Privacy

That is a consequence of how Amply is built rather than a policy we chose to adopt. There is no backend holding a list of artists, no database of listeners, and nothing we could hand over, sell or lose.

One thing is not ours to promise. An artist who charges for their music serves it only to listeners who identify themselves with a wallet, and if you play it, that artist's own server records that your wallet did. It runs in their account, not ours. What that means for you is below.

This website

Static files. No cookies, no analytics, no tracking pixels, no fingerprinting. We do not know that you visited.

Setting up an artist's streaming service

When an artist connects their Cloudflare account, the authorisation happens between them and Cloudflare. We receive a short-lived access token, use it to create their storage and Worker, and discard it.

We never receive a refresh token, and we never store a credential. Our access to an artist's Cloudflare account exists for the seconds of one setup flow and then is gone permanently. We cannot go back in later. If something needs changing, the artist authorises us again.

We keep no record that the setup happened, no artist list, no email address, no web address. The relay that carries those requests is stateless, has no storage attached to it, and logs nothing.

You don't have to take that on trust. Your Cloudflare account keeps its own audit log of every change made in it, and it will show exactly what setup created, and that nothing has touched your account on Amply's behalf since.

The listener app

Everything stays on the device:

Which artists you follow, stored locally, never transmitted to us.
What you listen to, and for how long, measured on your device so that artists can be paid. It never leaves it.
Your wallet key, generated on your device and held in its secure storage. We never see it, cannot recover it, and could not spend from it.

There is no sync, no cloud backup, and no account. That has a real cost: lose the device without a backup and you lose the library and the balance. We would rather be honest about that than hold your data in order to avoid it.

Music you pay for

Music an artist has made free plays for anyone, with no identification and nothing recorded. Music an artist charges for is served only to a listener whose app proves which wallet it holds, because that is how the artist is paid and how they can stop serving someone who doesn't pay. Your app does that by signing a challenge; there is still no account, no password and no email.

When you play a paid track, that artist's server keeps a running total for your wallet: how many tracks, how many minutes, and when you were last there. It does not record which tracks you played, or when you played them, because Amply's software does not collect that. The artist can see those totals and can decide to stop serving your wallet.

This is the artist's data, held by the artist, under their own responsibility. It is also deletable by you, without asking anyone: your app can prove the row is yours by signing for it, and the record is erased immediately. No form, no identity documents, and nobody to persuade.

One exception, and we would rather state it than bury it. If an artist has stopped serving your wallet, erasing your record does not lift that. Everything about your listening goes — how much, how long, when — and what stays is the address itself, marked as barred. Otherwise the erasure right would double as a way to undo any artist's decision to stop dealing with someone, which is not what it is for. Erasure has always had limits where a controller has grounds to keep something, and this is the smallest one we could implement.

The app shows an artist's price before you play anything of theirs, and a paid track never plays without a wallet, so it cannot happen by accident.

Amply for Artists, our app for Stripe

Artists who sell card subscriptions can install our app, Amply for Artists, in their own Stripe account. It exists only so Stripe can make a key limited to what an artist's streaming service needs: setting up subscription plans and checkout links, and checking who has subscribed. The artist copies that key into their own streaming service, where it stays. The app collects nothing, and we never receive the key, the payments, or anything about the artist's customers. The artist can uninstall the app, or delete the key, in Stripe at any time.

What other people can see

We are not the only party involved, and it would be misleading to describe only our own part.

The artist's own streaming service serves the audio, so it can see requests for it, the same way any website can. It belongs to the artist, and it is their responsibility.
Cloudflare operates that infrastructure, under the artist's own account and Cloudflare's own privacy policy.
Stripe, if you subscribe to an artist by card. You pay on Stripe's own page, to the artist's own Stripe account, under Stripe's privacy policy. The artist's streaming service keeps only your wallet address, the subscription's ids and when it ends.
The payment on-ramp, if you fund a wallet, is a separate company whose terms and identity checks are their own.
The blockchain. Payments to artists are recorded on a public ledger. This is worth understanding clearly: those records are permanent, public, and cannot be deleted. Anyone can see that an address paid an artist, when, and how much. Addresses are not names, but they are not anonymous either, a wallet can be linked to a person, particularly through the on-ramp that funded it.

Your rights

Data protection law gives you rights to access, correct and erase personal data held about you. We hold none, so there is nothing for us to produce or delete. If you believe otherwise, write to us and we will look into it.

Changes

If this page changes, the change is visible in the public repository's history, with a date and a diff. We cannot quietly revise it.

Contact

Open an issue on the repository.