Privacy Policy

Effective Date: April 14, 2026  ·  Applies to: ShoutOut iOS Application

---

1. Introduction

Klone21 Ventures LLC ("we," "us," or "our") operates the ShoutOut iOS application. ShoutOut plays music from your connected streaming service and injects short, scheduled voice snippets — called "shoutouts" — at precise timestamps within your listening experience.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and your rights regarding that information. By creating an account or using ShoutOut, you agree to the practices described in this policy.

This policy applies globally. Users in the EU, EEA, or UK and California residents will find additional jurisdiction-specific information in Sections 11 and 12, respectively.

2. Information We Collect

2.1 Account Registration and Sign-In

You may create a ShoutOut account using one of three methods:

• Email and password — we collect your name and email address directly.
• Sign in with Apple — Apple provides us with a unique identifier and, at your option, your name and email address (or an Apple-relayed proxy address). Apple does not share your Apple ID password with us.
• Sign in with Google — Google provides us with your name, email address, and a unique Google account identifier. Google does not share your Google account password with us.

Regardless of sign-in method, we store a name and email address (or proxy address) for your account. The specific data received from Apple or Google is governed in part by their own privacy policies, linked in Section 5.

2.2 Audio and Voice Data

ShoutOut enables users to record short voice clips ("shoutouts") that are inserted into music playback at timestamps you choose. We collect:

• Voice recordings you create within the app.
• Metadata associated with recordings, including duration, timestamp placement, and the playlist or track they are linked to.

Audio clips are stored on Cloudflare R2 (see Section 5). We do not use your voice data to build biometric profiles or for advertising purposes.

2.3 Third-Party Music Service Account Linking

To play music, ShoutOut integrates with:

• Apple Music — via the MusicKit framework and your Apple ID authorization.
• Spotify — via the Spotify Web API and OAuth 2.0 authorization.

When you link a service, ShoutOut receives a short-lived access token to retrieve and play music on your behalf. We do not receive your streaming service password, full listening history, or financial information.

2.4 Technical and Usage Data

We may collect limited technical data automatically, including device type, operating system version, app version, crash reports, and general feature usage patterns. This data is used in aggregate or pseudonymous form to improve app performance and stability.

3. How We Use Your Information

We use the information we collect for the following purposes only:

• Account creation and authentication — to verify your identity and secure your account, including via Apple or Google Sign-In.
• Delivering the ShoutOut feature — to store and insert your voice clips into music playback at specified timestamps.
• Music playback — to authenticate with Apple Music or Spotify and stream content through the app.
• Transactional emails — to send account verification messages and password reset links via Resend (see Section 5). We do not send marketing, newsletter, or promotional emails.
• App improvement — to diagnose bugs, analyze feature usage, and enhance performance.
• Legal compliance — to fulfill obligations under applicable law.

4. How We Do Not Use Your Information

• We do not send marketing, promotional, or newsletter emails.
• We do not sell, rent, or trade your personal information to third parties.
• We do not use your voice recordings to build biometric profiles or for advertising targeting.
• We do not share your email address with any third party for their own marketing purposes.
• We do not use Apple Sign-In or Google Sign-In data for any purpose beyond authenticating your account.

5. Third-Party Service Providers

We use the following third-party services to operate ShoutOut. Each acts as a data processor on our behalf and is contractually restricted from using your data for any purpose other than providing their service to us.

Provider	Service	Data Processed	Privacy Policy
Resend	Transactional email delivery	Email address, email content	resend.com
Cloudflare R2	Audio clip storage	Voice recordings	cloudflare.com
MongoDB Atlas	Database (user data)	Name, email, account data	mongodb.com
Apple (Sign-In)	Authentication	Name, email (if shared)	apple.com
Google (Sign-In)	Authentication	Name, email	google.com
Apple Music / MusicKit	Music playback	Access token	apple.com
Spotify	Music playback	Access token	spotify.com

We do not use any advertising networks, analytics platforms that track you across apps, or data brokers.

6. Email Communications

ShoutOut sends transactional email only, delivered via Resend. The only messages you will receive are:

• Email verification — a one-time message when you register with email/password to confirm your address.
• Password reset — sent only when you initiate a password reset request.

Users who sign in with Apple or Google do not receive email verification messages, as authentication is handled by those providers.

We do not send unsolicited email of any kind. We have no marketing list, newsletter, or promotional mailing program. If you receive an unexpected email claiming to be from ShoutOut, contact us at the address in Section 13 immediately.

7. Data Storage and Security

Your data is stored as follows:

• Account data (name, email, authentication tokens) — stored in MongoDB Atlas, hosted in the United States.
• Audio clips (voice recordings) — stored in Cloudflare R2 object storage.

We implement industry-standard security measures, including:

• Encryption of data in transit using TLS.
• Encrypted storage for voice recordings and authentication credentials.
• Access controls limiting data access to authorized personnel only.

No method of electronic storage or transmission is 100% secure. While we apply strong protections, we cannot guarantee absolute security.

8. Data Retention

• Account information (name, email) — retained for the life of your account and deleted within 30 days of account deletion.
• Voice recordings — retained until you delete them within the app, or upon account deletion.
• Music service access tokens — stored for the duration of your active session or until you disconnect the service.
• Technical logs — retained for up to 90 days for security and debugging, then deleted.

9. Account Deletion

You can permanently delete your ShoutOut account and all associated data directly from within the app. To do so, go to the Profile tab and tap Delete Account in the Danger Zone section. Upon confirmation:

• Your account record (name, email) will be deleted from MongoDB Atlas within 30 days.
• All voice recordings associated with your account will be deleted from Cloudflare R2 within 30 days.
• Any music service access tokens will be revoked immediately.

If you signed in with Apple, you may also revoke ShoutOut's access via Settings > [Your Name] > Password & Security > Apps Using Apple ID on your iOS device.

If you signed in with Google, you may also revoke access via your Google Account at myaccount.google.com > Security > Third-party apps with account access.

You may also request deletion by contacting us at the email in Section 13 if you are unable to access the in-app option.

10. Your Rights and Choices

Regardless of your location, you may:

• Access — request a copy of the personal information we hold about you.
• Correction — request correction of inaccurate information.
• Deletion — delete your account in-app (Section 9) or contact us to request deletion.
• Portability — request your data in a portable format.
• Disconnect music services — unlink Apple Music or Spotify at any time via app settings.

EU/EEA/UK and California residents have additional rights described in Sections 11 and 12. We will respond to verifiable requests within 30 days.

11. Children's Privacy

ShoutOut is not directed to children under the age of 13 (or under 16 where required by applicable law) and we do not knowingly collect personal information from such children. If we become aware that we have inadvertently done so, we will delete it promptly. Contact us immediately if you believe a child has provided us with personal data.

12. Additional Information for EU, EEA, and UK Users (GDPR)

If you are in the EU, EEA, or UK, the GDPR or UK GDPR applies to our processing of your personal data. This section supplements the rest of this policy and takes precedence in the event of a conflict.

12.1 Data Controller

Klone21 Ventures LLC is the data controller. Contact details are in Section 14.

12.2 Legal Bases for Processing

• Performance of a contract (Article 6(1)(b)) — processing your name, email, voice recordings, and music service tokens is necessary to provide ShoutOut.
• Legitimate interests (Article 6(1)(f)) — processing technical/usage data to maintain security and improve the app. We have assessed these interests do not override your rights.
• Legal obligation (Article 6(1)(c)) — processing required by applicable law.

We do not rely on consent for core processing. If we ever introduce consent-based processing, we will seek explicit consent and allow withdrawal at any time.

12.3 Special Category Data (Voice Recordings)

Voice recordings may qualify as biometric data in some EU member states. Where that classification applies, we process them on the basis of your explicit consent (Article 9(2)(a) GDPR), solely to deliver the shoutout feature. You may withdraw consent and delete recordings at any time in-app or via account deletion (Section 9).

12.4 International Data Transfers

ShoutOut and its sub-processors (Section 5) are based in or store data in the United States. Transfers of EU/EEA/UK personal data to the US are protected by:

• Standard Contractual Clauses (SCCs) approved by the European Commission with each US-based sub-processor.
• The UK International Data Transfer Agreement (IDTA) for transfers from the UK.

You may request copies of the relevant transfer mechanisms by contacting us at the address in Section 13.

12.5 Your GDPR Rights

In addition to the rights in Section 10, you have the right to:

• Restriction of processing (Article 18) — ask us to restrict processing while you contest accuracy or object to processing.
• Object to processing (Article 21) — object to processing based on legitimate interests; we will cease unless we have compelling grounds.
• Not be subject to solely automated decisions (Article 22) — ShoutOut does not make legally significant automated decisions about you.
• Lodge a complaint — with your local supervisory authority. EU authorities: edpb.europa.eu. UK: Information Commissioner's Office at ico.org.uk.

We respond to GDPR requests within one calendar month, with a possible two-month extension for complex requests. We will notify you if an extension applies.

13. Additional Information for California Residents (CCPA / CPRA)

If you are a California resident, the CCPA as amended by the CPRA grants you specific privacy rights. This section supplements the rest of this policy.

13.1 Categories of Personal Information Collected (Last 12 Months)

• Identifiers — name and email address.
• Audio and sensory data — voice recordings.
• Account credentials — hashed passwords (email/password accounts only); OAuth tokens (Apple/Google Sign-In).
• Internet or network activity — app usage patterns and technical log data.
• Inferences — none. We do not build profiles or draw inferences about your preferences.

13.2 Sources

Directly from you (registration, recordings), from Apple or Google (Sign-In), and automatically from your device (technical data). We do not purchase data from brokers.

13.3 Business Purposes for Collection

As described in Section 3. We do not collect personal information for the purpose of selling it.

13.4 Disclosure and Sale

We do not sell your personal information and have not done so in the past 12 months. We do not share personal information for cross-context behavioral advertising. Disclosures to sub-processors (Section 5) are made solely for business purposes under contracts that restrict further use.

13.5 Your California Rights

• Right to Know — categories and specific pieces of personal information collected, sources, purposes, and third parties.
• Right to Delete — delete your data in-app (Section 9) or submit a request to us.
• Right to Correct — request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing — we do not sell or share. If that changes, we will update this policy and add a "Do Not Sell or Share My Personal Information" link.
• Right to Limit Use of Sensitive Personal Information — voice recordings may be sensitive personal information under CPRA. You may limit our use to delivering the shoutout feature by contacting us or deleting recordings in-app.
• Right to Non-Discrimination — we will never penalize you for exercising your California privacy rights.

13.6 Submitting a California Request

Email us at the address in Section 14 with subject line "California Privacy Request." We will acknowledge within 10 business days and respond within 45 calendar days (extendable to 90 days with notice). We will verify your identity by matching information you provide to what we have on file, without requiring you to create an account.

13.7 Shine the Light (Civil Code § 1798.83)

We do not disclose personal information to third parties for their direct marketing purposes. No Shine the Light disclosures are applicable.

14. Contact Us

For privacy questions, rights requests, or concerns — including GDPR and CCPA/CPRA requests — please contact:

We aim to respond to all privacy inquiries within 5 business days.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the Effective Date and, where appropriate, by email notification. Continued use of ShoutOut after an update constitutes acceptance of the revised policy.

---