Language: 中文 · English · Bahasa Malaysia
Cookie & Storage Notice
This website (stringsong.io)
Sets no cookies. If you choose a language with the language links, your choice is saved in your browser's local storage (key ss-lang) so the home page opens in that language next time. Fonts and images are served from our own domain; no third-party requests are made.
The app (app.stringsong.io)
The app keeps its data in your browser's local storage, where every key starts with flutter., and in IndexedDB.
| What (key) | Why | When it is removed |
|---|---|---|
| Sign-in session (Firebase Authentication, IndexedDB) | Keeps you signed in. Only if you sign in. | Sign-out |
Device settings: lang, listenMode, shuffle, repeat, autoplay, mixSeed (a random number so this device gets its own Daily Mix), sidePanel (desktop side panel open or closed) | Remember your settings on this device. | When you clear this site's data |
Likes and follows saved while signed out: liked, following | Let you use them without an account. Copied to your account when you sign in, then removed from the browser (if the copy does not succeed they stay as the browser's own data). | After the copy; account deletion; clearing site data |
Today's Daily Mix: dailyMix | The song list of today's Daily Mix (made from your account). | Sign-out, account deletion |
Welcome note: welcomeSeen_<hashed user id> | Remembers that the welcome note was shown for that account on this device. | Account deletion; clearing site data (kept on sign-out) |
Sign-in diagnostics: authDiagnostics | A log of the last 50 sign-in events on this device (time, event type, error code, a shortened account id, app build id), used to find the cause of unexpected sign-outs. Kept on this device only and never sent anywhere; you can view or copy it in About / Diagnostics. | Clearing site data (kept on sign-out) |
Continue listening: resumePositions | Where you stopped in up to 50 half-played songs on this device. | Sign-out, account deletion |
Recently played: recent | Your recent songs on this device. | Sign-out, account deletion |
Recent searches: searchRecent | Your last few searches. | Sign-out, account deletion |
Play counts: playLog | This device's play counts: the last 500 plays with their times. Not uploaded. | Sign-out, account deletion |
Account sync markers: merged_<user id>, prefsFromAccount_<user id>, prefsSaved_<user id> | Remember what was already copied to or saved in your account, so nothing is written twice. | Sign-out, account deletion |
Free plan daily allowance: usage_day, usage_skips, usage_albums; plan shown on this device: tier | Apply the Free plan's daily limits on this device. | When you clear this site's data |
| Offline database cache (Cloud Firestore, IndexedDB) | A copy of your synced library, so it loads fast and works briefly offline (signed in only). | Sign-out (if other tabs still hold it open, the app asks you to close them), account deletion |
Short-lived flags: deleteAfterRedirect (with a session storage check value), accountDeleted, signedOutResult | Finish an action across a sign-in redirect and show its result. | deleteAfterRedirect expires after 10 minutes; the others are cleared once shown |
| App files (browser cache) | The browser's normal cache. The app registers no caching service worker (an old one, if present, removes itself). | Managed by the browser |
Lyric cards are made on your device; nothing is uploaded to us. Sharing one uses your device's share sheet, so where it goes is your choice.
Sign-in and other services
The app's engine, fonts and the Firebase software are served from app.stringsong.io itself. Your browser contacts Google for Firebase (sign-in, database, file storage and functions on googleapis.com and cloudfunctions.net), for Google sign-in (accounts.google.com, apis.google.com and our sign-in domain stringsong-4764e.firebaseapp.com, where Google may set its own strictly necessary cookies while you sign in), and for your profile photo (googleusercontent.com). Google receives your IP address and browser details for these; see the Privacy Policy. Google reCAPTCHA is used only if we enable App Check, which we have not.
All of this is strictly necessary for features you use, which is why we do not ask for consent. None of it is shared for advertising.
How to clear it
Signing out (in that tab and every other open tab) removes recently played, Continue-listening positions, today's Daily Mix, recent searches, play counts, the account sync markers and the offline database cache. Before signing out the app tries to send changes that are not synced yet; if you are offline it warns you that they would be lost. Deleting your account removes the same, plus the likes and follows kept in the browser and the welcome-note marker. Device settings, the Free plan's daily counters and the sign-in diagnostics log stay until you clear this site's data in your browser settings.
Questions: [email protected]. More detail: Privacy Policy. This notice is available in English, Chinese and Bahasa Malaysia; if they differ, the English version prevails.
Version history: 1.0 (2026-10-17) first public version. 1.1 (2026-10-17) full list of app storage keys and when each is removed; the app no longer loads files from Google's content servers. 1.2 (2026-10-17) resumePositions, mixSeed, sidePanel; lyric cards. 1.3 (2026-10-17) authDiagnostics, dailyMix, welcomeSeen_<hashed user id>.