Privacy

Who is responsible

Sin & Signal – Justin Schaarschmidt, c/o Online-Impressum, Europaring 90, 53757 Sankt Augustin, Germany, support@sinandsignal.com. See the Impressum / Legal Notice. No data protection officer is appointed, because none is required at this size. Write to the address above about anything on this page.

When you visit

The site is hosted by Cloudflare, Inc., USA, which acts as our processor. To deliver the pages and keep them secure, its servers process your IP address, the time of the request, the page requested and technical browser details. Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a working, secure website. Cloudflare publishes no fixed retention period for these logs; they are kept only as long as needed for delivery and security.

Data may reach the USA. Cloudflare relies on the EU-US Data Privacy Framework and, as a fallback, the EU Standard Contractual Clauses.

This website sets no cookies of its own and uses no analytics, ads or tracking pixels. Fonts, images and audio load from this site. If you tap the Instagram link, Instagram's own privacy rules apply there.

After you tap to enter, your browser keeps one small note in session storage so the opening doesn't play again. It holds no personal data, never leaves your device and disappears when you close the tab.

The waitlist

What and why. If you sign up, we process your email address, your IP address, the time of signup and confirmation, and the consent wording you agreed to. We use them to email you about the launch of the app and related launch news, and to be able to prove your consent. Signing up is voluntary. Nothing is decided about you automatically.

Legal basis. Your consent, Art. 6(1)(a) GDPR, and Art. 7(3) lets you withdraw it at any time, via the link in every email or by writing to us. Withdrawal doesn't affect what happened before it. Keeping proof of consent rests on Art. 6(1)(f) GDPR, our legitimate interest in being able to show the emails were lawful.

Double opt-in. You get a confirmation email first. Nothing further is sent unless you confirm. Unconfirmed signups are deleted after 30 days.

Measuring emails. Emails use a pixel and tracked links that show per recipient whether an email was opened and which links were clicked. This is covered by your consent and ends when you withdraw it.

Provider. The list runs on Brevo ([check: exact company name and address in the Brevo contract]), EU, which acts as our processor. [check: hosting location and any non-EU sub-processors in the Brevo contract]

How long. We keep your address until you withdraw or the launch news is over, whichever comes first. We then keep only the proof of your consent for three years after withdrawal, used for nothing else.

Age. You must be 16 or older to sign up. If we learn someone younger has signed up, we delete the entry.

When you write to us

Mail to support@sinandsignal.com or creators@sinandsignal.com passes through Cloudflare Email Routing and is forwarded to our mailbox. The contact form sends your email address and message through Cloudflare, as our processor, to the same mailbox. The website itself stores nothing you enter. We use your message to answer you, never for marketing, and keep it as long as the matter requires. Legal basis: Art. 6(1)(f) GDPR, or Art. 6(1)(b) GDPR where it concerns a contract.

When you apply as a creator

If you apply on the creators page, you give us your account, country and email address and confirm that you are 18 or older. The form sends them through Cloudflare, as our processor, to our mailbox. The website itself stores nothing you enter. We also look at the public profile you name.

We use this to review your application and to email you about the creator program. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time by writing to us, and Art. 6(1)(b) GDPR for steps towards a contract you asked for. Withdrawal doesn't affect what happened before it. Applying is voluntary.

If nothing comes of it, or you withdraw, we delete your application within 30 days and keep only your account name, so that we don't contact you again. Keeping that name rests on Art. 6(1)(f) GDPR. If we work together, the partner terms tell you what we keep and for how long.

Your rights

You have the right to access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18) and to a copy of your data (Art. 20).

Your right to object. Where we rely on Art. 6(1)(f) GDPR, you can object at any time for reasons arising from your situation (Art. 21 GDPR). Just write to us.

You can complain to a data protection authority, for example where you live. The one responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW, Düsseldorf). If you are in the UK, you can complain to us first; we acknowledge complaints within 30 days.