Privacy

This is a small site about one artist’s music. It runs no advertising and no third-party tracking of any kind, and the only analytics it keeps are its own, with nothing that identifies you attached to them. The only thing it ever asks you for is a message, and only if you choose to send one.

If you send a message

The form on the contact page asks for your name, your email address and your message. Those three things are stored in this site’s database, emailed to the address that handles enquiries here, and an automatic acknowledgement is sent back to the address you gave so you know it arrived.

Two other things are recorded alongside it. The first is your browser’s user-agent string — the line that names your browser and operating system. The second is a one-way hash of your IP address, not the address itself: the number is put through SHA-256 before anything is done with it, and the original is never written down. The hash exists so the site can tell that the same sender is submitting over and over and apply a per-hour limit, which is what keeps automated spam off the form. It cannot be turned back into your IP address.

The two cookies

This site sets two cookies, and neither one identifies you.

prowess_hiphop_session holds a token that proves a form submission came from this site rather than from somewhere pretending to be it. It is marked HttpOnly and SameSite=Lax, it is sent only over HTTPS, and it is deleted when you close your browser. It carries no identifier, it is not read by anyone else, and it is not used to follow you — there is nowhere to follow you to.

pr_theme is set only if you choose an aspect (a site style) with the switcher on your member dashboard. It holds one word — testament, firestarter or priestess — so the next page opens in the style you chose. It is SameSite=Lax, lasts a year, and holds nothing else.

What this site does not do

• No third-party analytics, ever. There is no Google Analytics, no Plausible, no Fathom, no Matomo, and nothing from any company that tracks you across other sites.
• No advertising, no tracking pixels, no fingerprinting, no third-party cookies.
• No accounts. There is nothing to sign up for and nowhere to log in.
• No mailing list. No address is collected for one, because there isn’t one.
• Nothing is sold, rented, or handed to a data broker. There is no arrangement under which that could happen.

This site’s own analytics

This site records a small number of events so the artist can tell whether her music is being heard: that a page was viewed, that a Bandcamp preview was played, that a link out to a streaming or social platform was clicked, and that the contact form was used. Nothing else is measured.

Nothing about you is recorded. There is no cookie, no localStorage entry, no browser fingerprint and no identifier of any kind attached to an event, so there is no way to tell that the same visitor came back, or to connect one event to another. What is stored per event is: which of the four things above happened, the page it happened on, which release (if it concerns one), the host only of the site that referred you here (never the page or the search terms), and the host only of an outbound link you clicked (never your own address). Your IP address and browser string are never written to the events table — not hashed, not truncated, not at all.

One thing derived from your IP address is kept, briefly, for a different purpose: to stop one sender flooding the counter, the server records a one-way keyed hash of the address, so it can count requests per minute. The key is a random value generated fresh each day and destroyed the next day. Once that key is gone, nobody — including anyone holding a copy of the database — can work out which address a hash came from, or match it to any other day. Those hashes are deleted within a day, are never joined to the events above, and the raw address itself is never written down.

This site honours Do Not Track and Global Privacy Control. If your browser sends either signal, nothing is recorded for that visit, and the server refuses the request even if it somehow arrived anyway.

Events are kept for 13 months and then deleted automatically (cli/prune-analytics.php) — long enough to compare a release’s reception across a year, not indefinitely.

Other companies your browser talks to

Two are worth naming plainly, because a policy that only describes this server would be leaving out the part you cannot see.

• Google Fonts. Every page on this site loads two typefaces from Google’s servers, which means Google receives your IP address and browser string as part of that request. This is the one unavoidable third party here. If you block it, the site falls back to fonts already on your machine and everything stays readable.
• YouTube. Video pages show a still image and a play button, not an embedded player. Nothing is requested from YouTube until you actually press play. When you do, the player loads from youtube-nocookie.com, and from that point YouTube’s own privacy policy applies to what you do inside it.

Links out to Bandcamp, Spotify, Apple Music, SoundCloud, Patreon, Instagram and the rest are ordinary links. Following one takes you to a company with its own privacy policy, and this site is not told that you went.

Like every web server, the host this site runs on keeps standard access logs — the page requested, the time, the IP address and the browser string. That is the hosting provider’s ordinary operation, not something this site collects or reads.

How long things are kept

Messages are kept until they are deleted by hand; there is no automatic expiry, and it would be dishonest to claim a retention period that nothing enforces. If you want yours removed, ask — see below. Analytics events are the one exception: they carry no way to identify you in the first place, and they are deleted automatically after 13 months regardless — see “This site’s own analytics” above.

Asking what is held, or asking for it to be deleted

You can ask what this site holds about you, ask for a copy, or ask for it to be deleted, and it will be done. The route is the contact form, or ADST Media, the enquiry route published on the press page. There is nothing to verify against and no account to prove, so say which message was yours and it will be found by the address it came from.

Children

This site is not directed at children under 13 and does not knowingly collect anything from them. If a message arrives from a child, it will be deleted.

Changes

If what the site does changes, this page changes with it, and the date below changes too. There is no mailing list to announce it on.

Last updated 2026-08-16. This page describes what the software on this site actually does, verified against the code rather than adapted from a template. It is not legal advice.