This Cookie Notice explains how PianoLabs uses cookies and similar technologies (collectively, "cookies") to recognise you when you visit our website, what they do, and how you can control them. It supplements our Privacy Policy.

1. What cookies are

Cookies are small text files placed on your device by a website you visit. "Similar technologies" include local storage, session storage, and pixels — these do not always involve a literal cookie file but serve comparable purposes. Throughout this notice we use "cookies" to cover all of these.

Cookies set by PianoLabs directly are "first-party". Cookies set by services we rely on are "third-party". A "session" cookie expires when you close your browser; a "persistent" cookie stays on your device until it expires or you delete it.

2. Categories and the specific cookies we use

Strictly necessary — essential for the Service to work; cannot be disabled.

sb-access-token / sb-refresh-token (Supabase) — first-party authentication tokens that keep you signed in. Session and persistent (up to 7 days for the refresh token). Without these you cannot log in.
pianolabs-csrf — first-party, CSRF protection on form submissions. Session.
Security cookies set by our hosting provider to detect and prevent fraudulent activity. Session to 24 hours.

Functional — remembers preferences so you don't have to re-enter them.

theme — light/dark mode preference. Persistent, 365 days. Local storage.
exercise-mode, bpm, metronome-state — last-used exercise settings. Persistent, 365 days. Local storage.
cookie-consent — records your cookie preferences from the banner. Persistent, 365 days.

These are set only after you choose preferences. You can clear local storage in your browser settings.

Analytics — only with your consent.

[INSERT ANALYTICS COOKIE NAMES, e.g. ph_session, ph_user_id (PostHog)] — anonymous, aggregated product analytics. Persistent, [INSERT PERIOD]. Used to understand which features are popular and where users encounter friction. We do not use these for cross-site tracking or advertising.

We do not use third-party advertising cookies and we do not allow cross-site behavioural-advertising trackers on PianoLabs.

3. Your choices

When you first visit PianoLabs you will see a cookie banner. You can accept all cookies, reject all non-essential cookies, or open Settings to choose by category.

Strictly necessary cookies are always on, because without them the Service does not work; this is permitted under POPIA, the EU ePrivacy Directive, and the UK PECR for "strictly necessary" cookies.

You can change your choices at any time via Profile → Settings → Cookies, or by clearing the cookie-consent cookie and reloading the page.

You can also block or delete cookies through your browser settings. Note that doing so may break authentication and preference features.

4. Do Not Track and Global Privacy Control

Our analytics cookies respect the Global Privacy Control (GPC) signal. If your browser sends GPC, we will not load analytics cookies even if you have not interacted with the banner. We do not currently respond to the older Do Not Track header, which is no longer maintained by major browser vendors.

5. Updates

We may update this Cookie Notice if we change cookies. The "Last updated" date reflects the most recent version. For information about how we handle personal data, see our Privacy Policy.

6. Contact

Questions about cookies? Email support@pianolabs.io with the subject line "Cookies".