Cookie Policy
Detailed disclosure of cookies, localStorage, sessionStorage, IndexedDB, Global Privacy Control (GPC) handling, and consent categories across bandruption.com, bandruption.fun, create.bandruption.fun, and bandruption.ai.
- Version
- 2026-10-31
- Effective Date
- Last Updated
- Data Controller / Contracting Entity
- Bandruption Corp — 8 The Green B, Dover, DE 19901, United States
- Legal & Privacy Contact
- hello@bandruption.com · (+1)302-468-6362
- Account Deletion
- https://www.bandruption.fun/account-deletion
- Document SHA-256
- 81b465b5946bb817fde08a9fedf5300c239ce7a35c05180803ea8be4af26108a
- Version Permalink
- 2026-10-31
1. Scope and Our Global Opt-In Approach
This Cookie Policy explains how Bandruption Corp ("Bandruption", "we", "us", or "our") uses HTTP cookies, browser localStorage, sessionStorage, IndexedDB, and third-party media embeds across bandruption.com, bandruption.fun, create.bandruption.fun, and bandruption.ai.
We apply a global opt-in standard across our web surfaces using our self-hosted, open-source CookieConsent v3 preference manager. Strictly necessary cookies and security mechanisms run to deliver the service you request, while all optional functional, analytics, marketing, and external media embed technologies remain turned off unless and until you actively enable them.
2. Host-Only Consent Storage and Subdomain Isolation
When you save a choice in our consent banner ("Accept all", "Reject nonessential", or custom category toggles in "Manage preferences"), we store your choice in a first-party, host-only cookie named bandruption_consent (Secure, SameSite=Lax, 180-day lifespan).
- No Cross-Domain Wildcard Sharing: We deliberately omit wildcard Domain attributes so a consent choice made on bandruption.fun does not silently opt you in on create.bandruption.fun, bandruption.com, or bandruption.ai.
- Minimized Anonymous Audit Receipt: To demonstrate compliance without tracking you, our server records an anonymous consent receipt containing only a random receipt UUID, surface hostname, action, category booleans, policy/banner version, locale, GPC flag, and timestamp (24-month TTL)—with zero user ID, email address, IP address, or user-agent string.
3. Consent Categories Explained
- Strictly Necessary (Always Active): Required for core page rendering, signed-in authentication sessions, CSRF and bot/abuse protection (reCAPTCHA Enterprise on newsletter submission, Cloudflare Turnstile on login), checkout payment execution, and remembering your language and consent choices.
- Functional (Opt-In): Enables optional enhanced browser capabilities such as OneSignal web push notifications on bandruption.fun and bandruption.ai.
- Analytics & Performance (Opt-In): Enables Bandruption first-party product and funnel analytics (@shared/analytics), Firebase Analytics / Web Vitals, Google Tag Manager analytics_storage, and HyperDX browser RUM on bandruption.ai. No pre-consent events are buffered or flushed retroactively.
- Marketing & Conversion Attribution (Opt-In; GPC-Suppressed): Enables the X (Twitter) campaign conversion pixel (pei71) on bandruption.fun and Google Consent Mode v2 ad_storage, ad_user_data, and ad_personalization flags. Bandruption does not serve third-party display ads (no Google AdSense, Meta Pixel, or LinkedIn Insight Tag).
- External Media Embeds (Opt-In or Click-to-Load): Controls third-party streaming iframes from Spotify, YouTube (youtube-nocookie.com), SoundCloud, Apple Music, and Bandcamp. Until allowed, embeds display a zero-network first-party placeholder.
4. Verified Cookie, Storage, and Service Inventory
The table below is generated directly from our runtime service registry so this policy and our live Consent Management Platform remain synchronized:
| Service / Purpose | Category | Provider | Surfaces | Cookies / Storage Keys | Scope & Retention |
|---|---|---|---|---|---|
| Consent Preference Storage — Stores your granular cookie and tracker consent choices on the current hostname so non-essential scripts remain off unless opted into. | Strictly Necessary (Always Active) | Bandruption Corp (CookieConsent v3, self-hosted) | bandruption.com, bandruption.fun, create.bandruption.fun, bandruption.ai | bandruption_consent | First-party host-only cookie (no cross-subdomain Domain wildcard; Secure; SameSite=Lax) (180 days) |
| Authentication, Session Security & Locale — Maintains signed-in user sessions, OIDC/OAuth security state, shopping cart integrity, and explicit language/theme interface settings. | Strictly Necessary (Always Active) | Bandruption Corp (Better Auth / OIDC / Session Security) | bandruption.fun, bandruption.ai | bandruption_auth.session_token, better-auth.session_token, connect.sid, refreshToken, token_provider, NEXT_LOCALE, lang | First-party host-only / HttpOnly authentication, CSRF, and UI locale cookies/keys (Session to 30 days (locale preference up to 365 days)) |
| Fraud Prevention, Bot Protection & Checkout Processing — Protects newsletter, login, and payment endpoints against automated abuse and processes user-requested financial transactions. | Strictly Necessary (Always Active) | Google reCAPTCHA Enterprise / Cloudflare Turnstile / PayPal / KOMOJU / Stripe | bandruption.com, bandruption.fun, create.bandruption.fun, bandruption.ai | _GRECAPTCHA, cf_clearance, __paypal_storage__ | Loaded strictly on demand during form abuse verification or checkout payment execution (Session to 180 days (provider security lifespan)) |
| OneSignal Web Push Notifications — Enables optional browser push notifications for artist drops, bounty updates, and AI task completion when both Functional consent and browser notification permission are granted. | Functional (Opt-In) | OneSignal, Inc. | bandruption.fun, bandruption.ai | onesignal-notification-prompt, OneSignalSDKDatabase | Origin-scoped localStorage and IndexedDB (loaded only after Functional consent) (Until browser push unsubscription or consent withdrawal) |
| Bandruption First-Party Product & Funnel Analytics — Measures page navigation, feature reliability, and subscription funnel performance using Bandruption-hosted ingestion after Analytics opt-in. | Analytics & Performance (Opt-In) | Bandruption Corp (@shared/analytics) | bandruption.com, bandruption.fun, create.bandruption.fun | bandruption.analytics.anonymous_id, bandruption.analytics.user_id, bandruption.analytics.session, bandruption.analytics.first_session_seen, bandruption.analytics.attribution, bp_sub_attr, bp_sub_session | Origin-scoped localStorage / sessionStorage; zero pre-consent writes or buffering; purged on revocation (Up to 365 days (subscription attribution keys expire in 30 days; immediately deleted on withdrawal)) |
| Firebase Analytics, Web Vitals & Google Tag Manager (Analytics Storage) — Collects aggregated traffic metrics and Core Web Vitals performance telemetry only when Analytics consent is granted. | Analytics & Performance (Opt-In) | Google LLC (Firebase Analytics, Performance Monitoring & Google Tag Manager) | bandruption.com, bandruption.fun, create.bandruption.fun, bandruption.ai | _ga, _ga_*, firebase-heartbeat-database, firebase-installations-database | First-party cookies and IndexedDB governed by Google Consent Mode v2 (analytics_storage only; ad_* remains denied unless Marketing is also granted) (Up to 13 months (cookies deleted immediately on consent withdrawal)) |
| Bandruption AI Real-User Monitoring (RUM) — Diagnoses client-side streaming latency and UI errors in Bandruption AI with URL/token redaction enabled. | Analytics & Performance (Opt-In) | HyperDX / OpenTelemetry Browser RUM (proxied via bandruption.ai) | bandruption.ai | hdx_session, opentelemetry_rum_session | Origin-scoped browser session telemetry on bandruption.ai (loaded only after Analytics consent) (Browser session (server observability traces retained up to 30 days)) |
| X (Twitter) Campaign Conversion Measurement & Google Ad Consent Signals — Measures signup and purchase conversions from Bandruption campaigns on X and controls Google Consent Mode v2 ad_storage, ad_user_data, and ad_personalization flags. | Marketing & Conversion Attribution (Opt-In; GPC-Honored) | X Corp. (Twitter Universal Website Tag, Pixel ID pei71) | bandruption.fun | muc_ads, personalization_id, guest_id_marketing | Opt-in conversion measurement on bandruption.fun only; blocked by default and automatically locked off when Global Privacy Control (GPC) is enabled (Up to 13 months per X Corp. policy (first-party artifacts cleared on withdrawal)) |
| External Music & Video Player Embeds — Loads interactive Spotify, YouTube, SoundCloud, Apple Music, or Bandcamp streaming players on artist profiles and guides only when requested. | External Media Embeds (Opt-In / Click-to-Load) | Spotify AB / Google YouTube (youtube-nocookie.com) / SoundCloud / Apple Music / Bandcamp | bandruption.com, bandruption.fun | sp_t, sp_landing, YSC, VISITOR_INFO1_LIVE | Third-party player origins; iframes are blocked behind a first-party placeholder until Embeds consent or explicit click-to-load (Session to 12 months governed by the embedded player provider once loaded) |
5. Global Privacy Control (GPC) and Google Consent Mode v2
If your browser or extension sends a Global Privacy Control signal (navigator.globalPrivacyControl === true), Bandruption automatically locks the Marketing & Conversion Attribution category to disabled, prevents the X conversion pixel from loading, and keeps Google Consent Mode v2 ad_storage, ad_user_data, and ad_personalization set to "denied". Absence of a GPC signal is never treated as opt-in consent.
On surfaces where Firebase Analytics or Google Tag Manager is configured, we initialize Basic Google Consent Mode v2 with analytics_storage, ad_storage, ad_user_data, and ad_personalization all defaulting to "denied", and no Google script is downloaded unless you grant the corresponding category.
6. How to Change or Withdraw Consent (Including Without JavaScript)
You can inspect, change, or withdraw your consent at any time with a single click using the "Cookie Preferences" button in the footer of every Bandruption web page (and in Account Settings on bandruption.ai), or the button at the top of this Cookie Policy.
- Immediate Effect Upon Withdrawal: Turning off a category or clicking "Reject nonessential" immediately halts future tracking calls, updates Google Consent Mode signals to "denied", unmounts external media embeds, and purges known first-party analytics/attribution cookies and localStorage/sessionStorage keys (_ga, _ga_*, bandruption.analytics.*, bp_sub_*).
- Browser Controls & No-JavaScript Browsing: If you browse with JavaScript disabled, zero optional analytics, marketing, push, or embed scripts execute on Bandruption websites. You can also delete or block cookies directly in Chrome, Firefox, Safari, Edge, or mobile browser privacy settings; blocking strictly necessary authentication cookies will prevent signing into authenticated workspaces.
Questions about our use of cookies or storage technologies may be sent to Bandruption Corp at hello@bandruption.com, (+1)302-468-6362, or 8 The Green B, Dover, DE 19901, United States.