Privacy Policy — Route 66

Route 66 — Best of Americana is owned and operated by Mediterra Capital LLC ("Mediterra Capital", "we", "us"). This Privacy Policy explains what data we collect and how we use it.

This policy aligns with the disclosures we make on Apple's App Store "App Privacy" label. A quick summary: we collect the minimum data needed to run the service — your email address, the content you create (comments, reports, claims, support messages), and how you interact with the app so we can personalize recommendations. We do not track you across other companies' apps or websites, we do not sell your data, and we do not share data with data brokers or advertising networks.

1. Data we collect

Each category below is linked to your identity (tied to your account) and is not used for tracking across other apps or websites.

Contact info

Email address — required to create an account, sign in, receive password resets and security notices, and (if you opt in) product announcements. Purposes: App Functionality, Authentication, Product Personalization, Customer Support.

User content

Comments on Culture Desk posts and other public discussion surfaces.
Artist claim submissions — the bio, links, and any photo you attach.
Reports you file (broken links, objectionable content) and any attached photo or voice note.
Support messages you send through the contact form.
Purposes: App Functionality, Customer Support, and — for reports — safety and moderation as required by App Store Guideline 1.2.

Identifiers

User ID — the internal account identifier we generate for you, plus the OAuth account identifier returned by Google, Apple, or Spotify when you choose to sign in with one of those providers. Purposes: App Functionality, Authentication.

Usage data

Product interaction — favorites, follows, block list, saved curator playlists, video resume position, aggregate play counts, and outbound-click events when you tap through to a partner (Spotify, Apple Music, YouTube, a venue, a station). We use this to power "Continue watching / listening", to rank recommendations, and to keep the AI Americana assistant on-topic. Purposes: App Functionality, Product Personalization.

Third-party connection tokens

If you connect Spotify Premium, we store the access and refresh tokens Spotify issues plus your Spotify account id so we can drive in-app playback. You can disconnect at any time from Account → Connections, which revokes and deletes the tokens.

Diagnostics

We do not currently ship a third-party analytics or crash-reporting SDK. Our hosting provider records standard server logs (IP address, request path, timestamp, user agent) for security and abuse prevention. Those logs are not linked to your account profile and are retained for a short operational window.

2. Data we do not collect

Precise or coarse location.
Health, fitness, or HealthKit data.
Financial info, payment card numbers, or credit information (we do not process payments in-app).
Contacts, calendars, browsing history outside the app, or search history.
Advertising identifiers (IDFA) or any data used to build cross-app advertising profiles.

No tracking. We do not track you, and we do not link any data collected in the app or on our website to third-party data for advertising or measurement purposes. We do not use third-party advertising or analytics SDKs, we do not share data with data brokers, and we never sell personal information.

Cookies. The Route 66 website uses only strictly necessary cookies and local storage required to sign you in and remember your preferences. The native iOS app sets no analytics or marketing cookies at all, which is why it shows no cookie banner.

3. Camera and microphone

Route 66 never accesses your camera or microphone in the background, and never uses camera or microphone data for analytics, advertising, or personalization. The native iOS app only requests these permissions the first time you tap a specific control that needs them, and only for the purpose described on that screen.

Camera is requested only when you tap:

"Take a photo" on an artist claim — for example, to photograph a venue marquee, a tour poster, or a signed release so the moderation team can verify that you're the artist submitting the claim.
"Attach a photo" on a broken-link or content report — for example, a screenshot of an incorrect show date or an inappropriate profile image so moderators can act within 24 hours.

Microphone is requested only when you tap:

"Record a voice note" on a content report — for example, a 10-second spoken description when typing on mobile is impractical.

If you deny either permission, the rest of the app continues to work; only the specific control is disabled. Change these any time in iOS Settings → Route 66 → Camera / Microphone.

4. How we use your data

App Functionality — sign in, keep you signed in, save favorites and follows, resume playback, deliver comments and reports to the right surface, hand off playback to Spotify / Apple Music / YouTube.
Product Personalization — rank the Home feed, "For you" artist and video recommendations, and the AI Americana assistant's responses using your favorites, follows, and interaction history. This happens on our servers, not with a third-party ad-tech provider.
Authentication — verify your email, complete OAuth handoffs, and issue session tokens.
Customer Support — respond to messages you send through the contact form or in-app report flow.
Safety & Moderation — review reports, act on Terms violations, and (as required by App Store Guideline 1.2) remove objectionable content and eject abusive users within 24 hours.
Security & Fraud Prevention — rate-limit abusive requests, block spam, and investigate suspected account compromise.
Legal Compliance — respond to lawful requests and honor privacy requests (GDPR / CCPA).

We do not use your data for advertising, and we do not sell or share it with data brokers.

5. How we share data

We share only the minimum data needed with these categories of providers:

Hosting and database — Cloudflare (edge runtime) and Supabase (managed Postgres, auth, storage) host the app and your account data.
Email delivery — Lovable's managed email service delivers auth emails (password reset, sign-in) and transactional notices from notify.r66radio.com.
Authentication providers — Google, Apple, and Spotify when you choose to sign in or connect with them.
AI providers — Google (Gemini) and other model providers behind the Lovable AI Gateway, used to rank content and power the AI Americana assistant. We send them the prompt and the minimum context needed; we do not send them your email or identifiers.
Playback partners — Spotify, Apple Music, and YouTube receive the standard requests needed to render embedded playback or open a track in their app when you tap through.
Law enforcement — only when required by valid legal process.

None of these providers receive your data for their own advertising purposes. We do not use third-party SDKs that track you across apps or websites.

6. Data retention

Account data — kept while your account is active. Deleted on request (see below).
User content — published comments and public artist claims remain visible until you delete them or an account deletion cascades their removal.
Reports and moderation records — retained in de-identified form after account deletion so we can defend past moderation decisions.
Server logs — short operational window (typically under 30 days) for security and abuse investigation.
Email delivery logs — retained per our email provider's plan window (typically 30 days).

7. Your rights and choices

Access, correction, deletion, or export — request any of these at /legal/data-request, or email Route66AmericanaRadio@gmail.com. We honor GDPR and CCPA/CPRA rights regardless of where you live.
Delete your account in-app — Account → Delete account. Deletion is immediate and irreversible; favorites, follows, block list, comments, and third-party connections are removed.
Do Not Sell or Share (CCPA) — we do not sell or share personal information as those terms are defined by California law. No opt-out is required, but you may still submit a request via the data-request form for confirmation.
Notification preferences — manage push and email preferences at Account → Notifications.
Withdraw consent — you can revoke Spotify / Google / Apple connections from Account at any time.

8. Children

Route 66 is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us data, email Route66AmericanaRadio@gmail.com and we will delete it.

9. International users

Route 66 is operated from the United States. If you access the service from outside the U.S., your data is transferred to and processed in the U.S. and other jurisdictions our providers operate in. Where required, we rely on Standard Contractual Clauses or equivalent safeguards.

10. Security

Passwords are hashed by our auth provider; connections use TLS; database access is restricted by row-level security policies scoped to your account. No system is perfectly secure — if you spot a vulnerability, please email Route66AmericanaRadio@gmail.com.

11. Changes to this policy

When we make material changes we update the "Last updated" date above and, for significant changes, notify signed-in users in-app or by email before the change takes effect.

12. Contact

Questions about this Privacy Policy, data requests, or privacy concerns: Route66AmericanaRadio@gmail.com.

Mediterra Capital LLC · Route66AmericanaRadio@gmail.com · Data controller for Route 66 — Best of Americana