Privacy policy.

01 About Amper

Amper is developed by Argentum Group, an independent, unregistered group of developers based in Sarajevo, Bosnia and Herzegovina. Argentum Group is the group’s working name, not a registered company.

In this notice, “we” refers to the developers operating this website. You can reach us about privacy at getamper.support@gmail.com.

This notice covers ampertones.com, www.ampertones.com, api.ampertones.com and the same website on its Sites hosting address. The Android app is still in development; see the app section for the boundary between website visits and app use.

02 Information we use

When you browse

Your browser sends technical information needed to request a page or asset, including your IP address, browser information, the requested URL and request time. Hosting and security services process request information to deliver the website and protect it against abuse.

Our fonts load from Google Fonts, so your browser also contacts Google to request font resources. This sends connection information such as your IP address and browser information to Google. Our scripts and showcase images are served from the site’s own address. Album artwork in the web studio loads directly from Apple Music’s image service and artist-operated image services. Those services receive connection information such as your IP address and browser information when the images load. We omit the page referrer from artwork requests. Artwork source links are shown on song details.

When you contact us

If you email us, we receive your email address, the name your email service provides, your message and any attachments you choose to send. We use these to respond and investigate the issue you describe. Please do not send passwords, verification codes or payment card details.

Browser storage

If you dismiss our cookie information notice, we store that choice in your browser so it does not appear on every page. That acknowledgement is not consent to analytics or advertising. If you add equipment in the public web studio, its catalog identifiers are saved in your browser to remember your guest collection. Guest equipment stays in this browser. When signed in, changes to My gear are saved to your account; the guest collection is not automatically uploaded. You can remove equipment in My gear or clear the site's browser storage. See our cookie information for storage names and controls.

Your account and studio

When you create an account or sign in, we process your email address, account identifier, confirmation status and session information. Your password passes securely through the Amper API to our authentication provider; we do not write it to application logs or store it as plain text. Authenticator setup and recovery codes, where enabled, support account security.

We store the equipment you select while signed in, your song and part selections for matches, generated settings and explanations, saved status, names, refinements, usage allowance and equipment requests. Matching uses the equipment and song information you select. The web studio does not record your microphone or upload audio.

Account data is held centrally: compatible clients signed into the same hosted Amper account use the same saved gear, tones and allowance. This does not automatically transfer browser-only guest gear or local development-app data. The initial song order is an editorial selection of familiar songs; it is not personalised from your browsing history or calculated from visitor tracking.

Recovery backups

We schedule daily backups of the application and account database, including saved gear, tones, usage records and authentication records such as password hashes. GitHub Actions temporarily processes readable database records to export them and test a restore in an isolated environment. It then encrypts the backup before uploading it to private backup storage. The decryption key is kept separately from GitHub. These backups support recovery after data loss; they are not used for advertising.

Account protection

We use request information and expiring counters to limit abuse. Authentication security events use keyed hashes of IP addresses and account identifiers. Cloudflare Turnstile may process browser and device signals when a security check is needed. When creating or resetting a password, our server checks known breaches using the first five characters of a password hash; the password, full hash and your email address are not sent to that breach-check service.

Links to other services

Instagram links take you to Instagram, where its own privacy practices apply. Email links open your email application; opening a draft does not send a message. These links are not embedded social feeds or automatic email submissions.

03 Why we use it

• Providing the studio you request: account, gear and tone information lets us sign you in, produce settings, keep your history and apply your allowance. We process it to provide the service you choose to use.
• Delivering and protecting the site: technical request information supports page delivery, availability and abuse prevention. Our basis is the legitimate interest in providing a functioning, secure website.
• Responding to you: correspondence lets us answer enquiries and resolve support issues. Our basis is the legitimate interest in handling messages you choose to send.
• Recovering the service: backups and isolated restore checks support our legitimate interest in protecting account data against accidental loss and restoring a working service.
• Remembering the notice: browser storage records your explicit request to dismiss the information notice.
• Meeting legal requirements: information may be used or disclosed where required by an applicable legal obligation.

We do not sell personal information, build advertising profiles, or make automated decisions with legal or similarly significant effects through the web studio. Visiting the site does not constitute blanket consent to unrelated processing.

04 Service providers

The current website uses these services:

Selected European hosting regions do not mean every processing operation stays in Europe. These providers operate internationally, so information may be processed outside Bosnia and Herzegovina, including in the United States and other countries where they operate. Their linked notices explain their processing arrangements. Contact us for information about the arrangements applicable to your data; this notice does not mean you consent to an international transfer.

We may also disclose information when legally required, or where necessary to establish, exercise or defend legal claims. We do not publish support messages as testimonials without permission.

05 Keeping information

Your account, saved gear and tone history remain while your account is active or until you request deletion. My account lets you export tone history and request account deletion. Deletion removes your identity and associated records from the live service; a temporary revocation record prevents old sessions from being reused. Some operational, provider or backup records may remain for security, legal obligations or their applicable retention cycle.

Scheduled cleanup

Session and verification records expire even before their database rows are removed. Our daily maintenance job is configured to remove expired verification challenges, sessions and unfinished authenticator setups; reward-session records more than one day after expiry; optional app analytics events older than 30 days; security audit events older than 90 days; and temporary account-deletion records older than one day. The web studio does not send optional analytics events or offer rewarded ads. Expiring rate-limit counters clear automatically.

These are cleanup thresholds, not promises that every row disappears at an exact time. The job runs after a successful backup and may be delayed or stopped by a service failure or safety check. Active accounts, enabled security settings, saved gear and tones are not removed by this routine.

Backup retention and deletion

Automated encrypted backup files in GitHub are configured for seven days of retention. Deleted live data may remain in a containing backup until that backup expires. A downloaded encrypted recovery-test copy is also held in restricted local storage; GitHub’s automatic expiry does not delete downloaded copies. We review separately held recovery copies when handling a deletion request and retain them only while needed for recovery verification or a specific legal obligation.

Before returning a restored database to service, we reconcile account deletions made after the backup so deleted accounts are not silently restored. Provider-managed operational records may have separate retention arrangements. Contact us for the status of a deletion request or information about retained recovery copies.

Support correspondence is kept for handling the enquiry and any related follow-up, dispute or legal obligation. Retention depends on the purpose and whether the matter remains open; you can ask us to review or delete correspondence using the contact details below.

The cookie-notice acknowledgement is used for up to 180 days and is then removed on your next visit. You can clear it sooner. Hosting and security records are managed by the relevant providers under their service arrangements; the 180-day browser-storage period does not apply to those records.

We use HTTPS for website delivery. No internet service or email channel can be guaranteed completely secure, so please limit the personal information you send to what your enquiry needs.

06 Your rights

Depending on the applicable law and circumstances, you may request access, correction, deletion, restriction or portability of your personal information, and object to processing based on legitimate interests. If processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Email getamper.support@gmail.com with your request. We may ask for proportionate information to verify your identity. Please do not send an identity document unless we explain why it is needed and how to provide it safely.

We will respond within the applicable legal timeframe and explain any permitted extension. You may complain to the Agency for Personal Data Protection in Bosnia and Herzegovina, or another competent supervisory authority where applicable. You do not have to contact us first to exercise that right.

07 The Android app

The website includes a showcase and a web studio. Reference tones are stored examples; signed-in matching adapts a selected song part to your chosen equipment. Browsing alone does not create an account, upload guest gear, start a subscription or display an in-app advertisement. The web studio offers no checkout or rewarded ads. Development builds that use the same Amper account may share its identity, but locally saved development data is not automatically migrated into the hosted studio.

The Android app is still being developed. Its account, saved-gear, tone-history and optional analytics features involve different information from website visits. Planned subscriptions and rewarded ads also require their own disclosures and controls before launch.

This website notice is not a complete privacy notice for a released Android app. App privacy information will be updated to match the features and providers actually offered. If you are testing a development build, contact us for information about that build before providing personal information.

08 Updates & contact

We will revise this notice as the website changes and update the date above. Material changes to how information is used will be explained through a visible notice or another appropriate channel before they apply where required.