Privacy, Cookies & Security

Last updated: October 23, 2026

Midimaze is an educational platform for Recording Arts & Technology students, musicians, and collaborators. This page explains what data we collect, what happens when you accept, reject, or ignore the cookie banner, how contextual sponsorships work on public logged-out pages, and why signed-in @swccd.edu students and faculty never see ads.

Default Cookie Posture: What happens if you do not click Accept or Reject?

Most visitors want to know what happens when a cookie banner appears and they simply keep reading without clicking Accept or Reject. Midimaze uses a strict three-state posture:

• 1. Undecided / No Click Yet (Default Posture): Before you click either button, Midimaze does not write any persistent analytics tracking cookies (ph_*) or cross-site advertising identifiers to your browser disk. First-party usage analytics (PostHog) runs strictly in cookieless memory-only mode (persistence: 'memory'), which counts the current page view in temporary tab memory and keeps session replay turned off. Public logged-out pages may display topic-matched contextual sponsor cards (for example, sheet music editions on the Scores page or audio interfaces on studio pages) that require zero tracking cookies.
• 2. When you click Reject Non-Essential: Midimaze saves your rejected choice in local storage and a first-party preference cookie (mm_consent=rejected) so the banner stays dismissed, purges any existing ph_* analytics keys from your browser, and keeps analytics locked to cookieless memory-only mode.
• 3. When you click Accept All: Midimaze saves your accepted choice (mm_consent=accepted) and permits PostHog to store first-party continuity cookies so bug reports and multi-page navigation can be diagnosed across reloads.

Ethical Sponsorships & Zero Ads for @swccd.edu

• Zero ads for Southwestern College students and faculty: If you sign in with a @swccd.edu email address (or any student, tutor, intern, faculty, or administrator account on Midimaze), all sponsor slots are completely disabled. Educational coursework, quizzes, studio bookings, and grading views are 100% ad-free in alignment with FERPA student privacy protections.
• Ethical contextual sponsorships for logged-out visitors: When browsing public catalog pages while signed out, Midimaze may show clearly labeled sponsor placements for music and audio education partners (such as urtext score publishers, pro-audio retailers, and academic software discounts). These placements are matched to the page topic rather than personal behavioral profiles.

What we collect

• Account info: Your email (used for authentication), display name, and role (student, faculty, admin). Provided when you sign in with an email link or a password. Southwestern College students may also have a student ID number taken from their@swccd.edu address or the class roster.
• Course content you create: Articles, studio bookings, weekly reports, submissions, notes, and recommendations stored in our Convex database and linked to your account.
• Usage analytics: We use PostHog to see which portals are used and to diagnose errors. As described above, PostHog runs in cookieless memory-only mode until you click Accept. When cookies are accepted, session replays mask text typed into form fields and keep diagnostic logs for 30 days.

Local Ambient Workspace Bridge (Professor Machine Only)

When the course instructor reviews student submissions, grades, or portal metrics on his own workstation running the local ambient daemon (http://127.0.0.1:17380), Midimaze can emit concise UI state transitions (such as which portal, score, or submission queue is currently open) to his local loopback interface. This traffic never leaves127.0.0.1, is disabled on student and visitor machines, and writes only to local instructor notes on his computer.

Cookies and browser storage

• Sign-in session (Strictly Necessary): A Better Auth session cookie that keeps you signed in. Required when you sign in.
• UI & Consent Preferences (Strictly Necessary): Local storage for theme (midimaze-theme), panel widths (astryx-resizable:*), table columns, and your cookie banner choice (midimaze-cookie-consent-v1 / mm_consent).
• Analytics (Optional / Opt-in): PostHog cookies and local storage (names starting with ph_), written only after you click Accept All Cookies.

Who can see course material

• Anyone can read public articles and browse public score and library catalogs.
• Any Southwestern College student who signs in with their @swccd.edu email can read course pages and use the class listening library, whether or not they are enrolled in a Recording Arts & Technology class.
• Students enrolled in a class can also submit work, take quizzes, and see their grades. Nobody sees another student’s submissions or grades except the professor.

Content download requests

Midimaze includes a feature that lets you request downloads of educational content from recommendations. When you trigger one of these requests, the row stored in our database contains only the content type, the search query you submitted, a timestamp, and a status field.

We deliberately do not store a user ID on these rows. The mutation that creates them runs server-side and does not record the calling user’s identity. Completed download requests are automatically swept after 7 days.

Authentication & Data Hosting

Authentication is handled by Better Auth running within our own Convex infrastructure. Passwords are hashed and stored inside the platform; no third-party authentication vendor holds your credentials.

• Web frontend: US virtual server behind HTTPS.
• Database: Convex (US region).
• File storage: Cloudflare R2 and Convex file storage (US region).
• Analytics: PostHog Cloud (US region).
• Email delivery: Amazon SES (US region).

Your rights & In-App Data Requests

You can submit data access, export, deletion, or privacy requests directly through the in-app request modal below. Every request is logged straight into the platform administrator’s Tasks queue without requiring external email.

• Access & Export: Click Request Data Export above to open the in-app task modal and request an export of your account data (articles, studio bookings, and submissions).
• Deletion: Click Request Account Deletion above to open a deletion ticket in the administrator Tasks queue. Your account row and linked content will be removed within 30 days.
• Cookie & Consent Choice: Use the control panel at the top of this page at any time to switch between Accept, Reject (Cookieless), or Reset.