Cookie Policy

Until you answer, a cookie bar at the bottom of every page asks about cookies. It has three categories:

• Necessary: always on, and not a choice. The authentication, security and preference storage described below, including the key that remembers your answer.
• Analytics: Google Analytics 4 and Ahrefs Web Analytics.
• Advertising: Google AdSense Auto Ads after site approval, plus Adsterra placements when the site admin enables them.

Accept all turns analytics and advertising on. Decline keeps only the necessary cookies. Manage settings lets you switch each category on or off, then Save settings. In the EEA, the UK and Switzerland, and wherever your region cannot be determined, analytics and advertising stay off until you accept; everywhere else they are on from your first page and Decline turns them off. Your answer takes effect at once, is kept in this browser, and is reapplied on every later visit. A refusal always wins, and Global Privacy Control turns both off whatever you choose. To change your answer at any time, choose Cookie settings in the footer of any page, or the button below.

Secure HttpOnly SameSite cookies maintain a signed-in or short-lived recovery session. They do not contain passwords or recovery codes.

Rate limiting, CSRF/origin validation, passkey challenges, and trusted-session protections may use short-lived server or browser state.

Theme and your cookie-consent choice are stored in browser localStorage (the theme and cookie-consent keys); workspace layout and guest session choices may also be stored locally. When you rate an SW Agent answer, this browser keeps which answers you rated and how (the rating's random id and your choice, never the question, the answer or your note), so the thumbs show your choice when you come back; it holds the latest 200. Signed out, SW Agent keeps your latest 30 chats and jobs, what you asked it to remember and the styles you chose in this browser's localStorage, and sends them nowhere until you choose to move them into an account. Two first-party cookies support the cookie bar, and neither contains an identifier. novus-region holds only eu or row, is set from the country of your request, expires after 12 hours, and decides whether analytics and advertising start off until you accept. novus-ads-refused holds only the value 1, mirrors an explicit advertising refusal, expires after a year, and is kept as a first-party consent marker; the browser runtime checks the saved choice before any ad request or preconnect.

The caption and title fonts load from Google Fonts on every page. Google Fonts sets no cookies, but Google receives each request with your network address and browser details. It is not part of the cookie bar's categories.

This is the Analytics category in the cookie bar. Google Analytics 4 measures aggregate usage through this site's own property, loaded by one consent-gated Google tag. Ahrefs Web Analytics, which sets no cookies, counts page views under the same choice. The same answer sets Google's Consent Mode v2 signals (analytics_storage, ad_storage, ad_user_data, ad_personalization). In the EEA, the UK and Switzerland, and wherever your region cannot be determined, they stay denied and the tag does not load until you accept; elsewhere they are granted until you decline. Your saved choice is reapplied on return visits, and Global Privacy Control overrides a saved grant. Withdrawing analytics consent immediately denies them, sets Google's ga-disable flag, expires applicable Google measurement cookies, and reloads the page once when the tag has already run (never inside Classic or Studio, where the flag alone stops it). Vercel Speed Insights, which sets no cookies, measures how fast pages load for a small sample of page views; it is loaded on every page and is not part of this category. Vercel Web Analytics is switched off.

This is the Advertising category in the cookie bar. Google AdSense Auto Ads is enabled by default in the site admin; its publisher script loads only after advertising consent on eligible public routes, and Google serves ads only after site approval and account setup. Adsterra placements, including content and editor units, the Social Bar, footer link and export sponsor tab, are controlled by a separate admin switch that is Off by default. Google, Adsterra and their demand partners may set cookies or use device storage to show and measure ads. Personalized ads in the EEA, the UK and Switzerland require a Google-certified CMP. In those regions, and wherever your region cannot be determined, no ad script is requested until you accept; elsewhere advertising is allowed until you decline. Declining stops new ad requests and removes ads already on the page; where ad code has already run, the page reloads once so nothing keeps running. Global Privacy Control turns advertising off too, over a saved Accept all. The sign-in, sign-up, account recovery, admin and security-settings screens load no ad code at all, and this page, the privacy policy, the terms, the security page and the accessibility statement carry no ad. One first-party cookie, nss_ads_optout, is written only if you choose Turn ads off above or open a Sonic Weaver page with ?nss_ads=off. It stores a single flag recording that no ad should be requested for this browser, whatever the cookie bar says, is scoped to sonicweaver.com, expires after two years, contains no identifier, and is removed by Turn ads back on or ?nss_ads=on. The public /ads.txt file lists Google and Adsterra as authorized sellers; the Adsterra row remains while that publisher relationship is active.

Signed-in projects are stored in Turso, not cookies. Music and files you import into Studio, for guests and signed-in members alike, stay in your browser's IndexedDB storage for this site; clearing site data removes them. Background Motion scenes, generated layer assets and imported stills also use browser-local storage. The models for lyric transcription, lyric translation, stem separation, background removal and picture depth are fetched from Hugging Face only when you start one of those tools and may be kept by the browser in Cache Storage, where Settings lists them with a Remove for each; no audio, picture or words are sent with that request. Community preview images, explicitly saved private assets, and private copies earlier versions of Studio made of imported files use Vercel Blob. Guest work is stored device-locally in your browser and can be exported as .novusvis; clearing site data removes it.