add privacy and status route [no authentication]