Privacy Policy
Last updated: June 4, 2026
Heads up — placeholder notice.
This document describes our actual practices for the email-only StkFlw waitlist. It will be reviewed and expanded into a fuller policy before the product itself launches and begins handling any health-related data.
What we collect
When you submit the waitlist form, we collect your email address and the timestamp of your submission. We do not collect your name, IP address (beyond the transient rate-limit window described below), browsing history, or any other personal information.
Why we collect it
We use your email for one purpose only: to notify you when StkFlw is ready for early access, and to send you the invitation when that time comes. We do not send marketing emails, newsletters, or promotions to the waitlist.
Where this applies
The StkFlw waitlist is intended for residents of the United States. Please don't sign up if you are located outside the US. If you are in the EU, UK, or another region with its own data-protection rules and you'd like your email removed, contact us using the address below and we'll delete it.
How we store it
Email addresses are stored in a PostgreSQL database (running the open-source Supabase stack) that we host and operate ourselves on our own infrastructure in the United States — it is not a third-party Supabase cloud account. Access is restricted to the application's service credentials. Encrypted backups are stored on storage we control.
Rate limiting
When the waitlist form is submitted, your IP address is temporarily held in server memory for up to one minute to prevent automated abuse. This data is not written to the database, not associated with your email, and is discarded automatically. We do not use cookies or browser fingerprints.
How long we keep it
We keep your email only as long as we need it for the waitlist: until you receive your early-access invitation, or until you ask us to remove it — whichever comes first. If you ask, we delete it within 7 days. After launch, any address that hasn't been used to create an account is deleted within 90 days.
How to delete your data
Email [email protected] with the subject line “Remove me from waitlist.” We'll delete your record within 7 days and confirm by reply.
Third parties
We do not sell, rent, or share your email with anyone. The database itself is self-hosted on our own infrastructure, so no third-party database provider holds your data. The one service provider in the path is Cloudflare, which provides the network and content-delivery layer that routes traffic to this site (and handles the email forwarding for the address below). Cloudflare may process connection metadata such as IP addresses as part of delivering and securing that traffic.
Children
StkFlw is not directed at children under 13, and we do not knowingly collect email addresses from them. If you are under 13, please do not submit the waitlist form. If you are a parent or guardian and believe your child submitted their email, contact us at the address below and we will delete it — and if we otherwise learn that an address belongs to someone under 13, we delete it.
Health data note
StkFlw collects only your email at this stage. We do not collect supplement use, dosage, health conditions, or any other health information from waitlist sign-ups. When the product launches, the in-app data practices will be described separately and governed by the launch privacy policy.
Changes to this policy
When we update this policy, the “Last updated” date at the top will change. Significant changes affecting already-collected data will be communicated by email to everyone on the waitlist.
Contact
Questions about this policy? [email protected]