KXFM 104.7 Privacy Policy

In short

This summary describes the web player as it works today. Planned features and the iPhone and Android apps aren't part of it yet. We'll update this policy before they launch (section 14).

• No accounts or analytics, no tracking code, and KXFM runs no ads. You never sign in. The only outside code that ever runs in the web player is YouTube's video player, after you tap play. Spreaker, which supplies episodes, may add its own ads to some of them (section 4).
• What you save stays on your device. The shows you follow, the events you save, where you stopped in an episode, your settings, your searches, your Safety checklist and the zone you pin on Safety are kept in your browser. KXFM never receives them, though pinning a zone downloads that zone's map and City flyer from our host (section 2).
• Besides our host's short-lived request records, we receive only what you send us: a feedback note, with the screen you were on, your browser's details and your name if you add it. Station staff, and the people and AI tools that help build and run the web player, may read it. We delete your note whenever you ask.
• Some services see your IP address, as with any website. Our host (Vercel today, with a move to Cloudflare planned), which also serves the places and events listings and their pictures, and the services that supply the audio, data and pictures: SecureNet (the live stream and song titles), Spreaker (episodes), the National Weather Service and NOAA (weather, surf, tides and alerts), YouTube (video thumbnails, plus the video player once you tap play) and the websites that host Community Hub pictures.
• Places and events are public listings, not information about you. They come from Overture Maps, the Laguna Beach Chamber of Commerce, Visit Laguna Beach, locallivemusic.us and local organizations' event calendars (section 6). Directions opens Apple Maps or Google Maps with only the place's name and address, and Add to calendar saves a file on your device. Nothing goes to those services until you tap.
• Giving, newsletter sign-ups and shopping happen elsewhere, on Givebutter, Mailchimp and Shopify, only when you tap, under those companies' privacy policies.
• We don't collect your location, and we never sell your personal information. We share it only with the services that help us run the web player, or when the law requires (section 8).
• Questions, a note to delete, or a listing to correct or remove? Email privacy@kxfmradio.org.

1. Who we are and what this policy covers

KXFM 104.7 FM, Laguna's Community Radio, is run by Laguna Radio, Inc., a 501(c)(3) nonprofit organization in Laguna Beach, California. The station is licensed by the FCC as KXRN-LP. In this policy, "KXFM", "we" and "us" mean Laguna Radio, Inc.

This policy covers the KXFM 104.7 web player, the station's app that runs in your web browser, including its access-code page while it's shared privately. Today it's at kxfm-web-player.vercel.app. We plan to move it to listen.kxfmradio.org.

The KXFM apps for iPhone and Android aren't released yet. They'll work differently (section 14), so this policy will cover them only once we've updated it for them, before they launch.

It doesn't cover:

• kxfmradio.org, the station's website, which has its own privacy policy;
• other companies' websites and services, including the ones listed in sections 4 and 5. They follow their own policies;
• the design preview (kxfm-app-preview.vercel.app), a separate, private mock-up of the future apps shown to station staff, board members and partners. It works differently from the web player. For example, it can ask for your location to show how Find my zone will work (your location stays on your device), and it keeps poll answers, reminders and saved places on your device. One exception: feedback notes sent from the design preview are kept in their own private storage at Vercel and handled like the web player's notes (sections 3, 10 and 12).

While the web player is being tested, it's shared privately and asks for an access code. This policy applies in that period as well.

2. Information that stays on your device

The web player saves a few things in your browser's storage, so it remembers your choices and opens quickly. None of it is sent to KXFM. The one exception is your name, and only when you include it in a feedback note you send.

The web player gets the current events list from our server while it's open (section 3). Your browser may keep that list for a few minutes; the web player doesn't save it. Calendar files you download with Add to calendar go wherever your browser saves downloads. The web player doesn't keep a copy.

To delete all of it, clear this site's data in your browser's settings. You can also unfollow shows, unsave events and untick checklist items in the web player at any time.

3. Information KXFM receives

Feedback notes

The web player has a Feedback button. It sends us a note only when you press Send. A note contains:

• the tags you chose (such as "Love it" or "Bug") and what you wrote;
• which screen you were on (its name, such as "About", and its link inside the web player). The Report a problem buttons on place and event pages open the same form, and their notes name the place or event;
• your browser's "user agent" text, as your browser reports it. It names your browser, your device's operating system and their version numbers;
• the time on your device when you sent it, and the time we received it;
• your name, but only if you typed one in. It's optional.

The note does not include your IP address, location, or anything saved on your device beyond what's listed above. Please don't put sensitive information in a note.

Where notes are kept: in private storage at our host, Vercel ("Vercel Blob"). Only people with access to KXFM's Vercel account, or the station's secret key, can read them.

Who reads them:

• KXFM staff, and the people who build and run the web player for KXFM.
• AI tools. The people who build and run the web player use AI tools, currently Anthropic's Claude, to help build, fix and run it. When they work on something a note reports, the note, including your name if you gave one, may be processed by Anthropic. Anthropic handles it under the terms of the account we use and its privacy policy.

How we use them: only to fix problems, improve the web player and know who sent them. Staff may export notes to a spreadsheet to review them. Those copies are kept and deleted in the same way as the notes (section 12).

If sending fails, the web player lets you copy your note. Once the station has set up its feedback inbox, it will also let you email the note. A copied note stays on your device until you paste it somewhere. An email goes through your own email provider to KXFM's inbox, and we keep it as described in section 12.

The access cookie, while the web player is private

While the web player is shared privately, entering the right access code sets one cookie in your browser. It lasts 60 days and has one job: letting you back in without retyping the code. It has the same value for everyone who enters the code, so it can't tell visitors apart. Scripts on the page can't read it. The code you type isn't stored. Our server checks it against a scrambled, one-way copy (a "hash"). Once the web player opens to the public, this cookie won't be needed to get in.

Hosting and request records

Our host today is Vercel, Inc. It serves the web player and runs its small server functions. Like every web host, Vercel's servers receive your IP address, your browser's details, the page or file requested and the time. Vercel may work out an approximate location (such as your city) from your IP address. Vercel uses this information to deliver the web player and protect it from abuse, and keeps its own records under the Vercel Privacy Notice.

What KXFM can see: people with access to KXFM's Vercel account can see Vercel's records of recent requests. They can include your IP address, the page or file requested, the time and your browser's details. Vercel keeps them for a short time under its standard settings.

• KXFM doesn't extend that time, and doesn't copy, export or forward these records.
• We look at them only to keep the web player running and secure. We don't use them to identify listeners, and we don't match them to feedback notes.
• Our own server code doesn't write your IP address or your feedback into its logs.

Planned move to Cloudflare: we plan to move the web player to Cloudflare, Inc. When we do, Cloudflare will become our host and receive the same kind of request information, under the Cloudflare Privacy Policy. We'll update this policy before the move, including where feedback notes are kept.

Content our server fetches for you. Some content is fetched by our server instead of your browser, so those sources see our server, not you:

• Community Hub posts, from kxfmradio.org;
• KXFM's list of videos, from YouTube's data service;
• the swell reading, from NOAA's National Data Buoy Center;
• event listings, from the calendars named in section 6.

How events stay current. Our server refreshes the events list on a schedule: the live-music calendar every 8 hours, the other calendars once a day. It keeps the latest copy of each calendar, and the combined list, in private storage at our host, replacing them at each refresh. When the web player shows events (on Laguna, Events, Local Live Music, Spin the Dial, Search and a place's page), it asks our server for that list, then again about every 30 minutes while the web player is on screen. That request carries nothing about you beyond what every request to our host does (above), and our server code doesn't log it. Nothing you do starts a refresh. When our server visits those calendars, it names itself as KXFM's importer, with privacy@kxfmradio.org as its contact, and follows each site's robots.txt rules.

The places list (its listings, details, photos and logos) is part of the web player itself, served by our host like its other files.

Our server also runs automatic checks that the stream and data sources are working. Those checks, and the events refresh, don't involve any information about you.

4. Services your browser contacts directly

To play the radio and show live information, your browser connects straight to the services below. Each one receives your IP address and browser details when it does, and handles them under its own privacy policy. We don't control what they collect.

KXFM adds no tracking code from these services. Except for YouTube's video player after you tap play, no code from them runs in the web player: no scripts or ad tags. Your browser only requests their audio, data files or images.

The weather, tides and alerts are always for Laguna Beach's fixed location, never yours.

Places and events don't contact their sources. The places list, place details, photos and logos, and the events list all come from our host (section 3). Showing them doesn't contact Overture, the Chamber, Visit Laguna Beach, the event calendars or the businesses themselves. Their sites receive a request only if you tap one of their links (section 5).

5. Only when you tap: other sites

Some buttons open another company's website in your browser. Nothing is sent until you tap, and once you're there, that site's privacy policy applies, not this one. How long KXFM keeps what these services send us is in section 12.

• Givebutter (donations and memberships).
  • What happens: the Give and membership buttons open KXFM's Givebutter pages. You enter your name, email, payment details and gift there.
  • What KXFM receives: your gift record from Givebutter (such as your name, contact details and gift amount). We use it to thank you, send tax receipts and keep membership records.
  • Founders Circle gifts go through the donation form on kxfmradio.org.
  • Policy: Givebutter's privacy policy.
• Mailchimp (the newsletter). This applies only if the web player offers a newsletter link and you sign up.
  • What happens: the email address and anything else you enter go to Mailchimp, which is run by Intuit, and to KXFM.
  • Tracking in newsletters: newsletters may record whether you open them and which links you click.
  • Unsubscribing: every newsletter has an unsubscribe link.
  • Policy: Intuit's privacy statement.
• Shopify (KXFM merchandise). This applies if you buy from KXFM's online merch store.
  • What happens: your order, contact, shipping and payment details go to Shopify. KXFM, and any partner that prints or ships your order, receive what's needed to fill it.
  • Policy: Shopify's consumer privacy policy.
• Directions (places and events).
  • What happens: Directions, on a place's or event's page or a gig on Local Live Music, asks whether to open Apple Maps or Google Maps. The link that opens carries only the name and address of where you're going (the place, or the event's venue), never your location or anything else about you.
  • Once it opens: Apple or Google handles your request under its own policy, and may use your location to route you if you let it.
  • Policy: Apple's privacy policy or the Google Privacy Policy.
• Add to calendar (events).
  • What happens: on an event's page, a gig on Local Live Music or a Spin the Dial event card, the web player makes a calendar file (.ics) on your device and downloads it. It holds the event's title, date and time, place, schedule and price where listed, link and source, and, when the event has a start time, a reminder an hour before.
  • What's sent: nothing, to KXFM or to any calendar service. Your calendar app adds the event only if you open the file.
• Other links. Here's where they go:
  • A place's or event's own links (its website, social media pages, tickets, its Chamber or Visit Laguna Beach listing, or the calendar it comes from) open those sites. A place's phone number opens your phone app.
  • "Find this song" opens Apple Music or Spotify, searching for the song's title and artist.
  • Safety's sign-ups and sources open the City of Laguna Beach, AlertOC (run by Everbridge), MyShake and the National Weather Service. Nixle sign-ups open your messages app with the sign-up text; nothing is sent unless you send it.
  • Other links go to KXFM's YouTube channel, kxfmradio.org, the swell data's sources (NOAA and CDIP), OpenStreetMap's copyright page (the zone maps' credit) and links inside Hub posts.
• Sharing. Share buttons use your device's own share menu. KXFM doesn't see what you share or with whom.

6. Local places and events

The web player lists Laguna Beach places (businesses, and public places such as beaches, parks and trails) and upcoming events in Laguna Beach and the rest of South Orange County, including KXFM's live music calendar (Local Live Music). Every place and event names its sources, with links, and the About page lists the credits and licences.

Where the listings come from: public, open and partner sources.

• Places: open map data from the Overture Maps Foundation, published under open licences, and listings from the Laguna Beach Chamber of Commerce (its members' listings) and Visit Laguna Beach, used with their permission. Official City of Laguna Beach and County of Orange information and the US Census Bureau's address tools are used only to place and check listings. KXFM updates the places list from time to time.
• Events: locallivemusic.us (the calendar behind kxfmradio.org's live music page; Local Live Music shows all of it, Laguna Beach and the rest of South Orange County, as that page does) and the event calendars of the Laguna Beach Chamber of Commerce, Visit Laguna Beach, OC Public Libraries' Laguna Beach Library, Laguna Canyon Foundation, the Festival of Arts of Laguna Beach, First Thursdays Art Walk, Laguna Art Museum, Laguna Playhouse, Laguna Beach Unified School District, LOCA Arts Education and the Sawdust Art Festival, used with permission. Our server refreshes them automatically (section 3). An event leaves the web player once it's over, or once its calendar's latest copy is more than 12 hours old (live music) or 48 hours old (the other calendars).
• Pictures: place photos and logos come from the Chamber (supplied by its members) and Visit Laguna Beach, each credited. We keep our own copies with the web player (section 4). Events have no pictures.

What listings contain: information about businesses, places and events, such as a business's name, category, address, phone number, website, social media links, hours, description and photos, and an event's title, time, place, price, description and links. They contain nothing about you, the listener. Some listings include information about people, such as the owner of a small business or a performer.

• Home addresses: we leave out the kinds of listings most often run from a home (home services and construction, business services, real estate and vacation rentals), service businesses whose location isn't confirmed, listings without a street address, and addresses that are only a mailbox. If a listing still shows what is really someone's home, tell us and we'll remove it.
• Corrections and removals: if you own or run a listed business or organization, or you're named in a listing, you can ask us to correct or remove it. Use Report a problem on the place's or event's page (it sends a feedback note, section 3), or email privacy@kxfmradio.org. We'll correct or remove it in the web player, and tell you which source it came from, so it can be changed there too.

Google, Yelp and Apple: we don't use their place data. Directions only opens Apple Maps or Google Maps with the place's name and address, when you tap it (section 5).

7. What we don't do

• No accounts or sign-in.
• No analytics or usage statistics. KXFM adds no ad networks, tracking code, device fingerprinting or session recording.
• KXFM doesn't place or sell advertising aimed at you. Spreaker may add its own ads to some episodes (section 4).
• No selling or sharing of personal information, as California law defines "sell" and "share".
• No location.
  • The web player is set up so it can't ask for your location.
  • Weather and alerts are for Laguna Beach's fixed location.
  • Places and events don't use your location. Directions sends Apple Maps or Google Maps only the place's name and address; those apps may ask for your location themselves (section 5).
  • Our host and the services in section 4 may estimate a rough location from your IP address, as any website can.
• No access to your camera, microphone, contacts or photos.
• No push notifications in the web player.

8. How we use and share information

How we use it:

• Feedback notes: to fix problems and improve the web player.
• Hosting records: to keep the web player running and secure.
• Place and event listings, including any names of people in them: only to show the listing, credited to its source (section 6).

Who we share it with: we share personal information only in these cases:

• Service providers who help us run the web player. Today these are Vercel, for hosting and storage; Google (Google Workspace), which hosts KXFM's email and any spreadsheet copies of notes; and Anthropic, whose AI tools help build and run the web player (section 3). After the planned move, Cloudflare will host the web player. Each may handle notes or records only to provide its service to us, under its own terms.
• When the law requires it, such as a valid subpoena or court order, or when needed to protect someone's safety, or to protect KXFM and its listeners from fraud or abuse.
• If KXFM's operations move to another organization. It would have to honor this policy for information collected under it.

We never sell personal information.

9. Children

The web player is for a general audience. It isn't directed to children under 13, and we don't knowingly collect personal information from them. This is consistent with the Children's Online Privacy Protection Act (COPPA).

The only place to type anything that reaches us is a feedback note. If you're under 13, please don't put your name in one. If a parent or guardian believes a child has sent us personal information, contact us and we'll delete it.

10. Your choices and rights

• Information on your device: you control it completely. See section 2 for how to delete it.
• Feedback notes and emails: you can ask us for a copy of what we hold about you, or ask us to correct or delete it. Deleting a note also deletes any copies of it in spreadsheets staff exported.
  • How we find your note: because there are no accounts, tell us roughly when you sent it, which screen you were on, and the name you used, if any. We may ask a question or two to find it and confirm it's yours.
  • How fast: we'll respond within 45 days.
  • Asking for someone else: an authorized agent may make a request for you, with your written permission.
• Gift, newsletter and order records: you can ask Givebutter, Mailchimp or Shopify directly, or ask us and we'll handle what KXFM holds.

California and other states. California's Consumer Privacy Act (CCPA) generally applies to for-profit businesses, so it generally doesn't apply to a nonprofit like KXFM. Some other states' privacy laws can apply to nonprofits above certain size thresholds. Whether or not a law applies to us, we honor these requests from anyone, wherever they live:

• to know what personal information we hold about you;
• to get a copy of it;
• to correct it;
• to delete it.

We won't treat you differently for making a request. We don't sell or share personal information, so there's nothing to opt out of. We also don't give personal information to other companies for their own marketing (California's "Shine the Light" law).

11. Do Not Track and Global Privacy Control

Some browsers send a "Do Not Track" or Global Privacy Control (GPC) signal. The web player doesn't track you across websites and KXFM doesn't sell or share personal information, so the web player works the same whether or not your browser sends these signals. There's nothing for them to switch off.

If we ever sell or share personal information, we'll treat a Global Privacy Control signal as a request to opt out.

YouTube's video player, after you tap play, and the other services in section 4 handle these signals under their own policies.

12. How long we keep information

13. Security and where information is stored

What we do:

• The web player and all of its connections use encryption (HTTPS).
• Feedback notes are kept in private storage. Only people with access to KXFM's Vercel account, or the station's secret key, can read them.
• The access code is stored only as a one-way hash.
• We limit who can read notes.

No system is perfectly secure. If a breach ever affects your personal information, we'll notify you as the law requires.

Where information is stored. KXFM is in the United States. Feedback notes sent from the web player are stored in the United States. Our host, Google Workspace (which holds our email and any spreadsheet copies of notes) and the services in sections 4 and 5 may handle requests and information in other countries under their own policies. If you use the web player from outside the United States, you can make the same requests described in section 10.

14. Planned features and the native apps

None of the features in this section is in the web player today. Each would collect new information or use new services. Before any of them launches, in the web player or the apps, we'll update this policy to say what's collected, why, who handles it and how long we keep it. The apps' store listings will carry matching privacy labels.

The services named here are current plans and may change. Any service we use will be named in this policy before the feature launches.

15. Changes to this policy

When we change this policy, we'll post the new version on the same Privacy page, with a new "Last updated" date, before the change takes effect. If a change is significant, such as collecting a new kind of information or using it in a new way, we'll also say so on the web player's About page for at least 30 days. Earlier versions are available on request.

16. Contact us

Questions or requests about privacy:

Email: privacy@kxfmradio.org

Mail: Laguna Radio, Inc. (KXFM 104.7), Attn: Privacy, 1121 Glenneyre St., Laguna Beach, CA 92651

Phone: 949-715-4859 (station office)