# Cookies and analytics | Lyro Music

> The cookies Lyro sets, how our first-party analytics works under the UK statistical-purposes exception, when Google Analytics runs (only with consent), and how to turn analytics off.

Source: https://lyromusic.com/legal/cookies

# Cookies and analytics

Last updated 25 October 2026

We set a small number of first-party cookies: to keep you signed in, to remember your choices, to credit a friend's invite if you open an invite link, and to count visits so that we can improve the site. We use no advertising cookies. Google Analytics cookies are set only if you allow them. You can turn analytics off at any time with the "Analytics: on/off" switch under "Cookie settings" in the footer of every page, and withdraw consent to Google Analytics with the "Google Analytics: on/off" switch next to it.

This summary is a guide and is not legally binding wording.

## 1. What we use

A cookie is a small text file that a website asks your browser to store. Lyro sets eleven cookies, all from our own domain. Five are essential, two are used only during Google sign-in, one is set only when you open a friend's invite link, and three support our own analytics. If you allow Google Analytics, Google's script sets two more on our domain.

We use no advertising cookies and load no advertising tags or social media widgets. The only third-party analytics script is Google Analytics, and it loads only after you allow it.

## 2. The cookies we set

| Name | Purpose | Duration | Type |
|---|---|---|---|
| lyro_s | Keeps you signed in. It holds a random session token. It is HttpOnly, which means scripts in the page cannot read it. | 30 days, or until you sign out | Essential |
| lyro_in | Tells our public pages that you are signed in, so the header can show "Open studio" instead of "Log in". It holds the value 1 and no identifier. | 30 days, or until you sign out | Essential |
| lyro_g | Protects Google sign-in against forgery while you are on Google's page. Set only if you choose Google sign-in. HttpOnly. | 10 minutes | Essential |
| lyro_gl | Remembers the language of the page you were on when you chose Google sign-in, so a new account opens in that language. Set only if you choose Google sign-in from a page that is not in English. It holds a two-letter language code and nothing about you. HttpOnly. | 10 minutes | Essential |
| lyro_ref | Set only when you open a friend's invite link. It holds the inviter's code, so that the invite can be credited if you create an account and start a plan. That is its only use. It holds nothing about you, and it is HttpOnly. | 30 days | Invite |
| lyro_optout | Remembers that you turned analytics off. | 12 months | Essential |
| lyro_notice | Remembers that you have seen the analytics notice, so that it is not shown again. | 12 months | Essential |
| lyro_ga | Remembers whether you allowed Google Analytics. It holds yes or no. | 12 months | Essential |
| lyro_a | A random identifier for our own analytics, so that visits from the same browser count as one visitor. It holds no name or email address. | 12 months. Deleted when you turn analytics off. | Analytics |
| lyro_nav | One word ("none", "cross-site" or "same-site") that says whether you reached a page by typing the address or opening a bookmark, or by clicking a link on another site or app, so that we can count where visits begin when the other site does not tell us. Read by our analytics on your next page view. It holds no name or email address and is not set if you have turned analytics off. | 15 minutes. | Analytics |
| lyro_v | Keeps you on the same version of a page while we test two versions against each other. It holds a short label for the version, not an identifier for you. | The length of the test, and never more than 12 months | Analytics |
| _ga | Google Analytics: a random identifier that tells visits from the same browser apart. Set by Google's script, only if you allow Google Analytics. | 13 months. Deleted when you withdraw consent. | Google Analytics, with consent |
| _ga_ and our property code | Google Analytics: keeps the state of the current visit. Only if you allow Google Analytics. | 13 months. Deleted when you withdraw consent. | Google Analytics, with consent |

## 3. Other storage in your browser

Our analytics also keeps two entries in your browser's session storage, which the browser clears when you close the tab. `lyro_sid` is a random identifier for the current visit, and it is replaced after 30 minutes without activity. `lyro_ctx` holds the address of the site that referred you and any campaign tags in the link you followed, read once on the first page. Both are removed when you turn analytics off.

The quiz, the prompt generator and the studio also keep a few entries in your browser's local or session storage, all with names that start with `lyro_`. They hold your quiz answers until you finish, an unsent draft in the studio, a generation that is waiting while you sign up or choose a plan, which first steps you have completed, and which in-app messages you closed during this visit. They exist so that your work is not lost between pages and so that messages you closed stay closed. None of them is an identifier, none is used to follow you, and clearing your browser's site data removes them.

**YouTube videos.** Some pages show one of our YouTube videos as a picture with a play button. The picture comes from our own site, so nothing is loaded from YouTube until you press play. When you do, the video plays in YouTube's privacy-enhanced mode (youtube-nocookie.com), and YouTube, which is part of Google, may then set its own cookies or store data in your browser under its privacy policy. "Watch on YouTube" opens the video on YouTube itself.

## 4. How our analytics works

Our analytics is first-party: our own script sends events to our own server, and the data stays in our own database. We use it only to see how the site and the studio are used, so that we can improve them.

It records:

- pages viewed, page titles and the width of the browser window;

- sections that came into view, how far you scrolled and how long you stayed;

- clicks on buttons and links that we have marked, and which questions you opened;

- the site that referred you, campaign tags, browser language, device type, which browser or app opened the page (a short label such as "Chrome" or "an app's built-in browser", and on Android the name of that app; not the full browser string), whether you arrived by typing the address or by a link from elsewhere, and your country;

- steps such as finishing the quiz, signing up, seeing the plans (with the price level they were shown at), starting a checkout, coming back from it and making a first track.

It does not record what you type, it does not fingerprint your device, and it does not follow you to other websites. Our analytics tables store the country that our host derives from your IP address, not the address itself. We share the data with nobody except the providers that host it for us.

Apart from the tracker, our server keeps daily totals of page requests, with no cookie and no identifier: how many times each page was loaded and, for each part of the site, how many requests carried ChatGPT's campaign tag, came with a referring address (yes or no, never the address) and began by typing or an app, a link on another site, or a link inside ours. A total cannot be traced back to a visit or a person.

A visit to our public pages is recorded under the random identifier in `lyro_a`, with no account identifier. Steps you take after signing in (signing up, a checkout, the studio) are recorded under your account together with the visit identifier in `lyro_sid`, so a visit can be linked to the account that signed in during it, and a visit that leads to a sign-up or a purchase is marked with a yes, so that we can see which pages help people get started. The [privacy notice](https://lyromusic.com/legal/privacy#analytics) explains this in full. Events are deleted after 120 days and visit summaries after 400 days.

## 5. Why you see a notice and not a consent banner

UK law normally requires consent before a website stores anything on your device that is not essential. Since 5 February 2026 the Privacy and Electronic Communications Regulations have an exception for statistical purposes. It applies when:

- the only purpose is to collect statistics about how a service is used, in order to improve it;

- the information is not shared with anyone else, except to help with that improvement;

- visitors are told clearly what is happening;

- visitors have a simple, free way to object.

We rely on that exception for `lyro_a`, `lyro_nav`, `lyro_v` and the two session storage entries. This page and the notice on your first visit are the explanation. The footer switch is the way to object.

The other cookies of our own need no consent because each is strictly necessary for something you asked for: signing in, Google sign-in, remembering your analytics choices, and, for `lyro_ref`, crediting the invite whose link you opened.

Google Analytics is different. Its cookies are not covered by the statistics exception, so we ask first. The notice has two equal buttons, "Allow Google Analytics" and "No thanks", and nothing is loaded from Google for it until you allow it. To withdraw consent later, open "Cookie settings" in the footer and select "Google Analytics: on", or use Settings > Privacy in the studio. We then delete the `_ga` cookies and stop Google Analytics at once.

## 6. How to turn analytics off, and what happens

There are two ways, and both work without an account:

- In the footer of every page, open "Cookie settings" and select "Analytics: on". The label changes to "Analytics: off".

- On your first visit, choose "Turn off" in the analytics notice at the bottom of the page.

When you turn analytics off:

- we set `lyro_optout` for 12 months and delete `lyro_a`;

- the session storage entries are removed, and any events waiting to be sent are discarded;

- the tracker stops recording, and our server ignores any analytics request that arrives with the opt-out cookie;

- the page version in `lyro_v` is no longer reported to us;

- Google Analytics stops too, if you had allowed it, and its `_ga` cookies are deleted;

- our server still counts each page request in daily totals, with no cookie and no identifier: one for that page, and one for its part of the site split by whether the link carried ChatGPT's campaign tag, whether a referring address was sent (yes or no, never the address) and how the browser says the request began.

The choice is stored in that browser only. If you clear your cookies, or use another browser or device, set it again. Select the switch again to turn analytics back on.

Data collected before you objected is deleted on the normal schedule. If you have an account, you can ask us to erase the analytics linked to it sooner.

## 7. Resources from other companies

Four things involve another company's servers. (Our typeface, Instrument Sans, is served from our own site.)

- **Stripe Checkout.** When you pay, you leave our site for a checkout page on Stripe's own domain. Stripe sets its own cookies there, including cookies that it uses to prevent fraud. See the [Stripe cookies policy](https://stripe.com/legal/cookies-policy).

- **Google sign-in.** If you choose it, you pass through Google's sign-in page, where Google's own cookies apply.

- **Google Analytics.** Only if you allow it. Your browser then loads Google's script from www.googletagmanager.com and sends measurements to Google Analytics. Section 5 and the [privacy notice](https://lyromusic.com/legal/privacy#analytics) explain what it receives.

- **Cloudflare Turnstile.** When we switch this check on, the sign-up page loads it from challenges.cloudflare.com to tell people from automated programs. To do that, Cloudflare receives your IP address and details of your browser, and it may store and read information in your browser, such as a short-lived challenge cookie. This is used only for security and is strictly necessary for the check, so the analytics switch does not affect it. See Cloudflare's [Turnstile privacy addendum](https://www.cloudflare.com/turnstile-privacy-policy/) and its [list of cookies](https://developers.cloudflare.com/fundamentals/reference/policies-compliances/cloudflare-cookies/).

## 8. Controlling cookies in your browser

Every browser lets you see, block and delete cookies, usually under Settings and then Privacy. You can delete cookies for one site or for all sites, and you can block them in advance.

Three things to know. If you block `lyro_s`, you cannot sign in. If you delete all cookies, you also delete `lyro_optout`, so analytics turns back on until you switch it off again. If you block or delete `lyro_ref` before you sign up, the invite cannot be credited.

## 9. Changes and contact

If we add, remove or change a cookie, we update the table on this page and the date at the top. The [privacy notice](https://lyromusic.com/legal/privacy) explains what else we do with personal data and the rights you have. For questions, use [the contact form](https://lyromusic.com/contact) or [hello@lyromusic.com](mailto:hello@lyromusic.com).