Privacy. Straight up, foreal.

This site is run by Riley PNP (James Riley), Kansas City contemporary hip-hop. There is no published privacy email, phone number, or postal address on this site. Do not guess an address from a placeholder or a social bio. For privacy, deletion, or correction requests, use /contact and put “Privacy” at the top of your message, with the email address you want the answer sent to. That form is a shell today, so until it is connected there is nowhere on this site that silently emails you back — that limit is stated here instead of hidden.

The site’s database is Cloudflare D1, a SQLite database. Below is what it can hold about you, in plain words.

• It answers only from this site’s own notes. The chat reads answers stored in the database (36 published rows). No web search, no made-up facts, no invented releases, prices, dates, or venues. Catalog is 2016–2022 only: Still Cookin’ Vol. 1, The Murder Tape, The Speez, The Fundraiser, Throwaways EP, plus the supplied singles on /music.
• It never asks for your personal details. No email, no name, no order code, no payment details in chat — ever. Newsletter means a link to /newsletter. Orders mean a link to /contact. Finishing happens on the page, not in chat. Never send card numbers, passwords, or codes in chat, to anyone.
• It never quotes what it cannot prove from the site. No live price, no Venmo handle, no ticket date, no order status. If the answer is not in the site’s notes, it says so and points you to the page that owns it: /music, /store, /live, /newsletter, or /contact.
• Public chat, private guardrails. The public chat never requires a sign-in or a provider access gate. Any admin surface stays separate and access-gated — you will never see it here. The chat payload is scrubbed before it reaches the model: only the page name and title are used, form fields and page text are stripped, and anything that looks like an email, phone number, card number, or secret is redacted or blocked.
• When the knowledge base has no answer, it does not guess. It returns a pinned fallback that says so, with no model call made for that turn.

This section exists because a privacy page has to be exact about forms, and this site’s forms are not connected yet.

• Today: shell only. The /contact form has no backend endpoint, no fetch, no email send, and no storage. Nothing you type into it is sent, stored, or emailed. The same is true of the /newsletter form: using it does not join you to any list today. Both pages say so on the page itself.
• When the contact form is connected, it will store exactly what you type: the name, email, subject, and message, plus the kind you pick (general / booking / press / support), and a status (new / read / replied / archived). It will never need — and you should never send — a card number, a password, a Venmo login, or a bank detail. Those are not contact-form fields, and payment never happens through this form.
• Known gap, stated plainly: the shell’s topic dropdown currently offers Booking / Press / Business / Fan, which does not match the database kinds (general / booking / press / support). Until the backend owner aligns them, pick the closest topic and put “Support” at the top of your message so it lands in the right pile. This page describes the database truth; the shell will be fixed to match it, not the other way around.
• No reply-time promise. There is no published response SLA, support email, or phone number on this site, so none is promised here. When a channel is real, its page will say so. /support routes questions to the page that owns them instead of inventing an inbox.
• Newsletter, when connected: the form collects an email address and your consent checkbox only — no phone, no SMS. It will store the email, when you consented, and a hashed unsubscribe token, and every email will carry an unsubscribe link. No frequency, schedule, or provider is promised until that flow is real.

• Why it’s there: before the chat answers, Cloudflare Turnstile checks that you are not a bot. That is the whole reason the check exists — no ads, no profiling, no selling the result.
• What Cloudflare processes: Turnstile’s own privacy addendum says it processes minimal signals — client IP address, TLS fingerprint, User-Agent header, and the sitekey and origin — solely to tell humans from bots, and that Cloudflare does not have the ability to directly identify individuals from those signals. We take them at their word and add nothing on top.
• How it’s checked: your token is validated on the server against Cloudflare’s Siteverify endpoint. A token is good for 300 seconds (5 minutes), one use only — after that it expires and cannot be reused, and a replay fails. The visitor’s IP for that check comes from Cloudflare’s connecting IP header only, never from a forwarding header a client could spoof. The raw token is never stored or logged.
• The rate limit: 5 chat messages a minute and 20 a day, per salted IP hash (Section 2). The check runs before the limit is counted and before any AI call, so a bot that fails the check costs you nothing: no answer, no quota used, no model spent.
• Honest limit: Cloudflare’s edge necessarily sees requests to deliver them — that is the network doing its job. What this site’s own stores keep is the hash, never the raw IP. Those are two different things, and this page keeps them separate on purpose.

This is the section that matters most for the store, so it’s said plain:

• Deep link only. When the store opens, paying means tapping a link like https://venmo.com/<handle>?txn_amount=…&note=RPNP-… (or the QR next to it) that opens Venmo with your amount and your order note already filled in. You pay inside Venmo, on Venmo’s site. The price on the order page is the amount the link carries.
• No Venmo API key. No Venmo webhook. No automatic confirmation. There is no Venmo API key for this store, no Venmo SDK, and no webhook secret — and this site will never ask you for one. Venmo does not notify this site when you pay. Nobody will ever ask you to “verify” a payment through a webhook callback, a code, or a link from a stranger. If anyone asks, walk away.
• Manual reconciliation — that’s the whole system. After you pay on Venmo, you paste your Venmo transaction ID back on the site. The order is only marked paid after a person matches that ID, the amount, and your exact RPNP- note against the ledger in the Venmo app. Until that match happens, your order stays pending and nothing is printed. A payment that cannot be matched cannot ship — that protects you and me both.
• What we see and don’t see: we never see or store your card, bank details, or Venmo login. We see only the transaction ID and note you paste back. Pay only the one verified handle shown on the live order page — money sent to any other handle cannot be recovered by me.
• Fees: Venmo charges the seller, not you, on business payments: 1.9% + $0.10 on direct Venmo payments (Tap to Pay on iPhone/Android is 2.29% + $0.10 and is not how this store charges). Venmo does not refund seller fees, so a refund returns your payment, not the fee. No separate “Venmo fee” line is added to your total.
• Fail-closed today: the Venmo handle is not verified yet, so there are no pay links anywhere on this site, the order endpoint refuses orders, and /store shows “Merch drops soon”. The chat will never state a handle. When the store flips on, it flips on /store itself — nowhere else.

• No tracking cookies, no ad pixels, count-only measurement. This site sets no first-party tracking cookies and runs no ad pixels, no fingerprinting, and no cross-site tracking. If first-party measurement is switched on, it is limited to the daily aggregate counts in the table below, stored in D1 as one row per day, event, and page path. No per-visitor row, no user ID, no email, no raw IP address, and no cross-site identifier is stored for measurement. The salted IP hash described in Section 2 for chat rate limits is not reused for measurement. Daily rows are rolled into monthly totals after 90 days and the daily rows are then deleted. No measurement endpoint is live until the Worker ships it and this page is updated in the same change. Until then, no measurement counts are collected.
• What your browser may hold, from our own code: the music player queue and position — in session storage by default (gone when the tab closes), or in local storage only if you tick “Save queue on this device”. That’s it. Clear site data any time and the music still works; the queue just starts fresh.
• Cloudflare’s own cookies (for example around access-gated admin pages) are Cloudflare’s, under Cloudflare’s Cookie Policy — not ours, and we don’t read them.
• Spotify embeds, when a track has one, are Spotify’s iframes under Spotify’s policies. They only load for that track; the queue itself is driven by the on-site player.

Any event not in this table is not collected. A new event requires a new row here before it ships.

Below is the retention design for this site. It is stated as a design — not as a purge that has already run — because the automated purge job is not deployed yet. Nothing here is kept forever for marketing, and nothing is kept for training a model.

• Chat rate-limit counters: 30 days, then purged. Abuse control only. Hash only, never raw IP.
• Turnstile token records: 300 seconds. Single-use enforcement inside the token’s own lifetime. Raw token never stored.
• Chat audit rows: 90 days raw, then rolled into monthly counts with no identifiers. Checking the chat answers from the catalog, not inventing. Truncated text only.
• Worker operational logs: 24 hours rolling, or the shortest the hosting plan allows. Status codes and counts only — never chat content, never a request body.
• Newsletter emails: until you unsubscribe. Then the address stops being mailed and the row is marked unsubscribed.
• Contact messages: while the thread is open, then archived. So a booking, press, or support thread can be answered and closed.
• Order, ledger, and shipment rows: kept as receipts. Refunds, disputes, and tax handling need them. That’s accounting, not marketing — they are never used to mail you.

If you ask us to delete your data (Section 10), chat and rate-limit rows go within 7 days. Receipt rows the law requires us to keep are kept for the legal minimum and never reused for marketing. We will tell you exactly what is kept and why.

• Cloudflare — hosting, edge delivery, the D1 database, the R2 file bucket, and Turnstile. Cloudflare’s edge necessarily sees requests to deliver them; our own database never keeps your raw IP.
• Workers AI (the chat model and embeddings) — sees only the redacted, site-grounded prompt for that one turn. No chat text is stored by us for training.
• Social and streaming platforms: Instagram, YouTube, SoundCloud, Facebook, X, Audiomack, Spotify, and Apple Music. This site does not receive your account data from those platforms. If you open a link to one of them, that platform processes the visit under its own privacy policy.
• Venmo — sees the payment itself when you pay, under Venmo’s own privacy policy. We see only the transaction ID and note you paste back.
• Print partner (Printful, with Printify as fallback, when the store opens) — sees only what printing and shipping an order requires: the item, size, and ship-to details. No chat data ever goes to the print partner.

No ad networks. No data brokers. No selling or sharing your data for someone else’s marketing. Full stop.

• Unsubscribe: one tap in any email, or /newsletter. No account needed. (Until the newsletter form is connected, there is no list to unsubscribe from — this page will say so when that changes.)
• See, correct, or delete your data: use /contact and put “Privacy” at the top, with the email address you want the answer sent to. We delete chat and rate-limit rows within 7 days and confirm. Browser storage is yours: clear site data and the player queue is gone.
• What we can’t delete on request: a completed order’s receipt rows while the law requires them. We’ll tell you exactly what’s kept and why, and it will never be used to market to you.
• Young fans: this is a public music site and we assume young fans are reading. We don’t build profiles on kids, we don’t target ads at anyone, and chat data doesn’t become a profile. If you’re under 13, please talk to a grown-up before ordering or contacting us.