Privacy Policy

1. Who we are

artist.dev is operated by artist.dev LLC, a California limited liability company. For anything about your privacy, email hello@artist.dev.

2. What we collect

You don’t need an account to listen or to send. An account is how you pitch an artist or claim a page, and when you make one, you give us:

• Your email address, to sign you in. Sign-in is by magic link, so we never collect or store a password.
• Your handle, name, city, and role (Maker or Finder), the profile you fill in before your first pitch or claim.
• What you pitch and write: the artists you put forward, the song you pick, and what you write about them. These are public.

We also record your IP address in two places.When you make an account, we keep it once, with your browser’s user-agent string. Each time you ask for a sign-in link, we log it with your email, so no one can flood an inbox with links. We use both to find and undo fraud, like one person making many accounts, not to profile you. We don’t collect audio, and we don’t knowingly collect sensitive personal information.

3. The send log

When you tap from an artist’s page through to Spotify, Apple Music, or YouTube, that tap is a send, and sends are how artists are ranked. For each send we log the artist, the platform, the day and time, where you were sent, and the website that sent you to us (its domain, not the full address).

To count each fan once a day without knowing who they are, we use a daily visitor key. It’s a one-way code made from the date, your IP address, and your user-agent string, mixed with a secret that never leaves our server. It changes every day, so it can’t follow you from one day to the next, and we don’t store your IP address or user-agent string with it.

We keep the visitor key and the referring website for 60 days after the day of the send, so we can look for fraud, like one key sending hundreds of times. After that we erase both. The artist, the platform, the day, and the destination stay, and no longer connect to anyone.

4. Why we use it

• To run the site: sign you in, record pitches and sends, build each artist’s page, and freeze each day’s result.
• To send you the two emails the product depends on: your sign-in link, and a note on the day an artist you pitched debuts.
• To keep results honest: find and undo fraud, fake accounts, and inflated sends.
• To measure and improve the site, and to run advertising (see below).
• To meet our legal obligations and enforce our Terms.

5. What is public, and what is not

Public:your handle, and the artists, pitches, and results tied to what you pitch. These are visible to anyone by design, so don’t put anything in them you wouldn’t want public. Send counts are public too, but they never show who sent.

Not public:your email address is never shown on the site. We use it to sign you in and to reach you, and we can see it internally, but it isn’t on any public page.

6. Third parties that store data through your browser

Two third parties set storage in your browser when you use artist.dev, and each is governed by its own policy:

• The Apple Music embed.The player is Apple’s, loaded from Apple, and it may set its own storage when it runs. Its use of your data is governed by Apple’s Privacy Policy. The player is part of the product. The consent controls below never turn it off.
• Meta. We use the Meta Pixel to measure which ads bring people to the site, and which visits end in a tap out to a streaming service, an event we call stream_click. The Pixel may set storage in your browser and share event and identifier information, such as page views, with Meta Platforms, Inc. under its own policy. Because the Pixel runs in your browser, Meta receives your IP address and your browser’s user-agent string with each event, though artist.dev stores neither for a send.

Plausible, our analytics, sets no cookies and is never turned off by the consent controls either.

7. Sharing event data with Meta from our server

Separately from the browser Pixel, we also send some of the same advertising events, stream_click included, to Meta directly from our own server. This is Meta’s Conversions API, server-side sharing of event data. It isn’t a browser cookie, so we tie it to the same consent rules as the Pixel, below, and it’s governed by the same Meta policy.

With these events we pass Meta its browser cookies (_fbp and _fbc) when they’re set, and a hashed form of your email when you’re signed in. Meta uses them to match the event to an ad.

8. Your consent choice

Whether Meta is on depends on where you are, which we work out from your IP address through our host, Vercel. We keep your region in a cookie so the page can show you the right control.

• In the US outside California, and in Canada outside Quebec, Meta is on until you refuse. The “Do not sell or share my personal information” link in the footer turns it off with one tap. In these regions, nothing on the site turns Meta back on, short of clearing your cookies.
• Everywhere else, California and Quebec included, and wherever we can’t tell, Meta is off until you accept it in the banner. Refusing is as easy as accepting, and you can change your mind from the “Cookies” link in the footer at any time.
• Global Privacy Control (GPC) wins everywhere.If your browser sends a GPC signal, Meta stays off whatever you chose, and we don’t show the banner.

Opting out stops new events. It doesn’t recall events already sent to Meta. Those are held under Meta’s policy. Refusing changes nothing about the music: the leaderboard, the pages, and the player all work either way.

9. Other providers

We don’t sell your personal information for money. We use a small set of providers to run the site, under contract and for that purpose alone:

• Supabase: database and sign-in.
• Vercel: hosting, and working out your region.
• Resend: sending the sign-in and Debut emails.
• Cloudflare Turnstile: telling people from bots at sign-in.
• Plausible: cookieless usage analytics.
• Sentry: error monitoring.

We may also disclose information where the law requires it, to protect the site or its users, or as part of a merger, acquisition, or sale of assets.

10. How long we keep it, and deleting your account

We keep your account information while your account is active or as long as we need it to run the site, meet legal obligations, and resolve disputes. The send log keeps its visitor keys for 60 days, as section 3 explains. To delete your account and its personal information, email hello@artist.dev. We remove or de-identify it within a reasonable period, except where the law requires us to keep something. Public results from past days may stay up in a form that no longer identifies you.

11. Your rights

Depending on where you live, you may have the right to access, correct, or delete your information, to object to or restrict some processing including advertising, and to withdraw consent. To use any of these, email hello@artist.dev. We may need to verify who you are first.

California residents.You have the right to know, delete, and correct your personal information, and not to be treated differently for using those rights. We don’t sell personal information for money, but our advertising use of Meta (above) may count as “sharing” for cross-context behavioral advertising under California law. In California, Meta is off unless you accept it, and you can refuse from the footer, with a GPC signal, or by emailing us.

EU/UK residents. Where the GDPR or UK GDPR applies, our legal bases are performance of our contract with you, our legitimate interests in security and measurement, your consent for advertising, and legal obligation. You may also complain to your local supervisory authority.

12. Children

artist.dev isn’t for children under 13, and we don’t knowingly collect their information. If you believe a child has given us information, email hello@artist.devand we’ll delete it.

13. Security and international transfers

We use reasonable measures to protect your information and rely on the established providers above. No method of transmission or storage is perfectly secure. Because sign-in is by email, protecting access to your inbox is part of protecting your account. We operate from the United States, and your information may be processed there and in other countries where our providers operate.

14. Changes

We may update this Policy. If we make material changes we’ll update the date above and may give further notice. Questions or requests? hello@artist.dev.