⚠️ Draft Document — Pre-Launch Review Required
This document contains placeholder legal language. It is prepared for compliance remediation and must be reviewed and approved by a privacy attorney before commercial launch or venue deployment.
1. Information We Collect
We collect and process user data depending on your role on the platform:
- Guests (Passengers/Riders): We collect the track selections you submit, the nickname/label you choose for display in the queue, and timestamps. Guests are not required to create an account, and we do not collect or store any guest logins, emails, phone numbers, or persistent device identifiers.
- Hosts (Drivers/Venues): We collect your account email, display name, subscription tier selection, and session configuration history. Payment details (credit card information, billing details) are processed directly by Stripe and are not stored on our database.
2. Data Retention & Session Deletion
We prioritize data minimization. All guest-submitted queue items, now-playing states, and active session identifiers are purged from our database immediately when the host terminates the session. Historical driver stats (such as cumulative songs played counts) are retained to track usage and billing.
3. Third-Party Processors
We share data with trusted infrastructure providers only to run the service:
- Supabase: For cloud database hosting, driver accounts, and real-time subscription infrastructure.
- Cloudflare: For Edge Network routing, static asset hosting, geoblocking middleware, and serverless APIs.
- Stripe: For secure customer subscription payment processing.
- Audius & Jamendo APIs: To query and fetch music catalog metadata and playback streams.
4. Cookies and Local Storage
We use localStorage on the host browser to store Supabase authentication tokens so you can stay logged in. Guests' browsers use brief memory cookies/session states strictly to save their current active session code. No advertising or tracking cookies are set.
5. California Consumer Privacy Act (CCPA/CPRA)
We do not sell your personal information. Under the CCPA, California residents have the right to request deletion of their personal data, opt out of data sharing, and request access to data collected. Since guests do not register accounts, we do not have searchable data that could identify individual guests.
6. Contact Information
For any privacy inquiries or to request deletion of your driver account data, please contact: privacy@litofs.com.