Pre-launch privacy summary · July 23, 2026
Privacy starts with asking for less.
This page documents the current waitlist design. It is not an active production privacy notice and must be reviewed with the operating entity, contact details, processors, and country-specific requirements before public data collection begins.
What the waitlist is designed to collect
A verified email; canonical country and metro; an opaque coarse-area identifier; household stage and size bucket; optional adult and child age bands; optional Indian state and hometown; up to three connection goals; travel-radius bucket; consent records; and pseudonymous campaign or referral attribution.
What it does not collect in this phase
No exact address, raw postal or ZIP entry after normalization, home coordinates, child or adult names, exact birth dates, school, phone number, photos, social profile, religion, caste, income, profession, immigration status, or public family profile.
Why the information is used
To operate and secure the early-access waitlist, confirm inbox control, measure qualified interest by broad area and cohort, contact people who separately permit research, attribute community campaigns, and decide where future availability may be viable. It is not sold or used to build advertising audiences.
Email confirmation and referrals
Email confirmation proves inbox control only. It does not verify identity, family status, ethnicity, or safety. Referral links are opaque; a referral counts internally only after a separate qualified household verifies its own email.
Facebook, WhatsApp, and contact lists
We do not import Facebook group members, request a WhatsApp contact list, upload address books, or ask one household to provide another family's email address. A verified member may choose to share an opaque referral link through a channel they control.
Retention and control
Unverified records are designed to expire after seven days. Verified records are scheduled for consent renewal or deletion after twelve months of inactivity. A private management link lets the email owner unsubscribe or delete the signup information.
Processors and international use
The planned providers are Google Cloud Firestore for server-side storage, Google Places for location normalization, Resend for transactional email, and Cloudflare Turnstile for abuse prevention. Identified signup is initially limited to Canada and the United States. Final processor terms, transfer disclosures, and contact information remain launch blockers.
Replace this pre-launch summary with the reviewed notice and accountable organization/contact details before setting PRIVACY_NOTICE_APPROVED=true.