Cookie Policy

Cookies are small text records stored by a browser and returned to a website. Local and session storage can remember information without sending it with every request. We refer to these technologies together as browser storage.

The authenticated Service uses essential cookies that cannot be disabled through our preference tool:

• lx_session maintains the signed-in session. It is HttpOnly, uses SameSite protection, and normally expires after 12 hours.
• lx_csrf helps protect authenticated actions against cross-site request forgery and normally expires after 12 hours.
• lx_auth_challenge supports short-lived login or multi-factor challenges and normally expires after 10 minutes.
• lx_oauth_state protects the Google sign-in callback when that option is used and normally expires after 10 minutes.

In production, authentication cookies are transmitted using the Secure attribute. Signing out, revoking a session, or completing a short-lived flow may remove the relevant cookie earlier.

lunaxCookieConsent stores the notice version, Analytics and Marketing choices, whether a Global Privacy Control signal was detected, and the time saved. This record remains until it is replaced or deleted. The dashboard may also keep limited theme, language, navigation, or temporary interface state in local storage. Local storage is not used as the source of authentication authority.

Essential storage supports security, navigation, consent, and requested functionality. Blocking or deleting it may sign you out, clear preferences, interrupt an unfinished workflow, or cause the consent notice to appear again.

Google Tag Manager container GTM-TQFS6VSJ manages consent-aware tags. Google Analytics 4 measurement ID G-9QQ3TT3S9P is used to measure page use, technical performance, traffic sources, and feature engagement. Google may process page URL and title, referrer, browser and device attributes, timestamps, interaction events, campaign parameters, approximate location, and pseudonymous identifiers. We do not intentionally configure Analytics to receive uploaded royalty statements, participant contact details, split percentages, payment records, or financial values.

Consent Mode v2 defaults analytics_storage, ad_storage, ad_user_data, and ad_personalization to denied. GTM does not load until Analytics or Marketing is accepted, and each category's consent state is supplied before tags run. When Analytics is allowed, Google Analytics commonly uses first-party cookies such as _ga and _ga_<container-id> to distinguish users and preserve session state. Google documents a default duration of up to two years, which may be renewed on later visits.

Google processes this information under its Privacy Policy and applicable Google Analytics terms.

Meta Pixel ID 719471049083365 is configured for campaign measurement. It loads only after you choose Marketing. The current site integration sends a standard PageView event and may disclose the page URL, referrer, browser and device attributes, timestamp, IP-derived information, campaign identifiers, and Meta-related browser identifiers. It does not upload customer lists or intentionally send royalty statements, catalog financial values, participant contact details, or payment records.

Meta may use browser identifiers such as _fbp and, when a Meta advertising click identifier is present, _fbc. Meta controls the operation and retention of its identifiers under the Meta Privacy Policy. Depending on applicable law, use of the Pixel may be considered targeted advertising, sharing, or a similar regulated disclosure.

Cloudflare Turnstile protects the login and public waitlist forms from automated abuse. It may process IP address, device and browser characteristics, challenge interaction, and other signals needed to determine whether a request is legitimate. Cloudflare states that Turnstile does not access form entries or other page inputs. We treat it as essential security technology, so it can operate without optional Analytics or Marketing consent. The current integration does not intentionally enable Turnstile pre-clearance.

Cloudflare's handling is described in its Privacy Policy and Turnstile documentation.

If you choose Google sign-in, the browser is redirected to Google, where Google may use cookies and account-security technologies under its own policies. Luna X Royalties uses the short-lived essential lx_oauth_state cookie described above to protect the callback. We request only OpenID, email, and basic profile scopes.

Spotify artist search is performed server to server using the Spotify Web API. The current integration does not sign a user into Spotify or place Spotify cookies through Luna X Royalties. Opening an external Spotify profile is a separate visit governed by Spotify's policies.

The durations above describe our application cookies and Google's published defaults. Third-party durations and names can change, and providers may use additional storage according to their configuration and policies. External services can set separate cookies after you follow a link or authenticate on their domain.

You can accept optional categories, use Essential only, or change your choices at any time below. Withdrawing consent stops future optional tag loading and sends updated denied states to Google, but it may not automatically remove identifiers already stored by a provider. Browser controls can inspect, block, or delete site data.

When the browser exposes a Global Privacy Control signal, Luna X Royalties treats it as a refusal of Marketing technologies on that browser. Analytics remains a separate choice.

Change cookie preferences

We may update this policy when technologies, providers, or legal obligations change. A material change resets the saved notice version and causes the consent banner to appear again. Contact [email protected] with questions.