Cookie Policy
Cookies and Browser Storage
CANTA uses strictly necessary cookies only, together with necessary browser storage. There are no advertising or cross-site tracking cookies and no analytics cookies. Product measurement, where it is used, likewise stores nothing on your device and reads nothing from it. For that reason there is no consent banner.
The legal ground for storing data on your device is Section 25(2)(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG, formerly TTDSG): storage that is strictly necessary to provide a service you have expressly requested. The subsequent processing of the data relies on Article 6(1)(b) GDPR (providing the requested service) and, for access control and abuse protection, on Article 6(1)(f) GDPR (legitimate interest in security).
Items used
| Item | Type | Purpose | Storage duration |
|---|---|---|---|
canta_session (signed) | Cookie | Maintains the requested session and the ownership of credits | One year |
canta_gate | Cookie | Access control during the invite/testing phase | One year; becomes inert when the invite phase ends |
| Sender name | Browser storage (localStorage) | Remembers the sender name you entered for your next composition; stays on your device | Until you clear browser storage or the app offers a reset |
| Last song | Browser storage (localStorage) | Remembers your most recently created song (identifier and title) so you can reopen it; stays on your device | Until you clear browser storage or sign out |
| Volume | Browser storage (localStorage) | Remembers the playback volume you set; stays on your device and is not transmitted | Until you clear browser storage |
The sender name is not repurposed as a tracking identifier. Where Turnstile security signals are used, the provider Cloudflare acts as a processor for site protection and as a separate controller for product improvement; see the processor list for detail.
Product analytics
CANTA measures whether the product works: how many people arrive, how many create a first song, how many complete one, share it, or buy credits, and where people stop. PostHog is used for this.
What is measured
- Identifier: a pseudonymous identifier prefixed "anon_". PostHog receives no name, no email address and no person profile. On the share and listen pages, an identifier held only in memory is used; it disappears for good when the browser tab is closed.
- Events: a fixed, closed list of eight events — visit, session start, first song, completed song, share, opening the checkout page, first successful purchase, and an explicit account departure. There is no automatic capture of every page view or click.
- Properties: timestamp, platform, first-visit origin (only the recognised
refandutmparameters — the full address of the page you opened and the referring address are read and immediately discarded, not stored), song identifier and metadata (genre and mood as fixed preset values, never free text; estimated generation cost, surface, whether you are the sender or the recipient, a playback milestone). On the purchase events, the fact of the purchase is added: transaction and offer identifiers, amount, currency, and number of credits. - Expressly not measured: message and lyrics text, song titles, audio files, prompts and any other free text; card details (these are held exclusively by Stripe); session replays and heatmaps; advertising profiles; cross-product tracking. No data is sold.
No consent banner — and why
The analytics stores nothing on your device and reads nothing from it: no analytics cookies, no browser local storage, no recognition based on device characteristics. The consent requirement in Section 25(1) TDDDG is therefore not triggered; the necessary storage CANTA does use is described in the cookie and browser-storage policy.
Your IP address is not evaluated to determine your location (geolocation is switched off at the provider).
Legal basis and objection
The legal basis is Article 6(1)(f) GDPR (legitimate interest in strictly minimised, profile-free product measurement). The balancing assessment is documented and is re-run if any of the safeguards above changes.
You may object to the analytics at any time (Article 21 GDPR). An objection stops collection; it does not merely hide it. Send an informal message to support@canta.lol; we will stop collection for you and delete the events already stored against your identifier. No objection route is needed on the share and listen pages, because no recognisable identifier is created there.
No automated decisions: analytics data is not used to vary prices, offers or features for individual people, and not for automated decisions within the meaning of Article 22 GDPR.
Retention
Raw events are kept for 12 months and are then deleted at the provider. Aggregate statistics that no longer make an individual identifiable are retained beyond that.
Recipients and transfers
The processor is PostHog, Inc. (San Francisco, USA); processing runs on the EU Cloud in Frankfurt. Its EU sub-processors (Amazon Web Services, Wiz, PlanetScale, Modal Labs) are routed through Germany.
Honest characterisation: EU hosting is not a promise that data never leaves the EU. Cloudflare sits on the provider's global edge regardless of the region chosen, and PostHog, Inc. is a US company with no EU establishment, so access from the USA (for example in support) is possible. Those transfers are safeguarded by the data processing agreement with EU Standard Contractual Clauses; certification under the EU-US Data Privacy Framework is declared by the provider.
Deletion
If you request erasure, we instruct the analytics provider to delete the events stored against your identifier, and the link between identifier and account is removed at CANTA. The memory-only identifiers used on the share and listen pages cannot, by their nature, be traced or deleted afterwards by anyone — including us — because they are never stored anywhere.
CANTA is made with AI.
Last updated: 2026-07-27