Introduction
Welcome to Matt Strout Music. We respect your privacy and are committed to protecting your personal data. This policy explains what we collect when you visit this site or create an account, why we collect it, who processes it on our behalf, and the choices you have. It describes what the site actually does today.
Information We Collect
We collect the following from visitors and account holders, and only when you give it to us or ask us to act on it. Separately, if you commented publicly on one of Matt’s posts on another platform, a copy of that comment may be held here even if you have never used this site — see “Artist Accounts on Other Platforms” below.
- Account information: Your email address, an optional display name, and a profile image if your sign-in provider supplies one. If you register with a password we store only a cryptographic hash of it, never the password itself. We also record whether your email has been verified and the date your account was created.
- Third-party sign-in data: If you sign in with Google, Spotify, or Apple, we receive the limited profile information described in the section below.
- Things you post or choose: Comments you leave on songs and blog posts, reactions and likes, and the “featured song” you pick for your profile.
- Order information: If you buy merchandise, we store your name, email address, shipping address, the items and amounts, and tracking details. See “Merchandise and payments” below for what we deliberately do not store.
- Messages and signups: The name, email address, type of enquiry, subject and message you submit through the contact form, and your email address if you subscribe to the newsletter. We do not log your IP address or browser details with contact form submissions.
- Usage and device data: If — and only if — you consent to analytics or marketing cookies, our analytics providers collect information about how you interact with the site, such as pages visited and general device and browser characteristics. Nothing in this category is collected before you make a choice.
Signing In With Another Platform
You can create an account with an email address and password, or by signing in through a third-party platform. We currently support Google, Spotify, and Apple. If we add other platforms later, the same rules in this section apply to them.
When you sign in this way, we receive only what is needed to create and identify your account:
- Google: your email address, whether that address is verified, your name, and your profile picture.
- Spotify: your email address and basic account details, including your subscription level (for example, Premium or Free) and country. We request this because Spotify playback on this site is only available to Premium accounts, and we need to know whether to offer it to you.
- Apple: your email address — which may be an Apple private relay address if you choose to hide it — and your name if you share it.
We also store the access credentials the platform issues us, so the connection keeps working without asking you to sign in repeatedly. We do not receive or store your password for any of these platforms. We do not post anything to your accounts, and we do not use platform data for advertising.
You stay in control. You can disconnect a linked platform at any time from the connected accounts section of your account settings, which deletes the profile information and access credentials we received from it. You can also revoke this site’s access from within the platform’s own account settings, which immediately stops us receiving anything further from it. To have any remaining data we received from that platform deleted, write to us at the address at the end of this policy and we will action it.
Spotify
We access your Spotify account data for two purposes only: to let you sign in to this site, and to enable playback of Matt Strout’s music in your browser while you are on the site. To do that we request permission to read your email address and basic account details, to read and control your playback state, and to stream audio through Spotify’s Web Playback SDK.
We do not use Spotify data for advertising, we do not sell it, we do not share it with third parties, and we do not build listener profiles from it. We do not modify your Spotify library, playlists, or followed artists. Playback controls act only while you are using this site.
You can disconnect Spotify at any time from the connected accounts section of your account settings, which deletes the Spotify profile information and access credentials we hold. You can also revoke this site’s access from your Spotify account settings, under Apps. If any data remains and you want it removed, write to us at the address at the end of this policy and we will action it.
Artist Accounts on Other Platforms
Matt Strout may connect his own accounts on third-party platforms — such as streaming, video, and social platforms — so that this site can display and analyse his own published content and its performance.
Where that happens, we receive the connected account’s own profile information, metadata about content published by that account — such as the post or video identifier, its caption, its link, the address of its cover image, when it was published, and its length — and aggregate engagement statistics such as view, play, like, share and comment counts. We do not copy the underlying image or video files themselves.
Comments on the artist’s posts. On some platforms, public comments left on Matt’s own posts are also collected into a private inbox so that he can read and reply to them in one place. Not every connected platform provides comments, and for those that do not, none is collected.
Where this happens we store: the comment text; the commenter’s public display name and their identifier on that platform; the web address of their public profile picture; when the comment was posted; the platform’s own identifier for the comment; which comment a reply belongs to, so conversations stay threaded; the comment’s public like count; and our own workflow state about it — whether it has been answered or dismissed and when, and whether it has been hidden or deleted. Profile pictures are stored only as a web address pointing back to the platform; we never copy or host the image itself.
This information is visible only to Matt and site administrators. It is never sold, and it is never used for advertising or to build advertising or targeting profiles. The only way information is combined across posts is a count of how many comments a person has left, shown to the artist for moderation context; that count is calculated when the page is viewed and is never stored. Administrators can search the inbox by comment text and by commenter name in order to find and respond to comments.
This data is used solely to present, analyse and respond to Matt’s own content.
Retention. If the artist disconnects a platform account, or the platform withdraws access, the stored access credentials for that platform are deleted and no further data is received from it. Records of the artist’s own published content and its statistics are retained after that point as his own business records, because they form the history of his work and remain available to him beyond the period the platform itself will serve. Copies of comments are retained so that the record of engagement with his work stays intact.
We also re-check what we have stored against the platform it came from, on a regular cycle. A comment that is still there has our copy refreshed; a comment that has been removed at the source is deleted from our records. This runs for YouTube today, and we apply the same approach on other platforms where their terms require it.
If you commented on one of Matt’s posts and want the copy held here removed, write to us at the address at the end of this policy. We honour deletion requests for personal information sourced from another platform within 7 days.
Cookies, Analytics, and Your Consent
When you first visit, a banner asks how you want to be tracked. You can Accept All, Reject All, or Customize to choose categories individually. Your choice is saved in your browser’s local storage.
Nothing in the analytics or marketing categories loads until you opt in. Both categories default to off, and no analytics or marketing script runs while the banner is still unanswered or if you reject it. The categories are:
- Necessary: Always on, and cannot be switched off. These make the site work — keeping you signed in, remembering your cart, and recording your cookie choice itself. They are not used for tracking.
- Analytics: We use PostHog to understand how the site is used so we can improve it.
- Marketing: We use the Meta Pixel to measure the effectiveness of promotion for Matt’s music and merchandise.
To change your choice later, clear this site’s stored data in your browser settings; the banner will appear again on your next visit and you can choose differently.
Merchandise and Payments
Merchandise is produced and fulfilled by Printful. When you check out, you are taken to Printful’s own checkout to complete the purchase, and your payment is handled entirely by Printful and its payment processors.
We never receive or store your card number or other payment credentials. What we store is the order record Printful returns to us: your name, email address, shipping address, the items ordered, the amounts, and shipment tracking details, so that we can show you your order history and answer questions about it.
How We Use Your Information
We use the information we collect to:
- Create and secure your account, and sign you in
- Enable playback of Matt’s music, including through a connected Spotify account
- Publish the comments, reactions, and profile choices you make
- Process and support merchandise orders, and show you your order history
- Respond to messages you send us
- Send newsletters and release news, if you have asked for them
- Understand and improve how the site is used, where you have consented
Who Processes Your Data
We do not sell, trade, or rent your personal information. We share it only with the service providers who operate this site on our behalf, each limited to what their function requires:
- Vercel — website hosting and delivery
- Supabase — database and file storage
- Printful — merchandise production, fulfilment, and checkout
- PostHog — product analytics, only with your consent
- Meta — marketing measurement, only with your consent
- An email delivery provider — to send the messages you request or that your account requires, such as email verification, password resets, newsletter confirmations, and replies to your enquiries
- Google, Spotify, and Apple — where you choose to sign in through them
We may also disclose information where the law requires it, or to protect our rights, safety, or property.
How Long We Keep It
- Account data is kept while your account is open, and deleted when you ask us to close it.
- Comments and reactions remain published until you or we remove them, or your account is deleted.
- Order records are kept for as long as needed to support the order and to meet accounting and tax obligations, which may extend beyond the life of your account.
- Contact messages are kept for as long as needed to handle your enquiry and any follow-up.
- Newsletter subscriptions are kept until you unsubscribe.
- Sign-in platform data is deleted when you ask us to remove it, and no further data is received once you revoke access at the platform.
- The artist’s own platform content and statistics are retained as business records after a platform is disconnected. Comments collected from those posts are retained until deletion is requested — see “Artist Accounts on Other Platforms” above.
Data Security
We implement appropriate security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Passwords are stored only as cryptographic hashes, and traffic to this site is encrypted in transit. However, no method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.
Children’s Privacy
This site is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us with personal information, please contact us at the address below and we will delete it.
Where Your Data Is Processed
This site is operated from the United States, and the service providers listed above process and store data in the United States and other countries where they operate. If you access the site from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those in your country.
Your Rights
You have the right to:
- Access the personal information we hold about you
- Request correction of inaccurate information
- Request deletion of your personal information
- Request deletion of data we received from a connected platform such as Google, Spotify, or Apple, and revoke that platform’s access at any time from the platform itself
- Opt-out of marketing communications at any time
- Withdraw consent where we rely on consent to process your data
To exercise any of these rights, write to us at the address below. We will respond within a reasonable period.
Contact Us
If you have any questions about this Privacy Policy or our data practices, or wish to make a request about your data, please contact us at:
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the “Last updated” date.