL. Raw campaign parameters and private page paths are not sent.
The collector does not create a visitor ID, write an analytics cookie, or link views to accounts, songs, or payments. It adds to a shared daily counter instead of storing an individual visit record. These are page-view counts, not unique-visitor or sales-attribution reports. Statistics collection is skipped when the browser signals Do Not Track or Global Privacy Control.
An earlier version used a cookie named musicagent_aid for account and payment attribution. The current website expires that cookie without reading its value and no longer uses it for attribution. Older server-side records may still exist; you can request deletion as described in our Privacy Policy.
4. Managing storage
You can use your browser settings to inspect, block, or remove cookies and website storage. Removing sign-in cookies will sign you out. Removing the saved-creation identifier stops automatic restoration, and removing the temporary song form can lose unsent descriptions or lyrics. Browser session restoration can preserve tab storage after a browser restart.
Clearing browser storage does not delete your account, saved songs, or payment records from the service database. For a deletion request, email [email protected].
5. Other services and contact
Google sign-in and Stripe checkout may use their own cookies when you visit those services. Their privacy and cookie notices apply there. The table above lists storage set by BeatLark's application.
Questions can be sent to [email protected]. See our Privacy Policy for information about server-side records and your privacy rights.