Privacy Policy

The short version

We ask for one thing: your email address. We use it to hold your place in CloakMind early access, to tell you when orders open, and to apply your 99,90 € founder price. We do not sell it, rent it or pass it to advertisers.

Who is responsible

CloakMind early access is run by the CloakMind project, an individual project. There's no incorporated company behind it yet, and we're not going to pretend otherwise. You can reach us at [email protected] for anything in this policy.

What we collect

Your email address, which you type in yourself.

Where you came from: the utm_source, utm_medium, utm_campaign, utm_content and utm_term values in the link you clicked, plus the referral code if a friend sent you. This tells us which channels are worth our time and nothing about you personally.

Your language preference and which version of the page you saw, so we can tell which wording works better. We also record an approximate country, derived from the network your request arrives on.

A one-way hash of your IP address. We never store the address itself. It exists only to stop one connection from flooding the list with fake signups and to stop people referring themselves.

We do not ask for your name, age, phone number, university or course, because we don't need any of it.

Legal basis

Managing your place in early access and emailing you about the launch and your founder price is the service you asked for when you signed up (Article 6(1)(b) GDPR - performance of a contract you requested).

Optional project updates beyond that are sent only if you tick the separate, unticked box on the form (Article 6(1)(a) GDPR - consent). Ticking it is never required to join, and you can withdraw it at any time.

Basic abuse prevention using a hashed IP relies on our legitimate interest in not having the list filled with fake entries (Article 6(1)(f) GDPR).

Analytics and cookies

This page sets no advertising cookies and loads no third-party trackers. For first-party analytics, it creates a random identifier for the current tab session. The server stores only a keyed HMAC derived from that identifier; it never stores the raw value or uses it to track you across sites.

The analytics identifier and the state that remembers you signed up live in sessionStorage and disappear when you close the tab. Analytics events are kept only for the server's limited retention window and then deleted. If Web Crypto or storage is unavailable, the page still works and that session is not counted as eligible.

How long we keep it

Until CloakMind Tape launches and the founder price period ends, or until you ask us to delete it - whichever comes first. If the project is abandoned, the list is deleted.

Your rights

You can ask us for a copy of your data, correct it, delete it, restrict what we do with it, or object to it. Every email we send has an unsubscribe link that removes you from the list immediately. For anything else, email [email protected] and we'll deal with it within 30 days. If you're in the EU or UK and you think we've handled it badly, you can complain to your national data protection authority.

Processors

The configured waitlist service uses Railway for the API, Supabase for storage and Resend for email delivery. Cloudflare hosts the landing page. The controller identity, provider agreements and processing details still require confirmation and qualified review.

PostHog is disabled in the current site configuration. First-party analytics uses sessionStorage for tab-session attribution as described above. Any future third-party analytics activation requires a review of the actual processing, this policy and any applicable consent requirements; cookieless operation alone does not settle that review.

Pending legal review

This policy is written to be accurate about what the software actually does, but it has not yet been reviewed by a lawyer. It will be before the first sale.