Cookie Policy

Cookies are small text files placed on your device when you visit a website. We also use similar technologies such as local storage (data your browser keeps for the site). We refer to all of these as “cookies” in this Policy. Cookies may be “session” (deleted when you close your browser) or “persistent” (kept until they expire or you delete them).

We use cookies and similar technologies for the following purposes:

• Strictly necessary — to keep you signed in (a secure, httpOnly session cookie), to protect against cross-site request forgery, and to maintain the security and integrity of the Service. The Service will not work properly without these.
• Preferences — to remember choices such as your theme, display, and feed settings, and to store interface state (for example, your place in a long audio track or an unsaved draft) so the Service behaves the way you expect.
• Performance and analytics — to understand, in aggregate, how the Service is used so we can improve it. We rely on privacy-preserving, aggregate measurement and do not build cross-site advertising profiles.
• Security challenges — when bot-protection is enabled, our provider (Cloudflare Turnstile) may set a cookie to distinguish humans from automated abuse.

We do not use third-party advertising networks. A small number of cookies may be set by providers that help us operate the Service (for example, our bot-protection provider, or an embedded media player you choose to play). Those providers process data under their own policies. We do not permit them to use your data to build cross-site advertising profiles through the Service.

If you choose to connect a third-party music service, that provider may store cookies or similar local data on your device to operate its connection. For example, connecting Apple Music loads Apple’s MusicKit, which may store data in your browser to manage your authorization. This information is controlled by that provider under its own policies and is used only to enable the feature you requested.

You can control cookies through your browser settings — most browsers let you block or delete cookies and clear local storage. Disabling strictly necessary cookies will prevent you from staying signed in and may break core features. Where required, we honor recognized opt-out preference signals such as Global Privacy Control. For embedded third-party media, no third-party player loads until you choose to play it.

One warning specific to this Service. The private half of your direct-message encryption key is kept in your browser’s local storage and nowhere else, unless you have stored an encrypted backup of it. Clearing site data for Andromeda deletes that key, and messages encrypted to it cannot be recovered afterwards — not by you, and not by us. If you are about to clear your browser data, or use a mode that clears it on exit, make a key backup first from Settings. Signing out does not delete the key; clearing site data does.

We may update this Policy from time to time; we will post the updated version with a new effective date. Questions may be sent to privacy@andromedasphere.com.