Cookies and statistics
European and UK law applies to storing or reading anything on your device, not just to "cookies". RefBooth stores only what the service you asked for needs, one value you set by answering our statistics question, and nothing for advertising or profiling. Below is the complete list of what is stored, what our statistics script reads, and the switch that turns it off.
refbooth.com, this site
| Name | Where | What it is | Kept |
|---|---|---|---|
rb_consent | Cookie, for refbooth.com and its subdomains | Your answer about statistics: granted or denied, or noted if you closed the notice with OK (which is never taken as a yes where the law asks first), nothing else. Set only when you press one of the buttons on the question or the notice, or the switch below, so you are not asked again on every page; it covers this site and app.refbooth.com. This is the one value the consent rules themselves require us to keep. | 180 days, then you are asked again. |
rb_country | Cookie, this site only | The country you picked in the price list, as its two-letter code, so the same prices show on every page. Set only when you pick a country. The country we suggest from your connection is never stored. | Until you close your browser. |
app.refbooth.com, the web app
| Name | Where | What it is | Kept |
|---|---|---|---|
__Host-rb_session | Cookie | Your sign-in. It is HttpOnly, so no script on the page can read it from the cookie, including ours, and it is host-only, so it is never sent anywhere but this one address. The answer that signs you in also carries the same value once, for our iPhone and Android apps; the web app discards it without storing it. | 30 days, or until you sign out. |
__Host-rb_csrf | Cookie | A random value that proves a request came from a page you were actually looking at, rather than from another site acting in your name. | With the session. |
__Host-rb_anon | Cookie | Set only if you analyse a track before signing in, so that report is still yours when you come back. Signing in claims it and the cookie is deleted. Dropping a file into the box on the refbooth.com front page sets this same cookie for app.refbooth.com: that upload is the analysis, and the cookie is what lets you open its report. | 7 days. |
rb_consent | Cookie, shared with refbooth.com | Your answer about statistics, as above. | 180 days. |
rb_country | Cookie, this address only | The country you picked for prices under Plan & billing, as its two-letter code. Set only when you pick a country; the country we suggest from your connection is never stored. | Until you close your browser. |
refbooth.theme | localStorage | "light", written only if you switch the app to the light theme; switching back to dark removes it. The app opens dark until then. The defaults you choose under Settings › Profile are kept with your account, not on your device. | Until you switch back or clear your browser storage. |
Visit statistics: what is read, not stored
Not switched on yet. Until it is, no statistics script loads on either site, nothing is counted and no statistics question is asked. This section describes what happens once it is.
refbooth.com and app.refbooth.com can load a small statistics script from our own server (Umami, open source, run by us in the European Union). It sets no cookie and writes nothing to your browser's storage. When it runs it reads the address and title of the page, the site that linked you here, your browser's language and your screen size. Before anything leaves your browser, our page removes the title and the screen size and cuts the address and the linking site down, so what is sent to our server is the address of the page, the domain of the site that linked you here and your browser's language (and, in the app, the steps listed in the privacy policy). It does not send your screen size, your fonts or anything else about your device. What our server does with that is described under Visit statistics in the privacy policy.
Where you are decides the default. In the European Economic Area, the United Kingdom, Switzerland and the other places where the law asks for agreement first, and whenever we cannot tell where you are, the script loads only after you choose Accept. Elsewhere it loads, and a short notice says so with a Don’t count me button. A browser that sends Global Privacy Control or Do Not Track never loads it, wherever it is.
You can also change your answer from Privacy choices at the foot of every page.
What is not here, and will not arrive quietly
No Google Analytics. No advertising pixel. No third-party tag of any kind. Paying for a plan happens on Stripe's own checkout page, at checkout.stripe.com, which may store values of its own there for that payment under Stripe's policy; nothing of Stripe's is loaded on our pages. The fonts are served by refbooth.com itself, so opening a page hands your address to no font host. The only measurement is the self-hosted statistics described above. If that ever changes, this page changes before the new tag ships, not after.
The iPhone and Android apps
They store your sign-in session in the operating system's secure keychain, and the onboarding choices you made (genres and experience level) on the device. No analytics or advertising software is in either app. See the privacy policy.