Privacy Policy

1. Who we are

The waitlist is run by the data controller:

We are based in the European Union and follow the GDPR.

2. What we collect

When you join the waitlist we store:

• your email address;
• your consent to be emailed about the launch (the checkbox on the form);
• the marketing source: which form you used and any UTM parameters or ref code in the link you arrived through (for example utm_source=tiktok);
• your browser's user agent (browser and operating system name);
• the time you signed up.

There are no accounts and no payments on this site, and we never ask for audio, video or photos here.

To check that a sign-up comes from a person and not a bot, your IP address and browser signals are sent to Cloudflare Turnstile when you submit the form. We use the result (human or not) and don't store your IP address.

3. Why, and on what legal basis

• To tell you about the launch and early access — based on your consent (GDPR Art. 6(1)(a)). You can withdraw it at any time.
• To keep the site secure and stop abuse such as bot sign-ups — based on our legitimate interest in running a safe service (GDPR Art. 6(1)(f)). This includes Cloudflare Turnstile.
• To understand which links bring people to the waitlist — the source and UTM parameters are stored with your sign-up, which you consent to when you join.

4. Analytics and cookies

• Cloudflare Web Analytics counts page views. It does not use cookies, local storage or fingerprinting, and does not identify you.
• PostHog (hosted in the EU) records page views and a "joined waitlist" event together with the form used and the UTM parameters. On this site PostHog runs without cookies: it keeps a random identifier in memory for the page you are on and does not write cookies or local storage. If we ever change that, we will ask for your consent first.

The waitlist site itself sets no cookies and stores nothing on your device. We use no advertising trackers or social media pixels.

5. Where your data is stored

We use these processors, each under a data processing agreement (DPA):

• Supabase — database for the waitlist, hosted in the EU (Ireland). Supabase DPA
• Cloudflare — website hosting, Turnstile bot protection and Web Analytics, served from its EU and global edge network. Cloudflare DPA
• PostHog — product analytics, EU cloud. PostHog DPA

We don't transfer your data outside the EU ourselves. Where a processor handles data outside the EU (for example Cloudflare's global network), it does so under the safeguards described in its DPA, such as the EU Standard Contractual Clauses.

6. How long we keep it

We keep your waitlist details until you unsubscribe, or until 12 months after the app launches — whichever comes first. Then we delete them.

7. Your rights

You can ask us to:

• show you the data we hold about you (access);
• correct it (rectification);
• delete it (erasure);
• limit how we use it (restriction);
• send it to you in a portable format (portability);
• stop using it based on legitimate interest (objection).

You can also withdraw your consent at any time. Withdrawing doesn't affect anything we did before.

To do any of this, email hello@yaptoon.com from the address you signed up with. We reply within one month.

You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI) or to the data protection authority where you live.

8. No selling, no sharing

We don't sell your data, and we don't share it with anyone except the processors listed above, who act only on our instructions.

9. Children

The waitlist is not meant for anyone under 16. If you think a child has signed up, email us and we'll delete their details.

10. Changes to this policy

If we change this policy we'll update the "Last updated" date above. If a change affects how we use your email, we'll tell you by email before it applies.