How it works
Downlink turns a track into a page where a fan unlocks the file by supporting the artist on SoundCloud. Everything the gate asks for is verified on the server, and the download is one signed cookie away.
A link, and the gate in front of it
An artist gives a track a page: the audio file, the SoundCloud URL and the gate that guards it. The gate is four switches, follow, like, repost and comment, and the artist turns on the ones they want. A page with every switch off is still a page, it just opens straight away.
A fan who clicks connects SoundCloud. Downlink asks for the authorisation with PKCE, performs the follow, the like and the repost server-side with the token SoundCloud hands back, then drops the token: it is never written down. What is kept is a signed cookie for that page alone, and the SoundCloud username, so the artist knows who supported them.
The comment, written by hand
SoundCloud forbids posting comments through its API, so Downlink never posts one. On a comment gate, connecting only proves who you are: you write the comment yourself on SoundCloud, come back, and Downlink reads the track comments with its own application token to find one that is yours.
That read happens once per click, plus once when you come back to the tab, never in a loop. The identity it relies on is tied to that single track, so the follow, the like and the repost cannot be skipped by walking in from another page.
From the cookie to the file
The download link checks the signed cookie and nothing else: no cookie, no file, whatever the browser claims. The cookie names the page it was minted for and it expires after a day, so it cannot be moved to another track or kept forever. The checklist follows it: once it is gone the steps read as to do again, instead of promising a download the server is about to refuse.
The audio never passes through the database. It sits on storage running on the same server as the site, and the download goes through a link signed for a few minutes: the file arrives under its real name, and the link dies behind you.
What the two counters count
A page shows its views and its downloads. A view is one visitor, one page, one day: the server hashes the IP address with a salt that changes daily and keeps only the hash, so a reload counts once and no address is ever stored.
A download is a row, carrying the SoundCloud username when the fan connected one. The artist sees who supported them; nobody sees an IP address, because none was kept.
Who signs in, and what is theirs
Artists sign in with Google or SoundCloud. Fans never have an account: a few signed cookies carry everything they need, and the browser is never believed on its own.
The public directory shows an artist by their SoundCloud handle, never by their account name: a Google sign-in can carry a real name, and a real name is not a stage name.
What is deliberately not here
No fan accounts, no newsletter, no comment posted on your behalf. No advertising and no tracking cookie: the audience is counted by a self-hosted Umami that sets none.
The numbers know nothing about a fan beyond the SoundCloud name they chose to connect, and the gate cannot tell whether a follow outlived the click. It proves a gesture was made, not that it was meant.