Your trust is what matters, not your data.

When you join, we store your email address, the platform you signed up from (macOS or Windows), the text shown next to the form, how many confirmation emails we sent, and the time and IP address of your sign-up and of your confirmation. Nothing else: no name, no company, no analytics profile.

If you don't confirm, we delete the sign-up after 30 days. Once you confirm, we keep your email until you leave the list, or until we close the waitlist after launch.

The times, IP addresses and form text prove that you asked to join. We keep them as long as your email is on the list (Art. 7 (1) with Art. 6 (1) (f) GDPR).

First an email with a link to confirm your sign-up. Only once you open that link are you on the list. If you ask for it again, we send it again, at most five times. Then we write when the app is available to download and when there is a new version, and about nothing else.

Every email has a link to leave the list. Leaving deletes your email and everything stored with it; it does not just flag it. You can also write to hello@ostiofiles.com.

If you write to us through the form, we store your name (if you give it), your email address and your message, and use them only to answer you. A copy goes to our mailbox. We delete both, the stored message and the copy in our mailbox, within 12 months.

Email you send us directly lands in the same mailbox.

The waitlist and contact forms use Cloudflare Turnstile, an invisible check that tells people from bots. It loads only when you click or type in a form, not when you open a page.

Turnstile runs in your browser and sends Cloudflare signals such as your IP address, your browser's user agent and details of the connection. It doesn't read what you type into the form. Cloudflare uses the signals for us to stop bots, and also on its own behalf to improve its bot detection. Details, cookies included, are in Cloudflare's Turnstile privacy addendum.

Supabase Pte. Ltd. keeps the waitlist and the contact messages for us in a database in Frankfurt, Germany, under its data processing agreement. Supabase is based outside the EU, so the agreement includes the EU standard contractual clauses.

Brevo GmbH (Berlin), part of the Brevo group of Sendinblue SAS (Paris), sends our emails: the confirmation emails, and a note to our mailbox for each contact form message. It works under its data processing agreement, which is part of its terms, on servers in the EU. For every email we tell Brevo that you have not agreed to tracking, so Brevo counts opens and clicks only anonymously, as totals, never tied to your email. Links in our emails may still pass through Brevo on their way to this site. The logo in our emails loads from this site, so opening an email can show up in the request logs below.

Cloudflare, Inc. (USA) hosts this site, keeps its request logs (see below) and runs the bot check. It is certified under the EU-US Data Privacy Framework.

Google Cloud EMEA Limited (Ireland) runs our mailbox (Google Workspace). Where Google processes data in the USA, it relies on the EU-US Data Privacy Framework, under which Google LLC is certified.

Nobody else: the list is not sold, rented or handed to an advertising network.

There are no analytics and no tracking on this site. It sets one cookie, named “os”, only if you pick macOS or Windows with the switch at the top of the home page, so the site remembers your choice. Fonts are served from this site, so your browser does not contact Google.

Cloudflare keeps logs of the requests to this site (IP address, time, page) for at most seven days, to keep the site running and protect it from abuse.

The Discord icon in the menu opens our Discord server in a new tab. That is Discord’s site, so once you click it, Discord’s own privacy policy applies. Nothing on this site is loaded from Discord.

You can ask what we store about you, have it corrected or deleted, restrict or object to its use, and take it with you. You can also complain to a data protection authority.

The waitlist is based on your consent (Art. 6 (1) (a) GDPR), which you can withdraw at any time by leaving the list. A message through the contact form is based on Art. 6 (1) (b) GDPR when it is about a contract or a question before one, and otherwise on our legitimate interest in answering people who write to us (Art. 6 (1) (f) GDPR). The bot check and the server logs rest on our legitimate interest in a working, safe site whose forms can't be abused (Art. 6 (1) (f) GDPR).

Noureldin Salah Abaas Saad Shobier, c/o POSTFLEX PFX-695-442, Emsdettener Straße 10, 48268 Greven, Germany. Write to hello@ostiofiles.com; a person reads it.