Cookie information
What this site stores.
Rolls & Rocks keeps only what it cannot work without: 3 cookies, all of them technically necessary.
Cookies in use
The table lists the cookies this deployment sets.
| Cookie | Purpose | Provider | Lifetime | Technically necessary | Third-party access |
|---|---|---|---|---|---|
sessionid |
Keeps you signed in, remembers the recordings this browser queued so they can be attached to your account after login, and carries the one-time Spotify sign-in handshake that is verified when Spotify redirects back. | Rolls & Rocks (first party) | 30 minutes without a request; every request restarts the clock | Yes — the service cannot work without it | Only this site |
csrftoken |
Protects every form that changes data (upload, rename, delete, merge, export, donation, contact, sign in) against cross-site request forgery. It is set only when a page carrying such a form is rendered. | Rolls & Rocks (first party) | one year, replaced whenever a new token is issued | Yes — the service cannot work without it | Only this site |
messages |
Carries one confirmation or error from a page to the next one (for example "Your Spotify account is connected."). It disappears as soon as the message has been shown. | Rolls & Rocks (first party) | until the browser window is closed; the cookie is removed as soon as the message has been shown | Yes — the service cannot work without it | Only this site |
Requests to other domains
Some content lives on other servers. Opening a playlist's Embed page loads Spotify's players into it; the other requests happen because you asked for the content or pressed a button. Each of these requests is listed below with the moment it happens.
| Provider | What is fetched | When |
|---|---|---|
| Spotify and Apple CDN | Album covers and 30-second previews of recognized tracks | When a playlist, catalog or Embed page is opened (covers) or a preview button is pressed (audio). On an Embed page a cover may be requested once more, so that the card standing in for an unmatched track can take its colour. |
| Google (accounts.google.com) | Signs you in: Google authenticates you and returns your identifier, e-mail address and name | Only after you press Continue with Google on a sign-in screen. The button leaves this site for Google's own pages, where Google sets its own cookies under its own policy; no Google script runs inside Rolls & Rocks. |
| Spotify (accounts.spotify.com) | Signs a Spotify account in and out | Only after you start connecting an account on the Spotify Auth page; the request is the OAuth redirect you trigger yourself. |
| Spotify (open.spotify.com) | Embedded players: one per track, or one for the whole exported playlist | Only after you open a playlist's Embed page. Each player is an iframe, so your browser loads that content from Spotify and Spotify sees the request, including your IP address and browser details, as with any embedded content. |
| PayPal | One-time donation | Only after you press the donation button on the Donate page. The button leads to the payment page PayPal hosts — the configured PayPal.Me profile or the business payment link — where the payment happens; afterwards PayPal returns the donor to the thank-you page here. |
| Facebook, X and WhatsApp (share links) | The address of the page you chose to share | Only after you press one of the Share icons on a playlist page. Each button is an ordinary link to that service's own sharing interface, opened in a new tab, carrying the address of the page you chose to share. |
Consent and these cookies
Article 5(3) of the ePrivacy Directive requires prior consent for storing or reading information on your device only when that is not technically necessary to deliver the service you asked for. Staying signed in, protecting a form against cross-site request forgery and showing a one-off confirmation are part of the service itself, so these cookies are set without asking and described here instead.
Changing or withdrawing your choice
Cookies are controlled by your browser, and you can delete or block them at any time from its settings. Some of this site depends on them:
- Deleting the session cookie signs you out and forgets the recordings this browser queued.
- Blocking the CSRF cookie makes every form fail, upload included, because the site can no longer verify where the request came from.
- The public catalog and every playlist page keep working without any cookie at all.