Privacy policy
Draft — not legal advice
This is a scaffold for a privacy notice, not a finished one. It was assembled from published sources by a software tool, not by a lawyer, and it has not been reviewed by one. Do not publish it as it stands.
Two things in particular are not decided here. Which supervisory authority is competent depends on the operator's place of establishment, which is unresolved — see the project README. And an English-only notice is very likely not enough for users in Italy: the Garante has criticised exactly that (provvedimento of 10 April 2025, doc. web 10130115). The Italian version needs a human translator, not a machine.
Short version
This site asks for one thing: an email address, so we can tell you when BCKDOOR launches. Nothing else is collected, nothing is stored on your device, and nothing is loaded from anyone else's servers.
Who is responsible
One person decides why your email address is collected and what happens to it, and answers for that:
- Name
- Jackson Brown
- bckdoorapp@gmail.com
- Postal address
- Via Tofane 2
31100 Treviso TV
Italy
Other people work on BCKDOOR. They do not decide what happens to the waitlist, so they are not controllers of your data. TODO this has to stay true in practice — if the group starts deciding together, everyone becomes a joint controller under Art. 26 GDPR whatever this page says
No data protection officer has been appointed. Art. 37 GDPR does not require one here. TODO have the lawyer confirm
No cookies, no storage, no third parties
This was checked against the source, not assumed:
- No cookies are set.
- No
localStorage,sessionStorageorindexedDBis used. - No analytics, no tag manager, no tracking pixels, no embedded videos, no social buttons.
- The font is served from this domain. Nothing is requested from Google's servers, so your IP address is never disclosed to Google on page load.
- Every image and icon is either served from this domain or inlined into the page.
Because nothing is stored on or read from your device, Art. 122 of the Italian Codice Privacy — which implements Art. 5(3) of the ePrivacy Directive — is not engaged, and there is no consent banner to click.
The waitlist form
What is stored
- The email address you typed, lowercased.
- The date and time of the signup and of your confirmation.
- A source tag, e.g.
landing, recording which form the signup came from. - A keyed hash of your IP address. The address itself is never written to disk. The hash is an HMAC-SHA-256 under a secret key, which is what stops it from being reversed by hashing every possible address.
No name, no browser fingerprint, no tracking identifier.
Why
| Purpose | Legal basis |
|---|---|
| Emailing you once, about the launch | Your consent, Art. 6(1)(a) GDPR. You gave it by ticking the box and then opening the confirmation link. You can take it back at any time. |
| Keeping the timestamps and the IP hash | Demonstrating that the consent was actually given, which Art. 7(1) and Art. 24(1) GDPR require of the controller. |
| Rate-limiting submissions per IP hash | Legitimate interest in not having the form abused, Art. 6(1)(f) GDPR. TODO the lawyer should sanity-check this basis and whether a balancing-test note is wanted |
The confirmation email
Your address is not on the list until you open the link we email you. If you never open it, the entry stays unconfirmed and is never used. This two-step process exists because the Italian supervisory authority treats it as a minimum measure for documenting marketing consent (Garante, provvedimento n. 330 of 4 June 2025, doc. web 10143278).
Who else sees it
Two processors under Art. 28 GDPR:
- Cloudflare, Inc.
- Hosting and the database. TODO confirm the database was created with the EU jurisdiction constraint, so that it runs and stores data inside the European Union
- TODO mail provider
- Sends the confirmation and the launch email. TODO name it, link its own privacy terms, and sign a data processing agreement before going live
TODO third-country transfers — if either provider processes data outside the EEA, the notice has to say so and name the safeguard relied on under Chapter V GDPR.
How long
| What | Kept for |
|---|---|
| A signup that was never confirmed | 30 days, then deleted automatically. The confirmation link itself expires after 7. |
| A confirmed signup | Until you unsubscribe. Every email we send carries an unsubscribe link, and you can also just write to the address above. |
| If BCKDOOR never launches | The whole list is deleted 24 months after the last signup. |
The first two run on a scheduled job once a day, not on request. The third is a commitment we have to keep by hand, so it is written down here to be held to.
Rate-limiting records are deleted automatically once they fall outside the one-hour window.
Your rights
Under Art. 15 to 22 GDPR you can ask for access to your data, for it to be corrected or deleted, for the processing to be restricted, and for a copy in a portable format. Because the processing rests on consent, you can withdraw that consent at any time under Art. 7(3) GDPR, which stops any further use — write to the address above, or use the unsubscribe link in any email we send. Withdrawing does not make what happened before it unlawful.
You can also complain to a supervisory authority under Art. 77 GDPR. In Italy that is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it. TODO confirm this is the competent authority once the place of establishment is settled
Changes
TODO say how changes will be communicated