What happens to your email address.

1. Who we are

Signal Inbox is operated by GetSignalInbox, the data controller for the waitlist described on this page. The contact address in section 12 reaches the people responsible directly.

This policy covers the getsignalinbox.com website and the waitlist API behind it (api.getsignalinbox.com). The Signal Inbox product does not exist yet; when it does, this policy will be replaced with one that covers it.

2. What the form collects

Submitting the email form writes one row to our database. That row has four columns, and this is all of them:

No name. No IP address. No user agent, device fingerprint, referrer, location, or marketing profile. There is no second table.

Handled in passing, never stored

Three things touch the request without ending up in the database, and it would be dishonest to leave them out:

• Your IP address. The API reads it from the connection to enforce a rate limit — ten submissions a minute — so the form cannot be flooded. It is used as a counter key inside Cloudflare's rate limiter and is never written to our database. The lawful basis for that is our legitimate interest in keeping the service available and the list clean (Article 6(1)(f) GDPR).
• A hidden field. The form includes a field that is invisible to people and attractive to bots. If it arrives filled in, the submission is discarded and nothing at all is stored.
• One log line. Each submission writes a log entry recording the source tag and whether the address was new to the list. It contains no email address and no IP address. It lives in Cloudflare's log retention and expires on their schedule.

3. Why we collect it

One purpose: to email you when there is something worth running. That is the announcement the form promises, and it is the only thing the address is used for.

We do not sell, rent, or share the list. We do not run a newsletter. We do not use it to build audiences, look you up elsewhere, or match you against anything. There is no automated decision-making and no profiling.

4. Lawful basis

Consent — Article 6(1)(a) GDPR. You gave it by typing your address into a form that says what it is for, and pressing the button.

You can withdraw it at any time, for no reason, at no cost, and it must be as easy to withdraw as it was to give (section 6). Withdrawing does not make the processing that already happened unlawful; it stops any further processing and removes the record.

5. How long we keep it

Until the launch announcement goes out, or until you ask to be removed — whichever happens first. Once the announcement has been sent, the waitlist has done its job and the list is deleted; if a mailing list exists after launch, joining it will be a fresh, separate decision.

Removal requests are actioned within 30 days and in practice within a few days. One caveat we would rather state than hide: our database keeps point-in-time backups for up to 30 days, so a deleted row can survive in those backups until they age out. It is not read or used in the meantime.

6. Getting removed

Email privacy@getsignalinbox.comand say you want off the waitlist. If you write from the address you signed up with, that is all we need; otherwise tell us which address to delete. No account, no login, no form to fill in, and we will not ask you why.

Every email we send to this list carries a working unsubscribe link, which does the same thing: deletes the record rather than flagging it.

7. Who else touches it

One company, plus one thing your browser does on every page load.

Cloudflare — hosting and database

This site, the waitlist API, and the database (Cloudflare D1) all run on Cloudflare. Cloudflare processes the data on our instructions as a processor under its Data Processing Addendum. Data is encrypted at rest and in transit.

The database is not currently pinned to an EU region, so your address may be stored or processed outside the EEA. Those transfers rely on Cloudflare's Standard Contractual Clauses and its certification under the EU–US Data Privacy Framework.

Nobody else

No email delivery provider is connected yet. When one is chosen to send the launch announcement, it will be named here before a single message goes out. Same commitment for any future sub-processor: named on this page first.

8. Your rights

Under the GDPR you can ask us to:

• Access — tell you whether we hold your address and give you a copy of the record. Given what is stored, this is a short reply.
• Rectify — correct an address that is wrong.
• Erase — delete the record. This is the same thing as unsubscribing, and it takes no more than an email.
• Restrict or object — stop us using the record while something is being sorted out.
• Port — receive the data in a machine-readable form, or have it sent elsewhere.
• Withdraw consent — at any time, as described in section 4.

Requests are free and answered within 30 days. Use the address in section 12. Because the only identifier we hold is the email address itself, writing from that address is normally proof enough; we will not demand ID documents to delete a row.

You also have the right to complain to a supervisory authority — the data protection authority in the EU or EEA country where you live, where you work, or where you think something went wrong. You do not have to raise it with us first, though we would rather you did, because we can usually fix it the same day.

9. Cookies and tracking

This site sets no cookies at all. Not analytics cookies, not advertising cookies, not even strictly necessary ones — there is no session to keep and nothing to remember. That is why you were not shown a cookie banner: there is nothing to ask you about.

There is no analytics on this site. No Google Analytics, no Plausible, no Cloudflare Web Analytics, no tracking pixels, no session recording, no A/B testing, no fingerprinting, no advertising tags. Nothing in these pages reads or writes local storage or session storage.

The typefaces on this site are served from our own domain, so no font provider sees your visit. Apart from fetching its own files, the only request this site makes on your behalf is the one that submits the form toapi.getsignalinbox.com. That is enforced, not just promised: a Content Security Policy sent with every page restricts the browser to those destinations, so a third-party tracker would not load even if one were added here by mistake.

10. What the product won't collect

Signal Inbox is not built yet, so nothing below is in operation. These are architectural decisions already made, and they are the reason this policy is expected to stay short:

• Model credentials never leave your machine. Agents run through the CLIs you already installed, with the keys you already hold. The most sensitive thing in this workflow never reaches our servers.
• Your code is not stored by us. GitHub is the diff viewer. Work happens in a git worktree on your hardware and lands on a branch you push.
• Concurrency is metered, tokens are not. We count how many tasks run at once, not what you spent them on. There is no usage surveillance to justify.
• The runner will be open source. Every byte it sends off your machine is publicly auditable, so none of this has to be taken on trust.

When the product handles real data, this policy will be replaced with one that describes it properly — including a data processing agreement for anything we handle on your behalf.

11. Changes to this policy

The date at the top is the date of the last change. If something material changes while your address is on the list — a new sub-processor, a new purpose — you will be told about it, and a new purpose would mean asking for consent again rather than assuming it.

12. Contact

Privacy questions, removal requests, and rights requests all go to the same place —privacy@getsignalinbox.com. A person reads it.