Xuxly Cookie and Storage Notice
Version 2026-10-25. Effective October 25, 2026.
1. Scope
This notice supplements the Privacy Policy of Nomenas Digital LLC for Xuxly. Xuxly uses browser and device storage for authentication, security, playback, preferences, unfinished workflows, payment state, and privacy choices. The website uses optional Google Analytics only after you allow it, with advertising storage and personalization disabled. Android advertising is separate and described below. Infrastructure providers may still process operational and security information.
A browser-storage lifetime is not necessarily the retention period of corresponding server records. A cookie that expires after 14 days does not prove that an expired database session has been physically deleted.
2. Current web storage
| Name or type | Purpose | Lifetime or clearing behavior |
|---|---|---|
sessionid cookie and associated server session | Authentication and account session | Browser-session cookie without "Remember me"; 14 days with "Remember me". Browser session-restoration behavior can vary. Server-row cleanup is addressed separately in the Privacy Policy |
csrftoken cookie | Protects state-changing requests against cross-site request forgery | Current configured/framework lifetime: 31,449,600 seconds, approximately 364 days |
g_csrf_token (Google Identity Services) | Double-submit protection for a Google sign-in response posted to Xuxly | Short-lived; set and controlled by Google Identity Services for the sign-in request |
g_state (Google Identity Services, when used) | Remembers Google One Tap or automatic-sign-in state | Controlled by Google Identity Services; duration may vary with the selected Google sign-in experience |
django_language cookie | Remembers the interface language selected by the user | Session cookie in the current configuration |
xuxly.analytics-consent.v1 in localStorage | Remembers your analytics permission or rejection, with a decision timestamp; does not contain your account identity | Up to 180 days, or until you clear site data or change the choice |
_ga and _ga_<stream> cookies (Google Analytics) | Optional pseudonymous visitor/session measurement on public pages, created only after permission | Configured maximum 180 days without renewal on every visit; removed by rejection/withdrawal in that browser. Event/user retention is configured separately as described in the Privacy Policy |
| Signed message cookie or session message data | Brief success/error messages | Temporary functional storage, consumed or discarded as the relevant message/session is handled |
xuxly.web.player.v2 in localStorage | Current item, playback position, volume, queue of up to 50 items, shuffle, repeat, autoplay, history reference, and last-update information | No fixed automatic expiry in the current version; may be removed if invalid/unresolvable or when site data is cleared |
xuxly.web.sleep-until.v1 in localStorage | Sleep-timer deadline | Removed when the timer expires or is switched off |
xuxly_artist_wizard in sessionStorage | Unsaved artist-wizard metadata, track titles, and selected file names; not audio bytes | Cleared after successful submission or when the browser discards the tab/session storage |
| Cloudflare Access/security storage, where that access layer applies | Protected tester/admin access and security | Provider-controlled and dependent on the protected-access configuration and provider security requirements |
The current non-local deployment marks the session cookie Secure, HttpOnly, and SameSite=Lax. The CSRF cookie is Secure and SameSite=Lax, but intentionally accessible to JavaScript for request protection. The language preference is a separate functional value and does not contain an authentication credential.
3. First-party activity records
First-party listening and service events are also recorded on the server as described in the Privacy Policy. Blocking a third-party cookie does not necessarily stop first-party request logging or server-side activity required by the feature you use. A keyed identifier is not necessarily anonymous.
The website's first-party Privacy choices control provides Allow analytics and Reject analytics with no preselected permission. No Google Analytics tag loads or analytics request leaves the browser before permission. You can change or withdraw the choice through Privacy choices on catalogue pages, also reachable at Privacy choices. Withdrawal stops future measurement and removes Analytics cookies in that browser; it does not delete events already received by Google. Account, checkout, administration, search, personal history/library, profiles and playlists are excluded; public page addresses omit query strings and fragments. Google Signals, advertising personalization and enhanced automatic interaction measurement are disabled. Other Google features such as a deliberate sign-in request are separate from analytics consent.
4. Android local storage and permissions
The Android application requests permissions relevant to reading your audio library, internet connections, foreground media playback, and keeping playback active. It stores the local library index, local playlists, hidden-item state, playback snapshot, preferences, offline catalog media, and local flags indicating Plus, local ad removal, or an operator ad-free grant in app-private files or databases. Google UMP and Mobile Ads may store consent, advertising, security, frequency, and measurement data through their SDK storage and device services. Car-display artwork can be cached and may be evicted by the app or operating system.
Local audio is not automatically uploaded. The current app disables Android cloud and device-transfer backup for the specified app data. Local app data generally remain until you remove them, clear app data, or uninstall the app. Clearing app data or uninstalling may remove offline downloads and locally maintained lists. Copies stored elsewhere on your device are separate.
5. Your controls
Your browser allows you to inspect, block, and clear cookies and site storage. Blocking authentication or security storage can prevent login or completion of a requested action. Clearing player storage may remove saved queues and playback preferences. Your device settings control Android app permissions and local-data clearing.
Where Xuxly provides a privacy or storage setting, its effect is described with that control. When Google UMP requires a privacy-options entry point, the Android settings screen lets you reopen that form. The website does not currently run behavioral advertising. Browser Global Privacy Control and Do Not Track signals therefore do not change a web-advertising practice; mobile choices operate in the app separately from acceptance of the Terms.
6. Future changes and contact
Before adding nonessential analytics, new advertising formats or partners, new SDKs, or materially different storage, we will update the inventory and provide any legally required notice and choice. Radio operators and their stream hosts independently process connection data when you play their streams; their practices are not fully described by Xuxly's cookie table.
Questions: legal@xuxly.com. See the Privacy Policy for other data categories, providers, locations, retention, and rights.