Privacy notice for signups and messages.

The site stores theme and animation choices in your browser so they can persist between visits.

The support portal records your verified email, product, platform, app version, subject, messages, response-only consent, and request status. It is separate from the waitlist. Please do not send case documents, confidential details, or sensitive personal information. Sign-in links are single-use and expire after 15 minutes. A secure, HttpOnly session cookie keeps this browser signed in for up to eight hours; signing out revokes that session.

The contact form records your email, optional name, subject, message, and permission to respond. It is separate from the waitlist and does not subscribe you to product or research updates. Please do not send confidential case information.

The form asks for your email address, your role, the main workflow you want help with, and your clear permission to receive relevant product and research updates. If you pick a product, the form records that choice too.

Your name and organization are optional. To see which page or campaign led you to sign up, the form may record the page you signed up on, the page that sent you there, and standard campaign tags from the link. The server also keeps a shortened copy of your browser's identifying string (its user agent) for support and for looking into abuse.

Your current role, workflow, product interest, and source are kept together in one record for your email address. We also keep a short history of your most recent signup and confirmation events, and separate lists of the categories you have picked over time. Your current choices and your past interests are kept apart on purpose.

To block spam and limit repeat attempts, the form uses a hidden bot trap and short-lived coded identifiers. One is made from your connection's network address as Cloudflare reports it, and the other from your email address. Your network address itself is not added to your waitlist record.

• Send product, beta, research, or launch updates to a confirmed address.
• Learn which professional audiences and workflow problems deserve attention.
• Answer access requests and direct questions.
• Spot duplicate, abusive, or automated submissions.

We do not sell waitlist information. Joining the waitlist does not create a product account, ask for a password, or sign you up for a paid service.

When you sign up, your address is saved as pending confirmation. We do not send it automated product or research email until you show that you control the address. Only confirmed addresses can receive automated updates.

When email confirmation is turned on, we send a signed link through Resend that expires after 48 hours. Opening the link shows a review page, and you confirm with a separate button on that page. Each new form submission replaces the code in the previous link, so an older link can no longer approve changed preferences.

If you submit the form again, we update your current role, workflow, and product choice, keep your short history, and set the address back to pending confirmation. That way a request nobody has confirmed cannot quietly change an address that was already receiving updates.

The marketing site, submission forms, and private management area run on Cloudflare Workers. Signup records and contact messages are stored in Upstash Redis. These providers handle the information only as needed to host, secure, and run the signup.

The private management area requires Cloudflare Access sign-in and an approved administrator email. Cloudflare Access processes administrator sign-in information and uses authentication cookies for that private area.

Cloudflare Web Analytics counts visits to this site. It sets no cookies, and the reports we see are totals, such as page views, referring sites, countries, device types, and page load speed, not individual visitors.

When Cloudflare Turnstile is turned on, Cloudflare also processes the challenge token and related security signals. Our server checks Turnstile tokens and does not store them in your waitlist record.

Resend processes the submitted email address and the confirmation message when email confirmation is turned on. The Resend API key and the secret that signs confirmation links stay on our server. A confirmation email alone does not add your address to the list that receives updates.

We may also disclose information when the law requires it, to protect the service or its users, or as part of a legitimate business reorganization. We do not give waitlist records to unrelated advertisers.

Support threads expire 90 days after the latest message or status change and may be deleted sooner on request. Restricted support audit events retain coded actor and request identifiers for up to 90 days, capped at 1,000 events. Login and session credentials are stored only as digests. Resend sends sign-in links and staff-reply notices; notices contain a request reference and portal link, without ticket message text. Provider acceptance does not confirm delivery.

Contact messages expire after 90 days and may be deleted sooner. Marking a message resolved does not extend that period. Administrative changes are recorded in a restricted audit trail for up to 90 days, limited to 500 events, with the administrator’s identity and a coded record identifier rather than the message itself.

We keep waitlist information while it is useful for the updates or product research you asked for, unless you ask us to delete it sooner. Your event history is capped, and the short-lived spam identifiers expire on their own.

You can ask to see, correct, or delete your waitlist record. Deleting it removes your current record, your event history, data kept for compatibility with older records, your confirmation status, and every current or past category list we know you are on. We may ask you to show that you control the email address before we delete a record.

You can stop updates by replying to any update or by writing to the address under Contact. Changing your preferences can also set your address back to pending confirmation.

The signup form accepts requests only from this site, limits request size and repeat attempts, and uses a bot trap, plus a challenge check when it is turned on. Connections to our providers are encrypted. No internet service can promise perfect security.

Send questions or privacy requests to Andrew Mayes, DepoStack's founder, at me@andrewmayes.com.

Website accounts use Better Auth running on DepoStack's Cloudflare Worker. Your email address, name, email-verification state, access-request status, and session records are stored in Cloudflare D1. Session records include connection addresses and browser details for security; the HttpOnly sign-in cookie expires after seven days. Connection addresses also support short-lived authentication rate limits. Short-lived email codes are stored as hashes; Resend delivers sign-in codes and account-approval notifications. Cloudflare Turnstile and limited, keyed request identifiers help protect code delivery against abuse.

The account-access waitlist is separate from the product-update forms described above. Verifying your email creates a pending request that requires owner approval. Joining it does not subscribe you to product updates, create a paid subscription, or grant access to a Planned product. Existing product-update records are not automatically turned into accounts. Access decisions are logged for up to 90 days.

Stripe handles hosted checkout and billing management when enabled. DepoStack stores the Stripe customer identifier linked to your account, subscription status, renewal/cancellation information, and webhook identifiers used to process updates safely. Payment card details are entered on Stripe's pages. Billing currently supports testing only; no live payment option is offered. See Stripe's privacy notice.

You can manage your name, sign out other sessions, and delete an account in account settings. Accounts linked to billing require assisted closure so ongoing subscriptions and retained billing records can be handled. For account or waitlist deletion help, contact Andrew using the address above. The support portal currently keeps its separate secure email-link sign-in.