Cookie Policy
Last updated: 2026-10-09
1. What we use, by category
Our consent banner (CookieConsent v3, self-hosted) groups everything into three categories. Here is the complete inventory — cookies and browser storage, because storage deserves the same transparency. Where a tool is set up but switched off, the table says so.
Strictly necessary
Always on. Required for the site and the web player to work, or kept only to finish something you started.
| Name | Type | Purpose |
|---|---|---|
| cc_cookie | Cookie (first-party, 6 months) | Stores your consent choice so we do not ask again on every page |
| iv_auth | localStorage | Keeps you signed in to the web player |
| iv_player_snapshot | sessionStorage | Carries what is playing from one page of the web player to the next, so playback continues where you were |
| iv_progress_queue | localStorage | Queues listening progress while you are offline, syncs when you reconnect |
| iv_player_speed | localStorage | Remembers the playback speed you chose in the player |
| iv-motion | localStorage | Remembers that you paused the moving background, so it stays paused |
| iv_verify_email | sessionStorage | The email address you just signed up or signed in with, handed to the email-verification page so you do not have to type it again. Tab-scoped, and removed once it has been used |
| iv_verify_resend_at | localStorage | The time you last asked us to resend a verification email, so the 60-second wait survives a page reload |
| iv_auth_continue | sessionStorage | For 30 seconds after the sign-in page sends you on, remembers where it sent you, so a page that does not accept your sign-in cannot bounce you back and forth. Tab-scoped; holds only a page address and a time |
| iconicVoicesLeads | localStorage | Fallback copy of a notify-me email you submitted, kept in your browser only if the network submission failed; sent again on your next visit, then removed |
| iv_dormant_leads_v1 | localStorage | The same kind of fallback copy for a "Notify me" request made from a book card; sent again on your next visit, then removed |
| iconicVoicesLeads_migrated_v1 | localStorage | A one-word marker left by an older version of the site after it moved saved notify-me emails to our server. No longer written; harmless if it is still in your browser |
| iv_pending_cycle_picks_* | localStorage | Legacy website plans only: book choices you made in your library that are waiting to be saved, so a dropped connection does not lose them |
| ivBannerDismissed | sessionStorage | Remembers that you closed an in-page banner during this visit |
| qcflags | localStorage | Used only by our internal audio-review pages, which are not part of the public site: the words a reviewer flagged for re-recording |
| Cloudflare Turnstile | Cookie / script (challenges.cloudflare.com) — configured, currently disabled | When enabled: bot protection on the sign-up and password-reset forms only |
| Sentry | Script (browser.sentry-cdn.com) — configured, currently disabled | When enabled: error reports when a page breaks, with emails, IP addresses, tokens and passwords scrubbed in your browser first. Sets no cookies |
Analytics
| Name | Status | Purpose |
|---|---|---|
| Plausible Analytics | Active (cookieless) | Anonymous aggregate page-view counts. Sets no cookies, stores no personal data, does no cross-site tracking — which is why it runs regardless of the Analytics toggle; the toggle still controls the Consent Mode signal |
| Cloudflare Web Analytics | Active (cookieless), added by our host | Aggregate page-load and performance measurements (such as how fast a page appears). Sets no cookies, uses no browser storage, and does not identify you or follow you across sites |
| iv_utm | sessionStorage; written only while Analytics is on | The utm_* values from the link you arrived on, so we can tell which campaign a signup came from. Tab-scoped — it disappears when you close the tab, and it is erased as soon as you switch Analytics off |
Google Analytics 4 (_ga) | Configured, currently disabled | If enabled: visit statistics with IP anonymization, following the regional rules in section 2 |
Marketing
| Name | Status | Purpose |
|---|---|---|
Meta Pixel (_fbp) | Configured, currently disabled (no pixel ID is set) | If enabled: ad measurement; communicates with connect.facebook.net. Loads only while Marketing is on for you (section 2) |
TikTok Pixel (_ttp) | Configured, currently disabled (no pixel ID is set) | If enabled: ad measurement; communicates with analytics.tiktok.com. Loads only while Marketing is on for you (section 2) |
| iv_em | localStorage; written only while Marketing is on | A hashed (never plaintext) copy of an email you submitted, used for ad-platform matching |
| iv_attrib_first, iv_attrib_last | localStorage; written only while Marketing is on | The campaign parameters of the link you arrived on — utm_* plus the Meta (fbclid) and TikTok (ttclid) click identifiers — kept so a later signup can be credited to the right ad |
Marketing storage is written only while the Marketing category is on for you — after you opt in where consent is required, or, in opt-out regions, as long as you have not opted out and your browser does not send Global Privacy Control. It is deleted the moment you turn Marketing off.
2. How consent works, by region
We work out your region from the country (and, in Canada, the province) that our host Cloudflare associates with your connection. Only if that is unavailable do we fall back to your browser's time zone, and if we still cannot tell, we use the strictest setting (opt-in). Your IP address is not stored for this.
- United Kingdom, EEA, Switzerland and Québec: opt-in. Analytics and
Marketing are off until you switch them on. Google Consent Mode v2 signals
default to
deniedbefore any tracker script loads. - United States: opt-out. The banner tells you plainly that we and our ad partners use cookies for measurement and that you can opt out. Analytics and Marketing start on; you can turn them off at any time, and it takes effect immediately.
- Canada outside Québec, and Australia: notice and opt-out. The banner tells you what we use; the optional categories start on, and you can turn them off at any time.
- Global Privacy Control (GPC). If your browser sends a GPC signal, we treat it as an opt-out of marketing: in the opt-out regions above, Marketing starts off for you without you having to click anything. In opt-in regions it is off anyway.
- Anywhere else, or if we cannot tell: opt-in, as in the UK.
Wherever you are, you can change your mind at any time with Your Privacy Choices.
California and other US states: we do not sell personal information. If the marketing pixels are switched on, turning Marketing off — in Your Privacy Choices, in the banner, or automatically through GPC — is our "Do Not Sell or Share My Personal Information" mechanism. No account or email is needed.
3. How to change your preferences — Your Privacy Choices
- Your Privacy Choices — the button above, and the Your Privacy Choices link in the site footer, open the preferences dialog, where you can switch Analytics and Marketing on or off, per service. On a page where the dialog cannot open, the link brings you here.
- Reset entirely — clear cookies and site data for iconicvoices.io in your browser's privacy settings. The banner appears again on your next visit.
- Email us — privacy@iconicvoices.io and we will help.
4. Third parties
Where the tools above involve a third party, their privacy policies are:
| Tool | Category | Privacy Policy |
|---|---|---|
| Cloudflare (hosting, Web Analytics, Turnstile) | Strictly necessary; Analytics (cookieless) | cloudflare.com/privacypolicy |
| Sentry | Strictly necessary (configured, currently disabled) | sentry.io/privacy |
| Plausible Analytics | Analytics (cookieless; aggregated only) | plausible.io/privacy |
| Google Analytics 4 | Analytics (configured, currently disabled) | policies.google.com/privacy |
| Meta Pixel | Marketing (configured, currently disabled) | facebook.com/privacy/policy |
| TikTok Pixel | Marketing (configured, currently disabled) | tiktok.com/legal/privacy-policy |
5. The iPhone app
The iPhone app uses no cookies, no advertising identifiers, and no third-party analytics. Buying the subscription in the app goes through Apple's In-App Purchase system, which uses no cookies and no ad identifiers either — what is exchanged with Apple is described in the Privacy Policy, sections 2, 3 and 6.
6. Contact
Questions or requests: privacy@iconicvoices.io. For how we handle data generally, see our Privacy Policy.