the purple life — Privacy Policy
**Last updated:** October 28, 2026 **Operator:** Artificially Limited Music LLC **Contact:** [email protected] **Related policy:** [Terms of Service](/terms-of-service) · [Accessibility](/accessibility) ## 1. Introduction and scope This Privacy Policy explains how Artificially Limited Music LLC ("we," "us," or "our") handles information when you visit or use **the.purple.life** (the "Site"). This policy applies to **public visitors** who browse the catalog, play audio, download releases where enabled, search the Site, view statistics or leaderboard pages, subscribe to optional push notifications, use syndicated feeds, public API discovery surfaces, or other machine-readable exports where published, and read custom pages such as this one. It also describes **authorized administrators** who sign in to the Site's admin area. Admin authentication is separate from public browsing and uses account credentials managed through our hosting and database provider. The public site name may appear as **the.purple.life** or as configured in site settings (for example, a custom SEO title). Those names refer to the same service. ## 2. Information we collect ### 2.1 First-party analytics (consent required) We operate **first-party analytics** on the Site. We do not use third-party advertising or marketing analytics networks (such as Google Analytics) in the current implementation. **Analytics tracking runs only after you choose Accept** in the Site's cookie consent banner **and** the Site successfully records that choice on the server (setting the consent cookie and analytics session). If Accept cannot be saved (for example, a temporary network error), the banner remains available and we do not treat consent as granted. If you choose **Decline**, we do not record analytics events for your browser session, and server-side download analytics are not stored for that session. When consent is granted, our platform may record **analytics events** that describe how resources are viewed, played, or downloaded. Events may include: | Event type | When it is generally recorded | | --- | --- | | `session_start` | A new analytics session begins after consent is granted | | `impression` | A resource card stays visible (about 25% of the card for about 1 second). Recorded once per session for that card placement, and separate from a page view | | `page_viewed` | A public page is viewed after consent, including songs, releases, artists, record labels, and other site pages. Recorded once per page. Pages that are not a specific catalog resource are stored as `site`, with the path | | `resource_click` | You open a catalog resource from a card, list, or similar control | | `resource_action_click` | You use an in-context action on a resource (for example, play, queue, share, or download controls) | | `external_platform_click` | You follow an outbound link to an external platform from a resource | | `share_click` | You use a share action for a resource | | `play_start` | Audio playback begins for a track | | `qualified_stream` | Playback reaches sustained listening (generally **30 seconds or more**) for a track. Those streams may also be credited to a parent album, EP, or double single when that release includes the track | | `play_progress` | Playback reaches progress milestones (such as 50% or 75%) | | `play_complete` | Playback reaches a high completion milestone (such as 95%) | | `skip` | Playback stops or is paused early (generally before **10 seconds**) | | `download` | A song download is served when downloads are enabled | | `zip_download` | A double single, album or EP ZIP download is served when downloads are enabled | | `radio_tune_in` | You tune in to the public radio experience | Events are associated with a **resource type** such as `song`, `single`, `double_single`, `album`, `ep`, `page`, `site`, `artist`, or `record_label`, and often with an internal resource identifier (UUID). Playback-related events may also include seconds listened, progress percentage, and track duration. ### 2.2 Browser session identifier To group activity within a browser without asking you to create an account, the Site issues a random **session identifier** after you grant analytics consent. That identifier is stored in an **httpOnly cookie** named `tpl.analytics.session` (with a companion freshness cookie) and is sent with analytics events. It is used for counting and deduplication, not to display your name on the Site. Admin reporting counts each consented session once for the time it is active, including when that session views or plays more than one resource. The session count is not limited to playback. Analytics sessions expire after a period of inactivity (currently **30 minutes**), after which a new session may begin if you continue browsing with consent granted. ### 2.3 Analytics consent choice The Site stores your analytics consent choice as: - **`tpl.analytics.consent`** in your browser's **local storage** (client-side mirror used by the public interface to decide whether to send events and whether to show the banner) - **`tpl.analytics.consent`** as an **httpOnly cookie** (server-side enforcement; event ingest and download analytics require this cookie to be `granted`) Both stores are updated together when Accept or Decline succeeds. Local storage alone is **not** enough for tracking: the server rejects analytics events without a valid consent cookie and session. If your local mirror says Accept but the consent cookie is missing, the Site may try to restore consent with the server or clear the mirror so the banner can ask again. Accepted values are `granted` or `denied`. Until you make a successful choice, the consent banner remains available and analytics events are not recorded. You can reopen the consent control from the cookie icon shown after you minimize the banner, or clear cookies and local storage in your browser settings to reset your choice. ### 2.4 Technical and attribution data When analytics consent is granted, analytics events and related server processing may include: - The **path** you visited on the Site - **Referrer** information when your browser provides it - **UTM** or similar campaign parameters when present in the URL (for example, `utm_source`, `utm_medium`, `utm_campaign`, or `ref`) - **Timestamps** for when activity occurred The server may inspect the request **user agent** only to filter common bots and crawlers from analytics storage. That user agent string is **not** stored as a field on analytics event rows in the current implementation. ### 2.5 Downloads and server-side activity Some download activity is recorded **on the server** when a download endpoint serves a file. Those records use the same analytics system and are stored **only when analytics consent is granted** and a valid analytics session cookie is present. They may not include every browser field available to client-side events. ### 2.6 Rate limiting (ephemeral IP use) To reduce abuse, the Site may apply **rate limits** using an IP address derived from request headers (such as `x-forwarded-for`). That value is used **in memory** for short-lived throttling and is **not** stored in our analytics event tables as a standing identifier. ### 2.7 Automated traffic Requests that appear to come from common **bots or crawlers** (based on user agent patterns) may be excluded from analytics storage even if the HTTP request succeeds. ### 2.8 Qualified stream deduplication To avoid inflating counts from repeated signals in a short period, **qualified stream** events may be deduplicated per session and resource within a short window (on the order of **five minutes**). ### 2.9 Optional push notifications If your browser supports web push and you choose to subscribe from the Site header, we store a **push subscription** tied to your browser's push endpoint and encryption keys (`p256dh` and `auth`). We use this information only to send optional notifications about topics you subscribe to (currently **new releases**). Push subscriptions are separate from analytics consent. Subscribing requires your browser's notification permission. You can unsubscribe at any time from the same header control, which removes the subscription from our database and from your browser. We do not use push subscriptions to identify you by name, and we do not sell subscription data. ### 2.10 Platform session and radio listener presence Some product features use a separate **platform session identifier** that does not depend on analytics consent. The Site may store a random identifier in your browser's **local storage** under the key `tpl.platform.session`. When you tune in to **global radio**, the Site may send that identifier (stored on our servers only as a **one-way hash**) with `tune_in`, `heartbeat`, and `sign_off` signals so we can maintain an approximate **live listener count**. Those records include timestamps such as `last_seen_at`, are used for operational display (for example, “listening live” in the header), and are separate from the analytics event tables described above. Radio listener presence is **not** used to publish your name or create a public visitor profile. Stale listener records are removed during routine maintenance (generally within about **24 hours** of inactivity). ### 2.11 Search The Site provides catalog and page **search**. Search requests are processed to return results and may be **rate limited** using an IP address derived from request headers. We do **not** store your search queries in our analytics tables as part of the current implementation. ### 2.12 Syndicated feeds, public API discovery, and machine-readable exports The Site may publish public discovery and export surfaces for released catalog content and site information we have already made available on the public Site, including: - **RSS/JSON feeds** and the public **sitemap** - Agent and LLM discovery files such as **`/llms.txt`**, **`/llms-full.txt`**, and **`/agent.txt`** - An **OpenAPI** description at **`/openapi.json`** and a human-readable API reference at **`/developers`** - Documented **public REST** endpoints under **`/api/v1/`** for uses such as health checks, catalog search, and radio status - **Markdown** exports of public pages such as lyrics and release backstories (for example via `Accept: text/markdown` or `.md` URLs), where offered Those surfaces expose information we have already published on the public Site. They do not require you to identify yourself, and they do not record visitor-specific profiles in the current implementation. Some live HTTP endpoints used by the Site itself (for example first-party analytics ingest, personal or display stats plumbing, and internal asset streaming) are **not** part of the documented public API reference. Rate limiting and abuse controls may still apply to public and operational endpoints as described in this policy. ### 2.13 Authorized administrators If you are an authorized admin user, our authentication provider may set **cookies** needed to maintain your admin session, protect admin routes, and refresh access tokens. Admin sign-in is limited to the admin area and is not required for ordinary listening or browsing. We process admin account information (such as email and authentication identifiers) to operate the admin interface, not to build a public social profile for visitors. ## 3. Information we do not collect from typical visitors For ordinary public use of the Site, we do **not** require you to create a visitor account, and we do **not** ask for your name, postal address, or payment details to browse or play music. We do **not** intentionally collect government ID numbers, precise geolocation, or contact details from public visitors through the analytics flows described above. If you email us at [email protected], we will receive whatever information you choose to include in your message. ## 4. How we use information We use the information described in this policy to: - Operate, maintain, and secure the Site - Deliver audio, artwork, lyrics, downloads, and pages - Measure engagement with songs, singles, albums, EPs, artists, record labels, and site pages (when consent is granted) - Produce **aggregated statistics** for admin reporting - Power **public-facing** presentations such as resource stream/download counts, leaderboard rankings, certification displays, recently played activity feeds, and approximate live radio listener counts - Understand traffic sources at an aggregate level (for example, referrer or campaign tags) - Send optional push notifications about new releases when you subscribe - Prevent abuse, enforce rate limits, and improve reliability If the Site is unavailable, suspended, or discontinued, related processing may pause or end along with the service, as described in our [Terms of Service](/terms-of-service). ## 5. How we share information We use service providers to host and operate the Site, including: - A **hosting** provider for the web application (for example, a serverless or edge platform) - **Supabase** (or equivalent) for database and authentication (admin) behind our application - **Cloudflare R2** (or equivalent object storage) for file storage such as artwork, audio, downloads, and site assets These providers process information on our behalf to run the Site. We do not sell visitor personal information. We do not share analytics event data with third-party advertisers in the current implementation. When you follow **outbound links** to third-party platforms (for example, streaming services, social profiles, or artist websites), those destinations are operated by third parties under their own policies. Some outbound links on release profiles may be counted in analytics when consent is granted; other links (such as footer social icons or artist/label profile links) are not tracked as analytics events in the current implementation. We may disclose information if required by law, legal process, or governmental request, or when we believe disclosure is necessary to protect rights, safety, security, or the integrity of the Site. ## 6. Cookies, local storage, and service workers **Public visitors** - **Local storage:** analytics consent mirror (`tpl.analytics.consent`); platform session identifier (`tpl.platform.session`) for radio presence; theme preference (`tpl.theme`); when used, player session state (`tpl.player-session`) containing queue and playback preferences; and optional **fan badge progress** (`tpl.fan-badges.v1`), plus device-local import/export cooldown timestamps (`tpl.fan-badges.export-cooldown`, `tpl.fan-badges.import-cooldown`), for device-local achievements (see below) - **Session storage:** player session state may also be mirrored in session storage for the same key when the player is active - **Cookies (httpOnly):** analytics consent (`tpl.analytics.consent`) and, after consent is granted, analytics session (`tpl.analytics.session` and a companion freshness cookie) - **Service worker:** if you subscribe to push notifications, the Site registers `/sw.js` in your browser to receive push messages for new releases - **Installable web app:** the Site may expose a web app manifest so supported browsers can install or pin the Site; installation itself does not create a visitor account - The Site does not rely on third-party marketing cookies for public analytics in the current implementation **Fan badges (optional, device-local)** Optional fan badges and titles may be calculated and stored only on your device under `tpl.fan-badges.v1`. Badge progress is not sent to our servers, is not used for public stats, certifications, leaderboards, or analytics, and is not synced across devices unless you manually export and import a progress file. You can reset progress from the public Badges page (`/badges`) or by clearing site local storage in your browser. We may use local storage to let you collect optional fan badges, import/export badge progress, and generate share images on your device. This badge data is not sent to us unless you separately share it with us or use a future feature that asks for permission. Badge share images are generated locally in your browser. Import and export are each limited to once every 10 minutes per device to keep badge collecting personal; those cooldown timestamps are stored locally and are not sent to us. **Authorized administrators** - **Cookies** set by our authentication stack for admin login and session management You can clear local storage and cookies in your browser settings. Clearing analytics cookies and consent storage resets your consent choice and prevents further analytics recording until you choose again. Unsubscribing from push notifications or revoking browser notification permission stops future push delivery. ## 7. Your choices - **Analytics:** choose **Accept** or **Decline** in the cookie consent banner. Declining means we do not record analytics events for your browser under the flows described in this policy. - **Push notifications:** optional. Subscribe or unsubscribe from the notifications control in the Site header when your browser supports web push. - **Browser controls:** you may block cookies, clear storage, disable notifications, or unregister service workers through your browser settings. - **Fan badges:** optional device-local achievements at `/badges`. Export, import, reset progress, or generate a local share image on that page. Clearing site local storage also removes badge progress. Share images are created in your browser and are not uploaded. ## 8. Public visibility of activity The Site presents **aggregate** and **non-personal** views of usage, including: - Stream and download counts on catalog resources - Leaderboard rankings and related performance metrics derived from listening and download activity - Certification displays derived from aggregate listening and download thresholds - An approximate **live radio listener count** derived from recent radio presence signals - A **recently played** presentation that shows release titles, artist names, artwork, and timestamps derived from recent **site-wide** listening activity (qualified streams after sustained listening, generally **30 seconds or more**). It is **not** a personal history for your device. The public feed may lag by a few minutes because of caching and periodic refresh. These features are not a real-name social network. They do not publish your email address or visitor account profile (because public visitor accounts are not offered). Activity from visitors who decline analytics consent is not included in these aggregates through the analytics flows described here. ## 9. Retention We retain analytics and operational data for as long as needed to operate the Site, produce aggregates, maintain security, and comply with legal obligations. Aggregated statistics (for example, daily rollups used for dashboards and public counts) may be kept after underlying raw events are deleted or trimmed, consistent with our operational practices and any future data-retention policy. Push subscription records are retained until you unsubscribe, your browser endpoint becomes invalid, or we remove stale subscriptions during routine maintenance. Radio listener presence records are retained only as long as needed to show approximate live listener counts and are removed when stale, generally within about **24 hours** of inactivity. ## 10. Security We use reasonable administrative, technical, and organizational measures designed to protect information processed through the Site. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. ## 11. Children's privacy The Site is not directed to children under **13**, and we do not knowingly collect personal information from children under 13 through the public analytics flows described here. If you believe a child has provided personal information to us, contact [email protected] and we will take appropriate steps to delete it where required. ## 12. International visitors If you access the Site from outside the United States, your information may be processed in the United States and in regions where our hosting and database providers operate. Those locations may have different data protection laws than your home country. ## 13. Changes to this policy We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above and, where appropriate, provide additional notice on the Site. Your continued use of the Site after changes become effective means you accept the updated policy. ## 14. Contact Privacy questions or requests: **Email:** [email protected] Privacy Policy outlining the privacy details for the.purple.life. the purple life — Privacy Policy Privacy Policy outlining the privacy details for the.purple.life. the purple life offers free music streaming, downloads, lyrics, and release stories. Explore the catalog, discography, FAQs, about, contact, and privacy pages for more. About the purple life: this site is a free music sharing and discovery experience for a single AI-assisted digital music artist project released by Artificially Limited Music LLC. Visitors can stream in the browser, tune into global radio with an approximate live listener count, read synchronized lyrics where published, open release backstories, and download enabled MP3 or ZIP packages for personal non-commercial listening and archival. Public aggregate stats, certifications, leaderboards, and a recently played strip summarize site-wide listening after analytics consent is granted through the cookie banner. Optional web push notifications cover new releases when the browser supports them. Fan badges and titles stay device-local in browser storage, are not uploaded to our servers, and are not used for public stats. Administrative tools are separate and require authorized sign-in. The catalog is intentionally single-artist: songs, singles, double singles, EPs, and albums attributed to the purple life with associated artist and record label profile pages when published. Agents should start at /developers and /openapi.json for the public REST schema. Authentication is not required for documented public /api/v1 routes — verify with GET /api/v1/health (no API key, no Authorization header). Use GET /api/v1/search?q= for catalog search and GET /api/v1/radio/status for the live station. Per-endpoint docs live at /developers/{handle} with Markdown and JSON exports. Prefer Accept: text/markdown or .md URLs for lyrics and backstories. Public /api/v1 routes are rate-limited per client IP and endpoint scope; on HTTP 429 honor the Retry-After header (seconds) and do not retry sooner (error.code rate_limited). Contact [email protected] for product questions. Do not scrape admin areas, authenticated APIs, or download endpoints in bulk. the purple life is released by Artificially Limited Music LLC and publishes original music only by the purple life (single-artist catalog): singles, double singles, EPs, and albums with public streaming, free downloads where enabled, synchronized lyrics, and release backstories. Use /llms.txt and /llms-full.txt for catalog discovery indexes, /agent.txt for when-to-use guidance, and /sitemap for human-readable navigation. JSON API errors use the shape { error: { code, message, hint? } }. Public API versioning uses the /api/v1 path prefix; breaking changes ship under a new path version. Deprecated operations are marked in OpenAPI and on their /developers pages. Policies and trust pages: Privacy Policy at /privacy explains first-party analytics consent, cookies, local storage, push subscriptions, radio presence hashing, rate limiting, and public API discovery surfaces such as /openapi.json, /developers, /llms.txt, and Markdown exports. Terms of Service at /terms-of-service cover permitted use of the catalog, downloads, documented public API endpoints, and prohibited abuse of private or undocumented surfaces. Accessibility at /accessibility describes keyboard access, visible focus, reduced motion preferences, synced lyrics live regions, and feedback via [email protected]. FAQs at /faqs answer common listener questions about streaming, downloads, radio, and consent. Brand guidelines at /brand document logos, typography, and colors for the purple life. Sitemap at /sitemap lists human-readable navigation plus discovery files for agents. Catalog discovery: browse /catalog for songs, singles, EPs, and albums; /discography for a release-oriented index; /artists and /labels for entity profiles; /leaderboard and /certifications for aggregate listening milestones; /search for catalog and page search; /badges for optional device-local fan achievements. Each released catalog resource page can export Markdown (Accept: text/markdown or .md) for lyrics and backstories, and many also expose .json for structured metadata. RSS and JSON feeds plus /sitemap.xml help syndication. Do not treat admin URLs, private download scrape loops, or undocumented operational endpoints as part of the public agent surface.
