Cookie Policy

This Cookie Policy is provided by MMC Media LLC, doing business as Psalmix ("we," "us," or "our").

Effective Date: April 1, 2026

1. Introduction

This Cookie Policy explains how Psalmix ("we," "our," or "us") uses cookies and similar tracking technologies on our website (psalmix.com), our blog (blog.psalmix.com), and our mobile application. This policy should be read together with our Privacy Policy and Terms of Service.

Essential cookies are always active because the service cannot function without them. Non-essential cookies (analytics and advertising) require your consent through our cookie consent banner. Advertising cookies are off until you opt in, except on psalmix.com for visitors in some U.S. states, where they start on with a notice that names Meta and a one-tap way to turn them off (section 3.4 lists the states). Analytics cookies are off until you opt in outside the United States, in Colorado and Connecticut, and wherever we can't tell where you are; visiting from most of the United States, they default to on and you can opt out instead. Section 3 explains exactly which regions get which default. Wherever this policy says you “opted in” to analytics, that also covers visitors from most of the United States whose analytics cookies are on by default and who haven't turned them off — except for session recording and heatmaps, which start only once you actually say yes. You can change your choice at any time through the Cookie Preferences option or in Settings → Privacy.

2. What Are Cookies?

Cookies are small text files that are stored on your device (computer, smartphone, or tablet) when you visit a website or use an application. They help websites and apps recognize your device and remember information about your visit or preferences.

Cookies can be "session cookies" (which expire when you close your browser or app) or "persistent cookies" (which remain on your device for a set period or until you delete them).

3. Types of Cookies We Use

We use different types of cookies to provide and improve our service:

3.1 Essential Cookies (Strictly Necessary)

These cookies are necessary for our service to function and cannot be disabled in our systems. They are usually set in response to actions you take, such as logging in, setting preferences, or filling in forms.

• Authentication: Keeps you logged in as you navigate between pages
• Security: Protects your account from unauthorized access and helps prevent fraud
• Session Management: Maintains your active session while using Psalmix
• Load Balancing: Distributes traffic efficiently across our servers
• Privacy choices: psx_ads_geo (up to 6 hours) records whether advertising starts on or off for your visit (see 3.4); psx_kid_device (1 year) records that this browser has opened one of our kids' learning pages, so Meta stays off in it; psx_ads_declined (1 year) records that you turned advertising off in this browser, so the default described in 3.4 can't switch it back on, even if your browser clears this site's other stored data. None of them identifies you or is sent to anyone else

3.2 Functional Cookies

These cookies enable enhanced functionality and personalization. They may be set by us or by third-party providers whose services we use. If you do not allow these cookies, some features may not function properly.

• User Preferences: Remembers your theme settings, maturity level preferences, and content filters
• Language Settings: Stores your preferred language
• Playback Settings: Saves your audio quality preferences and playback settings
• Parental Controls: Maintains your family account settings and content restrictions

3.3 Analytics Cookies (Performance)

These cookies help us understand how visitors interact with our service by collecting and reporting information anonymously. This helps us improve our service and user experience.

Whether analytics cookies start on or off depends on where you're visiting from. In the EU, the UK, and anywhere we can't determine your location, they are off until you choose "Accept all" or "Customize" in our cookie banner. Visiting from most of the United States, they are on by default under an opt-out model U.S. privacy law permits — you can turn them off at any time, just as easily as you could have declined them. That default covers counting page views and a short list of named steps; session recording and heatmaps still wait until you actually say yes. Colorado and Connecticut keep the EU/UK off-by-default treatment, even though analytics itself is not the kind of "sharing" those states' laws specifically target. This is a separate choice from advertising cookies, which are off until you opt in everywhere (see 3.4): turning one on or off never changes the other.

• Usage Analytics: Tracks which features are most used and how users navigate the app
• Performance Monitoring: Measures page load times and app performance
• Error Tracking: Helps us identify and fix technical issues
• A/B Testing: Allows us to test improvements to the user experience
• Session Recording: Only once you have actually said yes to analytics cookies (the U.S. default alone never starts it), and only on our public marketing and signup pages, a replay of how the page was used — mouse movement, clicks, and scrolling — so we can find where people get stuck. All text is masked in your browser before the recording is sent, so we receive a wireframe rather than readable words, and recording never runs on the pages where you listen, browse your library, or manage your account, or on our kids' learning pages (such as the times tables songs page), even after you say yes. See Section 4.4
• Heatmaps: Under the same yes, and on those same public pages only, where on a page people click and how far down they scroll, added up across visitors. A click is stored as a position on the page, never as what you clicked on, so no words are collected. Like recording, it never runs on the pages where you listen, browse your library, or manage your account, or on our kids' learning pages. See Section 4.4

3.4 Advertising Cookies

Advertising cookies are off until you opt in — except on psalmix.com in some U.S. states. Nothing advertising-related runs until you choose "Accept all" or "Allow" in our cookie banner, or turn advertising on in Cookie Settings or Privacy Settings, with one exception: since October 7, 2026, if the location our network provider reports for your visit is a U.S. state other than California, Colorado, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Oregon, Pennsylvania or Washington, advertising starts on at psalmix.com. The cookie banner then tells you so, names Meta, says it measures Psalmix’s ads, and offers "Turn off Meta", which turns it off with one tap and keeps it off in that browser for at least a year, unless both that browser's cookies and its other stored data for psalmix.com are cleared. If you haven't answered about analytics cookies yet, the banner offers "Essential only" instead, which turns off both. In those 14 states, outside the United States, and whenever the reported location doesn't include a U.S. state, it starts off. It also starts off if your browser sends a Global Privacy Control signal, if you have already said no, or if the browser has opened one of our kids' learning pages in the past year. The default is never saved as a yes; we decide it again each browser session. (From August 26 to October 6, 2026, a different default applied to most of the United States; if yours were on only because of it, we no longer treat that as a yes.) When advertising is on, we load the Meta (Facebook) advertising pixel on our public marketing pages — but never on our kids' learning pages, such as the times tables songs page, and never in a browser that has opened one of them in the past year, even after you opt in. Its job is measurement: telling us which ads actually brought people to Psalmix, so we can stop paying for the ones that don't work.

What it can see: that a visit or a signup happened, your IP address, your browser, and which marketing page you were on.

We also report some conversions from our own servers. If advertising is on for you (you opted in, or it started on by default as described above) and you reached us by clicking one of our ads, we store that ad's click identifier on your account — unless you created the account on one of our kids' learning pages or in a browser that has opened one of them in the past year, in which case we store nothing and report nothing about it to Meta, then or later. When you then create an account (including with Google or Apple), begin a checkout, start a trial, or pay for a subscription, our server tells Meta that the conversion happened — sending that click identifier, a scrambled (one-way hashed) version of your email address, and, for payments, the amount paid. Your email address is never sent in readable form, and nothing here is sent from your browser or requires a cookie on the page where you converted.

We do this because the events that matter do not happen in a web page: a payment is confirmed by our payment provider afterwards, and a signup with Google or Apple finishes on a part of our site the pixel is never loaded on. Without server-side reporting we cannot tell which ads bring people who actually subscribe — only which ads bring clicks. The same choice governs both. If advertising was never on for you — by your opt-in or by the psalmix.com default described above — no conversion is reported from our servers either, and the old August–October 2026 U.S. default does not count. If you turn advertising off later, the click identifier stored in your browser on psalmix.com is deleted immediately, and our servers stop reporting for your account as soon as the withdrawal is connected to it — which is immediate when you make the change while signed in. If you withdraw while signed out, sign in and confirm the setting so we can attach the choice to your account.

What it can never see — and these are hard limits, not intentions:

• Your listening history, playlists, or any song or artist data. We do not send music information to advertising networks, whether or not you opted in — not from the pixel, and not from our servers either. A conversion report says that a signup, a checkout, a trial or a payment happened. It carries no song, artist, playlist, station or genre, and there is no field in it that could.
• Anything you do in the app. The pixel loads only on our public marketing pages — the ones anyone can read without an account, like this one, but never our kids' learning pages — and on certain posts on our blog (blog.psalmix.com) about the app and clean music, where it sends page views only; it never runs on blog posts about faith or worship or on kids' learning posts. It is never loaded on the pages where you listen, browse your library, or manage your account. Server-side reporting does not change that: it reports the fact of a subscription or trial, never any activity inside the product.
• Automatically-collected form and button activity. Meta's Automatic Configuration, which would otherwise gather interactions with page elements on its own, is explicitly turned off.

Accepting analytics cookies does not accept advertising cookies. When you first arrive, choose "Customize" in the banner to allow measurement of the product without advertising, or "Essential only" to decline both; where analytics is already on but advertising starts off, the banner asks only about advertising and session recording, and "No thanks" keeps both off. Afterwards you can change your mind at any time — in Privacy Settings, or via "Cookie Settings" in the footer of our public pages — and a Global Privacy Control signal from your browser turns advertising cookies off without you having to do anything. Where advertising started on by default, "Turn off Meta" in the banner turns it off with one tap. On blog.psalmix.com, use "Cookie Settings" in the blog footer; choices there are stored separately from psalmix.com.

We do not build advertising profiles of our users, and we do not sell your personal information. Note that California law treats the use of an advertising pixel as "sharing" personal information for cross-context behavioral advertising even where no money changes hands — see our Privacy Policy for your rights and how to opt out.

4. Third-Party Cookies

We work with trusted third-party service providers who may also set cookies on our behalf:

4.1 Authentication & Database (Supabase)

• Purpose: Secure authentication and session management
• Type: Essential cookies
• Data Processing: Secure, encrypted storage

4.2 Payment Processing (Creem)

• Purpose: Secure subscription checkout and fraud prevention
• Type: Essential cookies (set during checkout; cannot be disabled)
• Details: Creem processes our web subscription payments and may use cookies and browser storage for payment security and fraud prevention. See creem.io/privacy

4.3 Hosting & Performance (Vercel)

• Purpose: Website hosting, performance optimization, and analytics
• Type: Essential and performance cookies
• Data Processing: Anonymized traffic and performance metrics

4.4 Analytics Tools

Loaded whenever analytics cookies are on — a separate choice from advertising. In the EU, UK, Colorado, and Connecticut, that means you opted in; visiting from most of the U.S., it means you haven't opted out. See "3.3 Analytics Cookies (Performance)" above for exactly which. Session recording and heatmaps are narrower: they start only once you have actually said yes, wherever you are, and never on our kids' learning pages. Whenever a Global Privacy Control signal is detected and you have not separately, explicitly opted in, no analytics scripts run regardless of region.

• PostHog (product analytics and session replay): Records how our public marketing and signup pages are used and lets us replay it, so we can see where people get stuck before they ever create an account — and counts a short list of named steps, both on the signup form itself and inside the app once you are signed in, so we can see the same thing after signup.
  • Scope of session replay: Public marketing and signup pages only, and only once you have actually said yes to analytics cookies (the U.S. default alone never starts it) — never on the pages where you listen, browse your library, or manage your account, and never on our kids' learning pages, such as the times tables songs page, even after you say yes
  • Scope of named events: Anywhere in the app while you are signed in, and on our public marketing and signup pages before you have an account. A shared song link opened without an account is neither — nothing is counted there. The list is short and fixed: completing signup, being shown a price, starting checkout, your browser seeing the subscription confirmed when you return from the payment provider, starting playback for the first time (counted once for each identity in a visit — so signing in, or out, and playing again counts again, because those stretches are deliberately not joined), the steps of the signup form itself — opening it, moving between fields, a validation message, choosing Google or Apple, submitting — and the steps of our free times-tables page: viewing it, pressing play, opening its free-account form, being sent a code, finishing signup, a first song finishing, previewing a spelling song, and tapping its trial, share, app-store, sampler, printable-chart, certificate or video-consent buttons. Where a step fails we record a fixed category such as "already registered", never the error text and never the address you typed
  • One extra cookie, named: if you sign up with Google or Apple, our server sets a short-lived first-party cookie called psx_signup_completed on the redirect back. It holds one word — which provider you used — expires after five minutes, and exists only so the browser can count the signup, because the account is created on our server where the analytics code does not run. It contains no identifier. If you have not opted in to analytics it is read and discarded without sending anything
  • The two are not joined: when you sign in we start a fresh, unlinked identity, so what you did before you had an account — including the masked recording of you filling in the signup form — is not attached to your account and cannot be retrieved from it
  • What a recording contains: mouse movement, clicks, scrolling, page changes, your browser and screen size, and the pages you viewed
  • What it can never contain: readable text of any kind. Every piece of text is masked in your own browser before the recording is sent — not only what you type into a form, but any text the page shows back to you, such as an email address on a confirmation screen. What we receive is a moving wireframe with blocks where the words were. Recordings also carry no listening history, playlists, or song data, because recording never runs where that exists
  • What a named event can never contain: anything identifying what you listened to. No song, playlist, artist, or station is attached to any event — "playback started" records that you pressed play, never what you pressed play on — and the address of any page inside the app is replaced with a placeholder before it is sent. Our catalogue includes worship and gospel music, so a listening history could suggest something about your religious beliefs; we do not collect it
  • Role: PostHog is our data processor under a Data Processing Agreement. It processes this only on our instructions and does not use it for its own purposes or for advertising — unlike an advertising network, it is not a separate controller of your data
  • Storage and retention: Stored in the United States; recordings are deleted after 30 days. Named events are kept for no longer than 12 months, and the ones tied to your account are erased when you delete your account
  • Cookies and browser storage: first-party only — a cookie and an entry in your browser's local storage, holding a random ID so page views in one visit can be joined into one recording. No third-party cookies, no advertising cookies, and no tracking across other websites. Withdraw consent in Settings → Privacy or via "Cookie Settings" in our footer. See posthog.com/privacy
• Google Tag Manager (GTM): We use GTM with Google Consent Mode to manage our analytics scripts. GTM itself does not collect data; it loads the analytics tools listed above only after consent. See policies.google.com/privacy
• Google Analytics 4 (our blog): On blog.psalmix.com, Google Analytics 4 tells us which pages are viewed, the type of device used, and your approximate location, derived from your IP address. The Google tag runs on every blog page in Google Consent Mode with its advertising features switched off: it sets its cookies only once analytics is on for you (by your choice, or by the regional default in 3.3), so nothing is stored on your device before you consent wherever consent is required, and it is never used for advertising. Its cookies are listed in 4.6 below. See policies.google.com/privacy

4.5 Advertising (Meta / Facebook)

Loaded only when advertising is on — a separate choice from analytics. It is off until you opt in, except on psalmix.com in the U.S. states where it starts on with a notice. See "3.4 Advertising Cookies" above.

• Purpose: Measuring whether our ads brought people to Psalmix
• Type: Advertising cookies (never essential; always optional)
• Scope: Public marketing pages and certain posts on our blog (blog.psalmix.com) only — never on the pages where you listen, browse your library, or manage your account, and never on our kids' learning pages, such as the times tables songs page. On the blog the pixel sends page views only, and only on certain posts about the app and clean music: it never runs on blog posts about faith or worship or on kids' learning posts, or on the blog's home page, archives, search results or error pages, so Meta does not learn a religious interest from what you read there. Conversions (signups, checkout starts, trials and payments) are additionally reported from our servers, which is described below
• Data Processing: IP address, browser information, which marketing or blog page you viewed, and a few actions on it (such as playing a preview, tapping an invoice button, or signing up). Never listening history, playlists, or song data. Meta's Automatic Configuration is turned off, so it does not gather page interactions on its own. See facebook.com/privacy/policy
• Server-side reporting (Conversions API): For users with advertising on (opted in, or on by default as 3.4 describes) who arrived from one of our ads — never for an account created on one of our kids' learning pages or in a browser that has opened one in the past year — we report account signups (including Google/Apple), checkout starts, trial starts and payments directly from our servers, sending the ad click identifier, a one-way hashed email address, and, for payments, the amount paid. No IP address or device information is sent with these. This runs only while advertising is on and stops when you turn it off (immediately, when the withdrawal is made while signed in)

4.6 Cookies and Browser Storage on Our Blog (blog.psalmix.com)

Our blog has its own cookie banner, which follows the same analytics rules as psalmix.com described in 3.3: analytics uses the same regional default. Advertising on the blog stays off until you accept it, wherever you are — the U.S. state default described in 3.4 applies only on psalmix.com. To apply the regional default, the blog asks psalmix.com which region you are visiting from, and your choices on the blog are recorded in the same consent record as psalmix.com's (they still apply only to the blog). The Google cookies are set only when analytics is on. The Meta cookies are set only after you accept advertising, and only on the posts described in 4.5. Withdrawing consent stops these cookies being used or refreshed, but does not delete the ones already on your device — to remove them, clear cookies for blog.psalmix.com in your browser. The table lists the blog's cookies and the entries it keeps in your browser's local or session storage.

We carefully vet all third-party providers to ensure they meet our privacy and security standards. For more details on how these providers use cookies, please refer to their respective privacy policies.

5. How to Manage Cookies

You have several options to manage or disable cookies:

5.1 Browser Settings

Most web browsers allow you to control cookies through their settings. You can:

• Block all cookies
• Block third-party cookies only
• Delete cookies when you close your browser
• Accept cookies from specific websites only

5.2 Mobile App

The Psalmix mobile app does not use cookies or third-party analytics or advertising trackers. You can manage app permissions and data storage through your device settings.

5.3 Consent Withdrawal

To withdraw consent for non-essential cookies (analytics and advertising) at any time: (1) use "Cookie Settings" in the footer — on psalmix.com, or on blog.psalmix.com for the blog, where choices are stored separately from psalmix.com — or open Settings → Privacy in your account and turn off analytics or advertising, (2) clear cookies in your browser settings, or (3) email [email protected] with subject 'Cookie Opt-Out'. The "Do Not Sell or Share" link in the footer, on psalmix.com and on our blog, opens the same Cookie Settings. Withdrawing stops non-essential cookies being used or refreshed from then on; it does not delete the ones already on your device, except that psalmix.com deletes the ad click identifier straight away (see 3.4). To remove the rest, clear cookies in your browser settings. Withdrawing consent will not affect your ability to use Psalmix but may affect personalization features.

Important Note: Blocking or deleting essential cookies may affect your ability to use Psalmix. You may not be able to log in, save preferences, or access certain features if essential cookies are disabled.

6. Psalmix Age Requirements & Privacy

Psalmix is intended for users 13 years of age and older. We do not knowingly collect information from users under 13. For more information about our age requirements and privacy protections, see our Privacy Policy.

7. Do Not Track & Privacy Signals

Some browsers include a Do Not Track (DNT) feature. Currently, our website does not respond to browser DNT signals.

Global Privacy Control (GPC): We honor GPC browser signals for all users, not just California residents. Analytics cookies are disabled when a GPC signal is present unless you have explicitly opted in through our cookie banner. Advertising cookies are disabled whenever a GPC signal is present, with no exception — a prior opt-in does not override it, because under CPRA the signal is itself a valid opt-out of sharing.

8. Updates to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in our practices or for legal, regulatory, or operational reasons. We will notify you of any material changes by:

• Posting the updated policy with a new "Last Updated" date
• Sending an email notification (for significant changes)
• Displaying a prominent notice on our website or in the app

We encourage you to review this Cookie Policy periodically to stay informed about how we use cookies.

9. Contact Us

If you have questions about this Cookie Policy or how we use cookies: