JamBench: Music learning platform

1. What are Cookies?

Cookies are small text files that websites store on your device. They help save your settings and keep you logged in.

In addition to cookies, we also use similar technologies such as Local Storage and Session Storage, which are also covered in this policy.

2. Types of Cookies

We distinguish between different types of cookies:

By Origin:

First-party cookies: Set by JamBench itself
Third-party cookies: Set by external services (e.g., Supabase for authentication)

By Duration:

Session cookies: Deleted when you close the browser
Persistent cookies: Stored for a defined period

3. Cookies & Storage

JamBench sets first-party cookies plus Local Storage and Session Storage. Strictly necessary entries (sign-in, UI, cache-bust) do not require consent. YouTube embeds and the campaign cookie yt_attr require your consent. Sign-up attribution is not stored on your device at all (section 3.5).

3.1 Authentication (Supabase)

Cookie	Purpose	Duration
sb-*-auth-token	Maintains your login session	Session / Persistent
sb-*-auth-token-code-verifier	PKCE authentication flow	Session

3.2 Functional Cookies (JamBench)

Cookie	Purpose	Duration
geo-country	Country code for regional display (e.g. date and number formatting). Not HttpOnly; Secure; SameSite=Lax.	1 hour
sidebar_state	Stores the sidebar state (open/closed)	7 days
oc_ok	Auth performance cache (prevents redundant database queries). HttpOnly, Secure, SameSite=Lax.	24 hours
ob_done	Onboarding completion marker for middleware routing logic	2 minutes
bb_r301	Cache-bust: one-time HTTP cache wipe so stale permanent redirects (e.g. old 301s) do not apply. Set for all visitors. HttpOnly, Secure, SameSite=Lax. Not a login cookie.	1 year
jb_pending_song	Set only when you click “Save … to my songs” on a public song page: remembers that song (its public id and URL slug) through sign-up so it is waiting in My Songs afterwards. Cleared as soon as the song is added. Not HttpOnly; Secure; SameSite=Lax.	24 hours
bb_benchmate_invite	Set only when you open a Benchmates invite link without being signed in: remembers the invite so the connection can be created after you sign in. Deleted after sign-in. SameSite=Lax.	up to 7 days

Legal basis: § 25(2) No. 2 TDDDG – no consent required as these cookies are strictly necessary for providing the function explicitly requested by the user.

3.3 Local Storage / Session Storage (app preferences)

The following entries remember UI and session state on your device. We do not store an anonymous visitor ID (no bb_anon_presence_id) and we do not send presence heartbeats for logged-out visitors.

Key	Storage	Purpose	Duration
jambench_preferences_*	Local Storage	UI preferences (theme, metronome) for signed-out users. After sign-in, preferences are stored server-side.	Until cleared
jambench_active_vertical	Local Storage	Selected instrument (e.g. “bass”)	Until cleared
jambench-content-zoom	Local Storage	App interface zoom level	Until cleared
kb.sectionViewMode.*	Local Storage	Practice mode per song/resource	Until cleared
kb.practiceModal.layout	Local Storage	Practice modal layout (songs and setlists)	Until cleared
bb_youtube_volume_v1	Local Storage	YouTube player volume	Until cleared
bench:timeline-zoom	Local Storage	Practice timeline zoom level	Until cleared
bb_section_walkthrough_v1_completed	Local Storage	Remembers that the section walkthrough has been completed	Until cleared
bb_subsection_drag_hint_v1	Local Storage	One-time hint for dragging subsections	Until cleared
jambench_session_draft_*	Local Storage	Short-lived practice-session draft if a save is interrupted	Until successful save or deletion
bb_session_heartbeat_active	Local Storage	Cross-tab signal that a practice session is active (signed-in only)	Until session end / cleared
bb.journal.scheduledSlots	Local Storage	Locally remembered practice slots pushed to the calendar	Until cleared
jambench_bands_fixture_v1	Local Storage	Local band workspace (draft/prototype data on the device)	Until cleared
currentUserId	Session Storage	Technical user ID for session navigation (signed-in only, stays in the tab)	Browser tab
selectedLibraryPresetId_*	Session Storage	Last selected library exercise per instrument/workspace	Browser tab
bb:scrollToPresetId	Session Storage	Scroll target after navigating to the library	Browser tab
sw-update-notified	Session Storage	Prevents a duplicate service-worker update notice	Browser tab
bb_section_walkthrough_v1_pending	Session Storage	Section walkthrough still pending in this tab	Browser tab
jambench_explicit_session_started_at	Session Storage	Timestamp when you explicitly started a practice session	Browser tab
yt_consent_songs_strip_dismissed	Session Storage	Hides the YouTube consent strip on /songs for this tab (“Not now”)	Browser tab

Legal basis: § 25(2) No. 2 TDDDG – no consent required; these entries are necessary for the app function explicitly requested (preferences, navigation, practice flow).

3.4 Consent-based (YouTube & campaign attribution)

yt_attr is set when you agree to the Terms of Service and Privacy Policy at sign-up (checkbox on the registration form). For users who are already signed in, the same cookie may also be set when they open a campaign link (/yt/…, /c/…).yt_consent is set only after you allow YouTube to load in the player.

Key	Storage	Purpose	Duration
yt_attr	Cookie	Campaign attribution: stores utm_source, utm_medium and utm_campaign (JSON) so we can measure which video or Short brought you to JamBench. Not shared with any third party.	30 days
yt_consent	Local Storage	Stores your consent to load the YouTube player (true/false). YouTube is not loaded without this consent.	Until revoked / browser data cleared

Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG (consent). You can delete these entries in your browser settings at any time. Using JamBench without the YouTube player is unaffected.

3.5 Sign-up attribution (no storage on your device)

To understand which pages and campaigns lead to registrations, a sign-up link on our public pages carries, in the link itself, the page you clicked it on (path only), any UTM parameters of that page and the external referring website. When you register, we save these values with your account. Nothing is stored on or read from your device for this, so no cookie or storage entry exists for it and § 25 TDDDG does not apply. For Google sign-in the values travel in the return address of the sign-in request.

Legal basis: legitimate interest in understanding the effectiveness of our own content (Art. 6(1)(f) GDPR). Not shared with ad networks.

4. Third-Party Services & Consent

The following third parties are integrated. Essential services are loaded without consent; for YouTube we collect your consent in advance:

Supabase (Authentication)

We use Supabase for user authentication. This sets the essential authentication cookies listed above.

Provider: Supabase Inc., 970 Toa Payoh North #07-04, Singapore 318992
Privacy: supabase.com/privacy

YouTube (Video Embedding)

JamBench embeds YouTube videos for song playback. Before a video is loaded, we ask for your consent. Only after you click "Allow & load video" will the YouTube IFrame API be loaded — at which point YouTube may set its own cookies to operate the player and collect usage statistics.

Your consent is stored in your browser's Local Storage under (yt_consent) and remains valid until you revoke it. You can revoke consent at any time by clearing the browser storage for this site.

Provider: Google LLC / YouTube
Legal basis: Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG
Privacy: policies.google.com/privacy

5. Cookie Management

For essential cookies (authentication, UI preferences, cache-bust) no consent is required. For YouTube videos we ask directly in the player for your permission before the YouTube API is loaded. Sign-up attribution stores nothing on your device (section 3.5).

You can manage cookies and local storage entries through your browser settings:

Chrome: Settings → Privacy and Security → Cookies
Firefox: Settings → Privacy & Security → Cookies
Safari: Preferences → Privacy → Cookies
Edge: Settings → Cookies and site permissions

Note: Blocking essential cookies will prevent you from logging in to JamBench.

6. Legal Basis

The use of cookies is based on the following legal ground:

Essential & functional cookies (sb-*, geo-country, sidebar_state, oc_ok, ob_done, bb_r301, jb_pending_song, bb_benchmate_invite): § 25(2) No. 2 TDDDG in conjunction with Art. 6(1)(b) and (f) GDPR — no consent required, as strictly necessary for operation and the function explicitly requested by the user
Local Storage / Session Storage (app preferences) (jambench_preferences_*, jambench_active_vertical, jambench-content-zoom and others in table 3.3): § 25(2) No. 2 TDDDG — no consent required; technical UI and session preferences
YouTube videos (yt_consent): § 25(1) TDDDG in conjunction with Art. 6(1)(a) GDPR — consent required; collected before the player is loaded
Campaign attribution (yt_attr): Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG — consent required; collected at sign-up
Sign-up attribution (carried in the sign-up link, no storage on your device): Art. 6(1)(f) GDPR; § 25 TDDDG does not apply because nothing is stored on or read from your device

Should we introduce third-party analytics or advertising cookies in the future, we will update this policy and obtain your consent.

Questions about cookies?

Cookie Policy

Summary