Short version: two cookies keep the site working and neither tracks you, and a third remembers an EPK link somebody handed you. Visits are counted without a cookie, and two cookies remember which advert or which artist's page brought you here; the analytics switch on this page stops that counting and those two cookies. It also stops us counting your visits, your clicks on an artist's links, channels, release buttons, shop and contacts, what you take from its EPK, and the messages you send through its form, for that artist's stats. Music players from other companies and, on our own pages, the measurement of our adverts only load once you say yes.
What we set
| Cookie | What it does | How long it lasts |
|---|---|---|
tap-session |
Carries the form token, and keeps this browser signed in while you are active | Two hours after your last visit, or until you sign out |
remember_web_* |
Signs you back in once the session above has lapsed, without a fresh link | 400 days, or until you sign out |
XSRF-TOKEN |
Stops another site from submitting a form on your behalf | Two hours after your last visit, the same as the session |
artist_access |
Remembers the EPK keys you were given, so a link keeps opening the page | One year |
known_browser |
Holds a hashed list of up to five browsers you have signed in from, so we can mail you when a new one does | One year |
tz |
Remembers your browser's time zone on console pages, so dates there show in yours | Until you close your browser |
analytics-consent |
Remembers that you saw the cookie dialog, or that you turned analytics off. It never records consent: counting needs none | One year |
ads-consent |
Remembers whether you allowed the advertising pixel on our own pages | One year |
players-consent |
Remembers whether you allowed the Spotify, SoundCloud, Mixcloud and Apple Music players to load on artist pages | One year |
The first six are strictly necessary for a service you asked for, so under Dutch and European law we do not need your consent for them and you cannot be asked to accept them. Together, tap-session and remember_web_* keep you signed in; known_browser is what lets us warn you about a sign-in from somewhere new. All three are set on every page, an artist's public pages included; until you sign in the session holds nothing that identifies you. artist_access is set only when you open an EPK link somebody handed you, and it is what keeps that link working. tz reads your browser's time zone for the console and holds it only for that browser session. The last three can be set either way: analytics-consent records that you saw the notice or objected, ads-consent and players-consent record what you chose.
When you pre-save a release or follow an artist
Opening a pre-save or follow confirmation link prepares a temporary session; only pressing Confirm confirms that pre-save or follow. We set the fan cookie when you press Confirm, connect Apple Music as a new fan, or open a personal fan-access link we sent you. It lets the release page and the follow form recognise you on your next visit and your own page know whose it is. It holds an identifier and the time your access was established, and it is set for that site rather than shared across sites. It lasts ninety days.
Recognition lasts longer than permission to make changes: after thirty minutes, changing or deleting what we hold needs fresh proof through a personal link from us. Keep those links private: for thirty minutes after anyone opens an unused personal access link, they can change or delete what we hold, the same as you could. 'Not you?' removes the cookie.
Analytics, unless you turn it off
We count visits with one script from Visitors, on our own pages and on public artist pages. It runs unless you turn it off, except on protected pages such as personal access links, sign-in confirmations and app authorisation or credential screens. The cookie dialog on your first page says so, and Reject all, Cookie settings at the foot of every page or the switch at the top of this page turns it off at any time.
The script sets no cookie and stores nothing in your browser. To tell one visitor from another within a day, Visitors combines your IP address and browser description with a value that changes every day and keeps only the scrambled result, so a visit tomorrow cannot be tied to one today. It uses your IP address to find your city and country, then throws the address away. Visitors keeps the counts in the European Union and uses them for nothing but our statistics.
The script is never given your name or your email address, and it plays no part in verification, bookings or anything an artist can see. Turn analytics off and it does not load from the next page on.
The same switch covers the counts we keep for an artist's stats: views of its pages, clicks on its links, channels, release buttons and shop, what is taken from its EPK, clicks on its contacts and messages sent through its form, counted on our own servers without setting a cookie and without keeping your IP address. With analytics off, none of that is counted either. The visitor notice explains what the artist sees.
Advertising, only if you allow it
On our own pages, home and every page around it, and in the console you use as a holder, a banner asks whether we may measure the adverts we run through OpenAI. Say yes and OpenAI's measurement pixel loads; say no, or say nothing, and it never does. It never loads on an artist's own pages, because those readers are the artist's, not ours, and never on our own registrar pages, because nothing there is a conversion.
| Cookie | Who sets it | What it does | How long it lasts |
|---|---|---|---|
__oppref |
The measurement pixel | Holds the click id from the advert you pressed, so a later sign-up or claim can be counted to it | Set by OpenAI |
TAP does not include your name or email address in the conversion events it supplies to OpenAI. Those events say when you look about to claim a handle, finish signing up or claim one. OpenAI also receives your IP address, browser details and the page's origin (its scheme and host, not its full address). OpenAI's separate automatic matching feature can detect and send hashed identifiers when enabled; it does not depend on TAP supplying them in its events. OpenAI may also use what it receives to personalise its own advertising elsewhere, unless you opt out with OpenAI directly. Turn advertising off on this page, or say no in the banner, and the pixel stops loading from the next page on.
The pixel does not load on protected pages such as personal access links, sign-in confirmations and app authorisation or credential screens, even when you have allowed advertising.
What brought you here, unless you turn it off
When you arrive through one of our adverts, or click the claim line at the foot of an artist's page, we remember where you came from, so that an account you create in the next 30 days is counted to that advert or that artist. That count is all it is for: the artist sees how many accounts and artists its pages brought, never who. Both cookies are set only while analytics is on; the switch at the top of this page covers them.
| Cookie | What it does | How long it lasts |
|---|---|---|
campaign |
Names the advert you pressed | 30 days |
ref |
Names the artist whose page you clicked the claim line on | 30 days |
Arrive through a second advert or a second artist's page and the cookie is replaced: the last one counts.
What embedded players bring
A website, a links page, an EPK or a release page can embed a player from Spotify, SoundCloud, Mixcloud, Apple Music or YouTube, chosen by the artist.
These come from those companies. When a player loads it can set its own cookies and see your IP address, under its own policy, not ours.
A video waits for a click, the way YouTube always has. The other players wait for a click too, until you say yes to loading them right away. The cookie dialog asks on every artist page, and the switch at the top of this page changes the answer. A click on one player loads that player only.
To keep players from loading at all, block third-party cookies or third-party content in your browser. The page still works.
The support window, when you press Contact
Contact and Write to us open a support window from Help Scout. Its script does not load with the page; it loads when you press one of those controls, and only then. Once it has, Help Scout can store its own cookies and local data to keep your conversation open, under its own policy. Never pressed it, nothing from Help Scout is in your browser.
Managing cookies
Every browser lets you see, block and delete cookies. Blocking ours means you cannot stay signed in, but you can still read every public page.
Changes
If we ever set another cookie that is not strictly necessary, this page lists it before it appears, and the switch above covers it.