One cookie, and a few remembered preferences

notch_session

A signed token that says which account this browser is signed in to. It is httpOnly, so no JavaScript on the page can read it - including any script that ever managed to get onto it - and SameSite=Lax, so it is not sent along with requests started by other sites. It lasts 30 days, and over HTTPS it is marked Secure.

It is strictly necessary in the real sense of the phrase: without it there is no way to know whose ratings to show you, so signing in is impossible. It carries no advertising identifier and is not shared with anyone.

It is not a music service token and it does not contain one. Any music service access and refresh tokens stay on the server, encrypted, and are never written to a cookie or to any browser storage. No page in this app has ever held one.

These are not cookies - they are never sent with a request - but they are stored on your device, so they belong on this page:

notch.panelAlpha

How transparent you set the glass panels.

notch.visualizer

Whether the ambient background visualiser is on.

notch.hotkeys

Whether single-key shortcuts are enabled.

notch.now.tab

Which tab you last had open on Now Playing, so it is still there when you come back.

notch.now.last-track

The last song Now Playing showed you, so the screen has something on it while it waits for the service to answer rather than flashing empty. It is the same metadata already on the screen - title, artists, album and the artwork link - and no audio. The service’s answer replaces it the moment it arrives.

notch.rate.*

How you left the rating screen set up: the order, the album or playlist you were working through, and whether it plays the next song automatically. Keyed by your account id, so two people sharing a browser do not inherit each other’s view.

notch.trail

The breadcrumb trail of how you got to the page you are on. Stored for the tab only - closing it forgets.

notch.logSession

A random id for this browser tab, sent to notch.fm’s own API on each request so that “it broke, I refreshed, it broke again” can be found in the server log as one story. It is stored for the tab only, so it is gone when you close it, and it is deliberately not in longer-term storage: an id that survived for months would be a durable way to recognise you, which is more than a bug report ever needed. It goes nowhere but this app’s own server.

This instance runs Google Analytics. It records which pages are visited and a small set of named product events, so we can see which features are used. It is configured with IP anonymisation on and page views sent manually rather than automatically.

No event carries anything that identifies you. Not your email, not your id at a music service, not your display name, and never a song you rated. The question it answers is how many people reached a screen, never which person did.

If your browser sends a Do Not Track signal, nothing is sent at all. That is checked before every event, not just at load.

There is no advertising cookie, no cross-site identifier and no fingerprinting attempt on any of these pages, in either configuration.

You do not have to connect one, and if you never do, this whole section is about something that did not happen to you.

notch.fm is an independent app and is not affiliated with or endorsed by Apple or Spotify. Connecting an account sends you to that service’s own authorisation screen on its own domain, which sets its own cookies as part of signing you in. That is between you and them: for Spotify, their cookie policy covers it; for Apple, theirs does. notch.fm can neither read those cookies nor set any of its own on their domains.

Album art on these pages loads from the service’s image servers, because that is where the artwork lives and copying it here is not something this app does. Links that offer to open something in Apple Music or Spotify take you there when you click them. Beyond those two, nothing on a notch.fm page is fetched from either service by your browser, and neither runs a script on it.

You can disconnect at any time: Spotify at spotify.com/account/apps, Apple Music in your Apple Account settings. The privacy page says exactly what stops when you do.

Log out

Clears the session cookie in this browser.

Sign out everywhere

Settings → Security. Invalidates every session token already issued for your account, not just this browser’s - the right move if you signed in on a device you no longer have.

Clear site data

Your browser’s own setting. Removes the cookie and everything listed above. Nothing you rated is stored in the browser, so nothing you rated is lost.