Cookie Policy
Draft placeholder — not yet reviewed by legal counsel.
Cookies ECHO sets
| Cookie | Purpose | Lifetime |
|---|---|---|
echo_session | Strictly necessary. Identifies your browser session so an anonymous or logged-in journey can be found again — httpOnly, first-party, never used for tracking or advertising. | 1 year |
google_oauth_state | Strictly necessary. Prevents cross-site request forgery during "Sign in with Google". Set only while that flow is in progress. | 10 minutes |
spotify_oauth_state | Strictly necessary. Same CSRF protection, for connecting Spotify to export a playlist. Set only while that flow is in progress. | 10 minutes |
What ECHO doesn't set
No advertising, analytics, or third-party tracking cookies.
Browser storage (not a cookie)
Dismissing the cookie notice banner is remembered in your browser's localStorage, not a cookie — it never leaves your device.
Third-party cookies
If reCAPTCHA is enabled, it runs invisibly in the background on the sign up / sign in form (there's no challenge to complete) and Google may set its own cookies while it does, governed by Google's own privacy policy — ECHO doesn't control those.
See the Privacy Policy for how ECHO handles the data behind these cookies.