Privacy policy

Controller

Fabio Crestoni, Italy. A contact address for privacy requests will be published here before the public launch.

What we collect, and why

• Your public X identity (user id, username, display name, avatar) to show who made a commitment. Legal basis: contract. We don't store X access tokens.
• Your email, only if you add one in your account: it fills in the checkout when you pay for a later launch date. You don't need one to commit. Legal basis: contract.
• Public posts on X about your launch. We don't email founders: when you commit, the day before your timer ends and at the result, the Just Launch account on X may post about your launch mentioning your username. Those posts are public, like the launch page, and never reveal what you hide until the timer ends. Legal basis: contract.
• Waitlist and newsletter emails, with double opt-in. Legal basis: consent, revocable at any time with the unsubscribe link. Waitlist addresses stay with Just Launch: founders see how many people are waiting, never who. We email the waitlist once, when the timer ends, and that email may carry one line from a sponsor, marked as such.
• What a sponsor gives us: an email, the name to show, the line to show and the link it points at. The email is only used for the receipt, the private link to the placement, a notice two weeks before a sponsored excuse ends, and anything that goes wrong with the payment; it is never shown on the site and never added to a mailing list. The name, the line and the link are public, because they are the placement. We fetch the icon of the site you link, from our servers, and cache it. Legal basis: contract.
• Pseudonymous technical data (keyed hashes of IP and user agent) for rate limiting, abuse prevention and click counts.

Processors

• Resend (transactional email and newsletter), under their DPA.
• Hetzner (hosting, EU).
• Google (Gemini) and TypeSafe AI (Jev), for the two reviews the verifier runs on a launch page: the visible text of that public page goes to TypeSafe, and a screenshot of it goes to Google. Only the page is sent, never your email, your X handle or anything else about you, and only for a page that looks like a single landing page.
• Dodo Payments (merchant of record for sponsored rows, sponsored excuses and paid launch dates: payment, tax and invoicing). We keep only your email, the amount and the payment id.
• DataFast (privacy-friendly visit analytics, cookieless: nothing persistent stored on your device). Besides visits it counts a few actions, like joining a waitlist, committing to a launch or opening a checkout, with categories and yes/no flags only: never your email, your X handle or anything a hidden launch keeps hidden. When you open a checkout, DataFast's visitor id for this browser session, which it rotates daily, goes along with the payment so it can be attributed to the page that brought you.

Cookies

A technical session cookie when you sign in, a convenience cookie holding the email you last typed into a waitlist form so you don't retype it (one year, this browser only), and one holding the language you picked. No analytics or advertising cookies: visit statistics are collected without cookies.

Retention

Commitments and their results are public records and kept for as long as the service runs. Unsubscribed addresses are kept only as a flag to honor the opt-out.

Your rights

Access, rectification, erasure where applicable, restriction, portability, objection, and complaint to the Garante per la protezione dei dati personali.