COOKIE POLICY.

Version 1.0.0 · In force from 26 July 2026

NOT READY FOR PUBLICATION. The following details are still placeholders and must be completed in lib/legal/entity.ts before launch: ICO registration number.

We use eight cookies in total. Four are needed to make the site work and cannot be turned off. The other four only count visitors and remember form answers, and we do not set them unless you agree. We do not use advertising or third-party tracking cookies at all.

What a cookie is

A cookie is a small file a website asks your browser to store. On a later visit the browser sends it back, which lets the site recognise that it is dealing with the same browser as before. That is how you stay signed in across pages.

UK law (the Privacy and Electronic Communications Regulations) says we may only set cookies without asking where they are strictly necessary to provide something you asked for. Everything else needs your agreement first, which is why you saw a banner.

Change your choice

You can change your mind at any time, and withdrawing agreement is as easy as giving it. Choosing to decline also deletes the cookies that were already set.

You have not made a choice yet.

You can also delete cookies through your browser settings. If you block the strictly necessary ones you will not be able to sign in.

Strictly necessary

Required to sign you in, keep your session secure and remember your cookie choice. These cannot be switched off and do not require consent.

These do not require your consent and cannot be switched off.

CookieWhat it doesHow long it lastsSet when
sessionKeeps you signed in. Contains a signed session token, not your personal details.7 days, extended while you stay active (30 days maximum)Sign-in and two-factor verification
csrf-signatureProtects against cross-site request forgery, so another site cannot act on your behalf.24 hoursAny authenticated page load
cookieConsentRemembers your cookie choice so you are not asked again on every visit.12 monthsThe cookie banner
presaveAuthHolds the short-lived security state that links you to the Spotify authorisation you started, so the connection cannot be hijacked mid-flow.10 minutesStarting a Pre-Save connection

Analytics

Let an artist see how many separate people visited their page, rather than just a total number of visits. Declining these does not reduce what you can do on the site.

These are only set if you agree. Declining them does not limit what you can do on the site.

CookieWhat it doesHow long it lastsSet when
fanlinkVidA random identifier with no personal details in it, so repeat visits to a release link are counted as one person rather than several. Only set for counting if you agree. It is also set, regardless of your cookie choice, if you connect a Pre-Save — it is the only way we can let you disconnect it again later without asking you to create an account, so in that situation it is strictly necessary for something you asked us to do.12 monthsFanLink pages, and connecting or disconnecting a Pre-Save
epkVidA random identifier with no personal details in it, so repeat visits to a press kit are counted as one person rather than several.12 monthsEPK pages
captureVidA random identifier with no personal details in it, so repeat visits to a sign-up form are counted as one person rather than several.12 monthsCapture form pages

Functional

Remember what you previously submitted to a form so you do not have to type it again.

These are only set if you agree. Declining them does not limit what you can do on the site.

CookieWhat it doesHow long it lastsSet when
capture_sub_<form id>Remembers that you already completed a particular form so your previous answers can be shown back to you. Stores a random reference to your submission, never your email address.6 monthsSubmitting a capture form

How our analytics work

When you agree to analytics cookies we store a randomly generated identifier in your browser. It is not derived from anything about you and cannot be traced back to you. Before it is recorded against a page view it is put through a keyed one-way hash, so what we store is not reversible into the identifier held by your browser.

If you decline, we still count the page view but attach no identifier at all. The artist sees how many times their page was viewed but not how many separate people viewed it. We do not fall back to your IP address or to browser fingerprinting.

  • —We never store your IP address against a page view. IP addresses are used only in memory, to apply rate limits.
  • —We do not use Google Analytics, Google Tag Manager, Meta pixels, or any other third-party analytics or advertising service.
  • —We do not track you across other websites, and we do not build advertising profiles.

Tracking in emails

Release announcement emails sent by an artist you subscribed to contain a small invisible image and links that pass through our servers, so the artist can see how many people opened the email and which links were popular. This is described at the point you join a mailing list, and every one of those emails has an unsubscribe link in the footer.

Music pitches sent to industry contacts use the same measurement, and include both an unsubscribe link and a link to report the message. Artists can switch this measurement off for their own outreach.

Service messages such as email verification, password resets and release notifications contain no tracking of any kind.

Questions

For more on how we handle personal data, see our Privacy Policy. For anything about cookies specifically, email [email protected].

Company details.

Registered name: In A Box Records Ltd

Company number: 09948687

Company type: Private limited company

Registered office: Hazeldean, Green Road, Wivelsfield Green, Haywards Heath, RH17 7QA, England

Registered in: England and Wales

Data protection contact: Data Protection Lead, [email protected]