Cookie Policy — Chorus

In plain English

We use Google Analytics to count visits and see which pages people read. That's it — no advertising, no behavioral profiling, no cross-site retargeting.
GA sets two first-party cookies (_ga, _ga_ZG8HTGXJCS) that last up to 2 years.
Cloudflare may set short-lived security cookies to keep bots away from the site. They're functional, not tracking.
This will expand if we ever launch a hosted product with sign-in. We'll update this page first.

1. What cookies are

Cookies are small text files that websites store in your browser. They can be used for harmless things (remembering you're logged in, keeping items in a shopping cart) or for invasive things (cross-site behavioral tracking, fingerprinting). This page tells you which kind we use.

2. What Chorus uses

The marketing site at chorus.codes uses Google Analytics 4 to measure traffic. That's the only analytics platform on the site — no Plausible, Fathom, Mixpanel, Hotjar, or Segment. There is no advertising. There is no behavioral profiling. There is no cross-site retargeting.

Google Analytics is loaded via the standard gtag.js snippet and sets the following first-party cookies on the chorus.codes domain:

Name	Set by	Purpose	Lifetime
`_ga`	Google Analytics	Distinguishes unique visitors so we can count daily/weekly traffic.	2 years
`_ga_ZG8HTGXJCS`	Google Analytics	Persists session state for our specific GA property (container ID `G-ZG8HTGXJCS`).	2 years

We use GA only for aggregate page-view and source/medium reporting. We don't enable Google Signals, advertising features, or remarketing. IP anonymization is on by default in GA4. Data is processed under Google's privacy policy.

The notify form posts a single JSON request to our API; no additional cookies are created or read in that flow.

3. Third-party cookies

3.1 Cloudflare

Our DNS and edge routing run through Cloudflare. Cloudflare may set short-lived functional cookies that help it tell humans from bots and protect the site from abuse:

Name	Set by	Purpose	Lifetime
`__cf_bm`	Cloudflare	Bot management; distinguishes humans from automated traffic.	~30 minutes (rolling)
`cf_clearance`	Cloudflare	Stores the result of a bot challenge if you've been challenged.	Up to 30 days

These are set by Cloudflare's edge, not by us, and we do not have access to their contents. They are necessary for the security of the site. See Cloudflare's cookie policy for details.

3.2 Google Fonts

The site loads the Geist webfont from Google Fonts (fonts.googleapis.com). Google states that no cookies are set when serving fonts. Your browser will send a request to Google's servers, which logs your IP per Google's privacy policy.

3.3 GitHub

Links to our GitHub repo go to github.com. Following those links takes you to GitHub, which has its own cookies — those are governed by GitHub's privacy policy, not ours.

4. The local Chorus daemon

The Chorus CLI engine and local daemon you install on your laptop don't use cookies — cookies are a browser concept and the daemon is a local process. The daemon stores configuration in ~/.chorus/ on your machine; that's not transmitted anywhere on the free tier.

5. Managing cookies

You can clear or block cookies through your browser settings:

Blocking the Cloudflare functional cookies may degrade the site's bot-protection — you'll likely be challenged more often.

6. Future changes

If we ever introduce a hosted product with sign-in (e.g., the planned Pro/Teams tiers in v1.5/v2.0), we'll need session cookies for authentication. We may also swap Google Analytics for a more privacy-respecting alternative (Plausible, self-hosted Umami) as the project matures.

Whenever the cookie inventory changes, we'll:

Update this page with the new entries and their purpose.
Bump the "Last updated" date at the top.
For tracking-style cookies (analytics, advertising), display a banner asking for explicit consent before they are set, where required by law (EU/UK/Brazil/etc.).

7. Contact

Cookie or tracking questions: [email protected].