Privacy policy
Short version
This site asks for one thing: an email address, so we can tell you when BCKDOOR launches. Nothing else is collected, nothing is stored on your device, and nothing is loaded from anyone else's servers.
Who is responsible
One person decides why your email address is collected and what happens to it, and answers for that:
- Name
- Jackson Brown
- bckdoorapp@gmail.com
- Postal address
- Via Tofane 2
31100 Treviso TV
Italy
Other people work on BCKDOOR. They do not decide what happens to the waitlist, so they are not controllers of your data.
No data protection officer has been appointed. Art. 37 GDPR does not require one for processing on this scale.
No cookies, no storage, no third parties
This was checked against the source, not assumed:
- No cookies are set.
- No
localStorage,sessionStorageorindexedDBis used. - No analytics, no tag manager, no tracking pixels, no embedded videos, no social buttons.
- The font is served from this domain. Nothing is requested from Google's servers, so your IP address is never disclosed to Google on page load.
- Every image and icon is either served from this domain or inlined into the page.
Because nothing is stored on or read from your device, Art. 122 of the Italian Codice Privacy — which implements Art. 5(3) of the ePrivacy Directive — is not engaged, and there is no consent banner to click.
The waitlist form
What is stored
- The email address you typed, lowercased.
- The date and time of the signup and of your confirmation.
- A source tag, e.g.
landing, recording which form the signup came from. - A keyed hash of your IP address. The address itself is never written to disk. The hash is an HMAC-SHA-256 under a secret key, which is what stops it from being reversed by hashing every possible address.
No name, no browser fingerprint, no tracking identifier.
Why
| Purpose | Legal basis |
|---|---|
| Emailing you once, about the launch | Your consent, Art. 6(1)(a) GDPR. You gave it by ticking the box and then opening the confirmation link. You can take it back at any time. |
| Keeping the timestamps and the IP hash | Demonstrating that the consent was actually given, which Art. 7(1) and Art. 24(1) GDPR require of the controller. |
| Rate-limiting submissions per IP hash | Legitimate interest in not having the form abused, Art. 6(1)(f) GDPR. |
The confirmation email
Your address is not on the list until you open the link we email you. If you never open it, the entry stays unconfirmed and is never used. This two-step process exists because the Italian supervisory authority treats it as a minimum measure for documenting marketing consent (Garante, provvedimento n. 330 of 4 June 2025, doc. web 10143278).
Who else sees it
Two processors under Art. 28 GDPR, both storing the data inside the European Union:
- Cloudflare, Inc.
- Hosting and the database. The database was created with
Cloudflare's EU jurisdiction constraint, which
means it only runs and stores data within the European Union —
verified as
jurisdiction: eu, regionEEUR. That constraint cannot be changed after creation, so it cannot silently drift. Cloudflare's data processing addendum - Resend (Plus Five Five, Inc.)
- Sends the confirmation email and, later, the launch email. The
sending region is Ireland
(
eu-west-1), so this leg stays inside the EU too. Resend's privacy policy and data processing agreement
Neither provider is used to transfer your address outside the EEA in the ordinary course of things. Both companies are incorporated in the United States, however, so their staff can in principle be asked to access data for support or administration. Both rely on the Standard Contractual Clauses and on the EU–US Data Privacy Framework for that case.
How long
| What | Kept for |
|---|---|
| A signup that was never confirmed | 30 days, then deleted automatically. The confirmation link itself expires after 7. |
| A confirmed signup | Until you unsubscribe. Every email we send carries an unsubscribe link, and you can also just write to the address above. |
| If BCKDOOR never launches | The whole list is deleted 24 months after the last signup. |
The first two run on a scheduled job once a day, not on request. The third is a commitment we have to keep by hand, so it is written down here to be held to.
Rate-limiting records are deleted automatically once they fall outside the one-hour window.
Your rights
Under Art. 15 to 22 GDPR you can ask for access to your data, for it to be corrected or deleted, for the processing to be restricted, and for a copy in a portable format. Because the processing rests on consent, you can withdraw that consent at any time under Art. 7(3) GDPR, which stops any further use — write to the address above, or use the unsubscribe link in any email we send. Withdrawing does not make what happened before it unlawful.
You can also complain to a supervisory authority under Art. 77 GDPR. In Italy that is the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma, garanteprivacy.it.
Changes
The date at the top of this page changes whenever we update it. If we ever want to use your address for something other than what is described here, that needs your consent separately — a changed date is not a way around that.