Solimar uses first-party cookies for sessions, OAuth security and referral attribution. Local storage and IndexedDB retain interface preferences, project drafts and media caches. Referral abuse checks also use hashed network and browser signals; see Privacy.
Updated 3 October 2026First-party authentication and attribution
01 / Cookies
Cookies we set
ac_sessionAuthenticates your Solimar session. Cleared when you sign out; Secure on HTTPS.Cookie · HttpOnly · Until session expiry or sign-out
ac_oauth_state / ac_oauth_verifier / ac_oauth_nextProtect Google sign-in and remember the return route. Consumed after the callback.Cookies · transient · Minutes
ac_apple_state / ac_apple_nonce / ac_apple_next / ac_apple_refProtect Apple sign-in, remember the return route and carry an invite across Apple's cross-site callback.Cookies · transient · Minutes
solimar_refCarries the invite code from the latest referral link to signup, including shared songs, videos and Spaces. It supports eligibility and rewards; it does not grant credits for a click.Cookie · HttpOnly · first-party · Up to 30 days, cleared on new-account signup
02 / Storage
Local storage keys
These preferences keep the interface consistent. Some account settings and saved projects also sync to the server. Video drafts, analysis caches, player state and offline media can additionally use local storage or IndexedDB.
solimar-onboardedRecords that you have completed (or skipped) the first-run tour, so it does not show again.
solimar-onboarding-prefsThe workflow and Sound DNA you picked during onboarding. Used to seed Home. Editable later from Settings.
solimar-cookie-noticeThat you have acknowledged the cookie notice. Removing it brings the notice back once.
ac_nav_mode / ac_nav_last / ac_sidebar_wYour navigation layout (full sidebar, compact rail or top bar), the layout the top bar returns to, and how wide you dragged the sidebar. Replaces the older ac_sidebar flag, which is removed on your next visit.
03 / Clearing
Clearing them
Signing out removes the session cookie. Clearing site data in your browser removes everything above; the only effect is that you will need to sign in again and will see the first-run tour once more.
04 / Third parties
What third parties set
If you pay for a plan, Stripe’s checkout sets its own cookies on Stripe’s domain during payment. Google and Apple do the same on theirs during sign-in. Solimar does not read or control those. See the privacy policy for how those services fit in.
