Last updated: November 3, 2026
Amp Frontier Corporation (“Amp,” “we,” “our,” or “us”) provides AI coding tools, our website at ampcode.com, our documentation and related services (together, the “Services”). This privacy policy (this “Privacy Policy”) explains what personal information we collect, how we use and disclose it, how long we keep it, and the choices and rights you have.
If you are a California resident, Section 9 (Your California Privacy Rights) describes your rights under the California Consumer Privacy Act, as amended (the “CCPA”). Capitalized terms not defined here have the meanings in our Terms of Service.
2.1 We do not sell your personal information for money.
2.2 We do share limited personal information with Google, Meta, LinkedIn, X and Reddit through advertising pixels on our website and by reporting conversion events to them from our servers, so we can measure our ads and show Amp ads to you on other sites. Under California law this is “sharing” for cross-context behavioral advertising.
2.3 You can opt out of this sharing at any time through the “Your Privacy Choices” link, which visitors outside the EEA, the UK and Switzerland see in the footer of every page of our website, including our documentation, or by turning on Global Privacy Control (“GPC”) in your browser. We honor GPC automatically. Opting out stops the advertising pixels; GPC also stops our own analytics cookies.
2.4 Our own website analytics are first-party only and are not shared with advertising companies.
2.5 For visitors from the European Economic Area, the United Kingdom and Switzerland, and visitors whose location we cannot determine, we do not use analytics or advertising cookies or tags on our website. We keep only an anonymous count of page loads with the country, with no cookie or ID.
2.6 You can ask to know, delete or correct your personal information by emailing privacy@ampcode.com.
“Personal information” means information that identifies, relates to, describes, or could reasonably be linked with you or your household, including online identifiers such as cookie IDs and advertising IDs. We collect the following categories of personal information.
| Category | Examples | Sources |
|---|---|---|
| Identifiers | Name, username, email address, account ID, display name, IP address, visitor ID and session ID cookies, advertising cookie IDs set by Google, Meta, LinkedIn, X and Reddit, ad click IDs, a hashed version of your email address, third-party login user ID | You; your browser or device; login providers you connect; advertising partners |
| Customer records and commercial information | Subscription plan, billing history, sales inquiry details, signup and purchase events. Payment card details are collected and stored by our payment processor, not by Amp | You; our payment processor |
| Internet and network activity | Pages viewed and how you use our website, such as the buttons and links you click, page path, referring site, UTM campaign tags, ad clicks and conversions, browser and device type, browser window width, log data, error data, feature usage events, email open and click data | Your browser or device; our servers; advertising partners |
| Approximate location | Country or general area, derived from IP address. We do not collect precise geolocation | Your browser or device |
| Inferences | Interest or audience segments that Google, Meta, LinkedIn, X and Reddit may associate with your browser for showing Amp ads | Advertising partners |
| Professional information | Company name, role and Organization membership | You; your Organization administrator |
| Content you submit | Prompts, code and files you submit to the Services, repository names, feedback, comments and correspondence | You |
| Account login credentials (sensitive personal information) | Username or email in combination with a password or passkey | You |
What we do not collect. Amp does not intentionally collect other sensitive personal information, such as government ID numbers, health information, precise geolocation, or information about racial or ethnic origin, religious beliefs or union membership. Personal information that appears in code or repositories you submit is processed only to provide the Services to you and is never shared with advertising partners.
On our public website (for example, our home, marketing, documentation, pricing and signup pages), we measure how visitors use the site, for example the pages they view, how they move between pages, and the buttons and links they click. We record the page path, the external referring site without query strings, UTM campaign tags, your country, which we derive from your IP address without storing it, the label and destination of a button or link you click, and technical details such as your browser window width. On pages whose address contains a private identifier, such as shared thread and gift code pages, we do not record that identifier. Our own analytics do not record your IP address, your browser user agent, anything you type into forms, or other URL parameters. This data is stored on our own servers and in our cloud data warehouse, operated by our cloud provider as our service provider, and is not sent to any analytics or advertising company. Outside the EEA, the UK and Switzerland these analytics run by default; a GPC signal turns them off (see Section 4.4).
Outside the EEA, the UK and Switzerland, if you create an Amp account, we link your analytics visitor ID to your new account so we can understand which pages led to signup, and if you use our public website while signed in, we record that activity with your account so we can understand how customers use our website and documentation. Activity linked to your account, including your earlier website activity, becomes part of your account information and is covered by your rights to know and delete. If you delete your account, we delete this linked activity.
Signup attribution. When you visit our website without being signed in, we may also set first-party cookies that remember how you arrived at our website, such as the referring site and campaign tags. If you create an account, we save this information with your account so we can see which campaigns lead to signups, and we delete it when you delete your account. We do not set these cookies in the EEA, the UK or Switzerland, or if your browser sends a GPC signal.
We use advertising pixels and tags from Google (the Google tag, for Google Ads conversion tracking and remarketing), Meta (the Meta Pixel), LinkedIn (the LinkedIn Insight Tag), X (the X Pixel) and Reddit (the Reddit Pixel). When you visit our website, these tools may collect your IP address, browser and device information, cookie and advertising IDs, the pages you view, and actions you take such as signing up. Google, Meta, LinkedIn, X and Reddit may combine this information with other information they hold about you, and use it to measure our ads and to show you Amp ads on their platforms and other websites. Their use of this information is governed by their own privacy policies:
Conversion events reported from our servers. We also report conversions to these partners directly from our servers (the partners call this enhanced conversions, advanced matching or a conversions API) when you take actions such as signing up, first using Amp, making a purchase (including the amount), creating a workspace or contacting sales. Some of these events happen while you are signed in to the Services. With each event we may send a hashed version of your email address, ad click identifiers, your IP address, browser information and the value of partner cookies such as Meta’s _fbp. We do not send content you submit to the Services, such as code, prompts or thread content, or anything you type into forms other than the sales inquiry itself, and we do not report events for a browser or account that has opted out or sent a GPC signal.
Where these tags run. We load advertising pixels on our public website, for example our home, pricing and documentation pages, for visitors who are not signed in. We do not load them inside the signed-in Services or on websites we host for enterprise customers under their own domain names.
Our advertising partners may also set or read cookies on their own domains under their own policies, for example Meta’s fr cookie, LinkedIn’s bcookie, lidc and UserMatchHistory cookies, and X’s personalization_id, muc_ads and guest_id cookies. Cookie names and lifetimes set by our partners are controlled by them and may change; the table below reflects their published information at the date of this policy.
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| Authentication and security cookies | Amp | Keep you signed in and protect the Services | Session or as set for login | Strictly necessary |
| Visitor ID (amp_vid) | Amp | Count returning visitors and measure signups | Up to 13 months | First-party analytics |
| Session ID (amp_sid) | Amp | Group page views from a single visit | 30 minutes of inactivity | First-party analytics |
| Signup attribution (amp_attr_first, amp_attr_last) | Amp | Remember how you arrived at our website, to measure which campaigns lead to signups | Up to 180 days | First-party analytics |
| Advertising opt-out (amp_advertising_consent) | Amp | Remember that you opted out through “Your Privacy Choices” | Up to 13 months, renewed on each visit | Strictly necessary |
| Time zone (amp-time-zone) | Amp | Show dates and times in your time zone | Up to 1 year | Strictly necessary |
| Ad click ID (amp_ad_click) | Amp | Remember the ad click ID from the ad you clicked, so we can report a later signup or purchase to that ad’s platform | Up to 90 days | Advertising |
| Google tag cookies (such as _gcl_au, _gcl_aw and other _gcl_ cookies) | Ad conversion measurement and remarketing | Up to 90 days | Advertising | |
| Meta Pixel cookies (such as _fbp and _fbc) | Meta | Ad conversion measurement and remarketing | Up to 90 days | Advertising |
| LinkedIn Insight Tag cookies (such as li_fat_id and li_giant) | Ad conversion measurement and remarketing | li_fat_id: up to 30 days; li_giant: up to 7 days | Advertising | |
| X Pixel cookies (such as _twclid) | X | Ad conversion measurement and remarketing | Up to 30 days from the ad click | Advertising |
| Reddit Pixel cookies (such as _rdt_uuid, and _rdt_cid when you arrive from a Reddit ad) | Ad conversion measurement and remarketing | Up to 90 days | Advertising |
We do not set the first-party analytics or advertising cookies in this table, or load the advertising tags, for visitors in the EEA, the UK and Switzerland, or for visitors whose location we cannot determine (see Section 4.4.2).
4.4.1 Visitors outside the EEA, UK and Switzerland. Our first-party analytics and advertising pixels run by default unless you opt out as described below, and we link your website activity to your account when you sign up or use our website while signed in. If you opt out through “Your Privacy Choices” or your browser sends a GPC signal, we stop loading advertising pixels in that browser (they do not load at all) and stop reporting conversion events from our servers for that browser and, if you are signed in, for your account, so we no longer use your information for sharing. Opting out through “Your Privacy Choices” does not turn off our own first-party analytics, which we never share with advertising partners. If your browser sends a GPC signal, we also do not set our own analytics cookies, and we record only anonymous page counts. We remember an opt-out for at least 12 months.
4.4.2 EEA, UK and Switzerland visitors. We do not use analytics or advertising cookies or tags on our website for you, whether or not you are signed in. We do not set analytics or advertising cookies, load advertising pixels, keep ad click IDs or link your website activity to your account, and if you create an account, we do not report your sign-up or later purchases to advertising partners from our servers. We keep only an anonymous count of page loads (the page, referring site and country, with no cookie or ID). If your browser still has our own analytics, signup attribution or ad click ID cookies from an earlier visit, we delete them on your next visit. Cookies that advertising partners set during an earlier visit, such as _fbp and _gcl_au, are not under our control and expire on their own. These rules also apply if we cannot tell which country you are in.
4.4.3 Your Privacy Choices. Outside the EEA, the UK and Switzerland, you can change your choice at any time through the “Your Privacy Choices” link in the footer of every page of our website, including our documentation.
4.4.4 Browser and platform controls. You can block or delete cookies in your browser and manage ad preferences in your account settings with each advertising partner. These controls are separate from, and do not replace, your CCPA opt-out.
4.4.5 Do Not Track. Do Not Track has no common standard, so we do not respond to it. We do honor GPC as described in this Privacy Policy.
We use personal information for the following purposes:
We use account login credentials only to authenticate you and secure your account. We do not use or disclose sensitive personal information to infer characteristics about you, or for any purpose other than those permitted under Cal. Civ. Code section 1798.121 and its regulations. For this reason we do not offer a separate right to limit.
| Recipient | Categories disclosed | Why |
|---|---|---|
| Cloud hosting, data warehouse and infrastructure providers | All categories | To host and run the Services and store analytics |
| AI model providers | Content you submit, identifiers | To process prompts and return results |
| Payment processor | Identifiers, customer records | To process payments |
| Email and communications providers | Identifiers, internet activity (email opens and clicks) | To send service and marketing emails |
| Your Organization’s owners and administrators | Identifiers, professional information, access logs | To administer the Organization’s account and respond to security incidents |
| Government authorities and parties to legal process | Any category as required | To comply with law and protect rights and safety |
| Acquirers or successors in a corporate transaction | Any category | In connection with a merger, acquisition, financing or sale of assets, subject to this Privacy Policy |
Our service providers process personal information only on our instructions and under written contracts that restrict their use of it as the CCPA requires. A current list of our subprocessors is on our Security page at ampcode.com/security.
| Third party | Categories of personal information shared | Purpose |
|---|---|---|
| Identifiers (IP address, cookie and advertising IDs, ad click IDs, hashed email address), internet and network activity, approximate location, commercial information (signup, first use, first purchase and its amount, workspace creation and sales inquiry events) | Cross-context behavioral advertising and ad measurement | |
| Meta | Identifiers (IP address, cookie and advertising IDs, ad click IDs, hashed email address), internet and network activity, approximate location, commercial information (signup, first use, first purchase and its amount, workspace creation and sales inquiry events) | Cross-context behavioral advertising and ad measurement |
| Identifiers (IP address, cookie and advertising IDs, ad click IDs, hashed email address), internet and network activity, approximate location, commercial information (signup, first use, first purchase and its amount, workspace creation and sales inquiry events) | Cross-context behavioral advertising and ad measurement | |
| X | Identifiers (IP address, cookie and advertising IDs, ad click IDs, hashed email address), internet and network activity, approximate location, commercial information (signup, first use, first purchase and its amount, workspace creation and sales inquiry events) | Cross-context behavioral advertising and ad measurement |
| Identifiers (IP address, cookie and advertising IDs, ad click IDs, hashed email address), internet and network activity, approximate location, commercial information (signup, first use, first purchase and its amount, workspace creation and sales inquiry events) | Cross-context behavioral advertising and ad measurement |
We may share aggregated or de-identified information that cannot reasonably be linked to you. We maintain such information in de-identified form and do not attempt to re-identify it.
We do not sell personal information for money. We share the categories of personal information listed in the table in Section 6.2 with Google, Meta, LinkedIn, X and Reddit for cross-context behavioral advertising. This includes the hashed email addresses and conversion events we report to these partners from our servers, described in Section 4.2. This sharing may be considered a “sale” under some state laws because these partners receive the information on their own terms. We do not sell or share content you submit to the Services, account login credentials or payment information.
We have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age.
You have the right to direct us not to sell or share your personal information. You can opt out in either of these ways:
We process opt-out preference signals, including Global Privacy Control, in a frictionless manner. When we detect a GPC signal, we treat it as a valid request to opt out of sale and sharing for that browser or device and for any profile we associate with it, including pseudonymous profiles. If you are signed in, we also apply it to your account. An opt-out saved on your account stays in place until you choose to opt back in. We do not charge you, change your experience of the Services, or show you a pop-up in response to the signal. Our website displays whether your opt-out has been honored, for example “Opt-Out Request Honored.”
We stop sharing as soon as feasibly possible, and no later than 15 business days after we receive your request. We will wait at least 12 months before asking you to opt back in.
We keep personal information only as long as reasonably necessary for the purposes described in Section 5.
| Category | Retention period or criteria |
|---|---|
| Account identifiers, profile and professional information | For the life of your account, then deleted within 30 days after account deletion, except as needed for the legal reasons below |
| Content you submit | As described on our Security page: threads you own are deleted within 30 days when you delete your account, and threads in an Enterprise workspace remain with that workspace |
| First-party website analytics linked to a visitor ID or account | Up to 13 months from collection, after which it is deleted. If you delete your account, we delete this linked activity, including the link between your visitor ID and your account. Requests to delete your information cover the same data |
| Signup attribution saved with your account | For the life of your account, then deleted when you delete your account |
| Advertising pixel data held by Amp (conversion events) | Conversion event data we hold for sending to partners is kept only as long as needed to send it, generally no more than 30 days. Ad click identifiers are kept for up to 90 days after the click. Our advertising partners keep the data they collect under their own retention policies |
| Anonymous page counts | Individual page counts are kept for up to 13 months; totals calculated from them may be kept indefinitely. These contain no cookie IDs or other personal information |
| Server and security logs | As long as needed to operate and secure the Services and to investigate security incidents |
| Billing and transaction records | As long as required by tax and accounting law |
| Sales inquiry records | As long as needed for sales follow-up and record-keeping |
| Marketing email engagement data | Until you unsubscribe, plus the time needed to process your request |
| Opt-out and privacy request records | At least 24 months, as the CCPA requires |
We may keep information longer when required by law, to resolve disputes, to enforce our agreements or to preserve legal claims. Deleted information may remain in backup systems until those backups are overwritten in the normal course.
If you are a California resident, you have the following rights, subject to exceptions in the CCPA:
Email us at privacy@ampcode.com with the subject line “California Privacy Request” and tell us which right you want to exercise. You may also delete your account directly in your account settings.
We verify requests to know, delete and correct by matching information you provide with information we already hold. Usually we ask you to confirm control of the email address on your account. We will not ask for more information than we need. We do not require verification for opt-out requests or GPC signals.
You may use an authorized agent to submit a request. We may require the agent to provide your signed permission and may ask you to verify your identity directly with us. This requirement does not apply to opt-out preference signals.
We will confirm receipt of a request to know, delete or correct within 10 business days and respond within 45 calendar days. If we need more time, up to 45 additional days, we will tell you why.
Residents of other U.S. states with consumer privacy laws may have rights to access, correct, delete and obtain a copy of their personal information, and to opt out of targeted advertising, the sale of personal information and certain profiling. You can opt out of targeted advertising and sale through “Your Privacy Choices” or Global Privacy Control, which we honor in every state. To exercise your other rights, use the method in Section 9.1. If we deny your request, you may appeal by replying to our decision with the subject line “Appeal.”
Where the GDPR or UK GDPR applies, Amp is the controller of your personal information and relies on these legal bases:
Where advertising pixels collect data on our website, Amp and the relevant partner (Google, Meta, LinkedIn, X or Reddit) may be joint controllers for that collection and transmission. Each partner is responsible for its own later processing.
You have the right to access, correct, delete, restrict or object to processing of your personal information, to data portability, and to complain to your supervisory authority. To exercise these rights, email privacy@ampcode.com.
When we transfer personal information outside the EEA, UK or Switzerland, we use appropriate safeguards such as Standard Contractual Clauses.
We use administrative, technical and physical safeguards designed to protect personal information, described on our Security page. No system is completely secure. If a security incident affects your personal information, we will notify you as required by law.
The Services are not directed to children. We do not knowingly collect personal information from children under 13, or under 16 in the EEA and UK. If we learn we have collected such information, we will delete it. Contact us at privacy@ampcode.com if you believe a child has provided us information.
The Services may link to or integrate with third-party sites and services, such as code hosts. Their own privacy policies govern their practices.
We review this Privacy Policy at least once every 12 months and update it when our practices change. Our next review will be no later than October 2027. We will post the updated policy with a new “Last updated” date, and will give additional notice of material changes where required.
Questions about this Privacy Policy or our privacy practices: privacy@ampcode.com or Amp Frontier Corporation, 455 Market St Ste 1940 PMB 431018, San Francisco, CA 94105-2448.