Cookies and Storage

Pianify sets one cookie, and it exists to keep you signed in. There are no advertising cookies, no analytics, and no tracking of any kind — which is why you have not been shown a banner asking about them.

1. The one cookie

Name	What it holds	Lifetime	Flags
`pf_session`	A signed token identifying your account. No name, no address, nothing readable.	30 days, or until you sign out	HttpOnly · Secure · SameSite=Lax

It is set when you sign in and removed when you sign out. If you never create an account, it is never set. HttpOnly means no script on the page can read it; Secure means it only travels over HTTPS; SameSite=Lax means another website cannot cause your browser to send it.

2. Why there is no consent banner

Storing or reading information on a device needs consent under Article 5(3) of the ePrivacy Directive, as implemented in Hungary — except where it is strictly necessary to provide a service the user has explicitly requested.

A session cookie that keeps you signed in, set only because you asked to sign in, is the textbook example of that exception. There is nothing else to ask about, so we do not interrupt you to ask it. A banner that collects consent for nothing is not a courtesy; it is noise.

[DECISION NEEDED: if analytics, advertising, embedded video, or any third-party widget is ever added, this stops being true. Consent would then have to be collected before those load, with a genuine refuse option, and this page would have to list them.]

3. Cloudflare

The site is served through Cloudflare, which may set its own cookies for security — for example to identify traffic from a browser that has already passed a bot check. These are strictly necessary for the security of the service and rely on the same exception. Cloudflare's own description is in its privacy policy.

The Turnstile challenge shown on the sign-up form is Cloudflare's, and runs only on that form.

4. Local storage, which is not a cookie but is treated as one

The same rules cover anything stored on your device. Pianify keeps the following in your browser's local storage. None of it is ever sent to us.

Settings — language, keyboard layout, note speed, volumes, difficulty options, whether the pedal is automatic, rendering resolution.
Key bindings — any keys you have remapped.
Local best scores — your own results per piece, kept on the device so they survive without an account. Separate from the leaderboard.

That is the whole list — two entries in your browser's local storage and nothing else.

All of it is strictly necessary in the same sense: it is the state of an application you asked to use, and clearing it resets the app to defaults. You can clear it at any time through your browser's site-data controls, and none of it is readable by us or by anybody else.

5. Turning it off

Blocking cookies for this site means you cannot stay signed in — everything else keeps working, and every piece stays playable. Clearing site data removes your settings and local scores; results already submitted to a leaderboard are on our servers and are unaffected.