Privacy policy

As of 30 September 2026.

1. Who is responsible

Controller under the GDPR (DSGVO) ("Verantwortlicher"): see the Impressum for name and postal address. Contact for all privacy questions: [email protected]. We have not appointed a data protection officer; we are not required to (§ 38 BDSG).

2. Visiting this website

The website is delivered by Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, as our processor. To deliver the pages and protect them against attacks, Cloudflare processes technical data of every request: IP address, date and time, requested address, referrer, browser and operating system. Legal basis: our legitimate interest in a secure and working website (Art. 6 (1) (f) GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework; we have concluded a data processing agreement with Cloudflare. We do not keep these request logs ourselves.

We use no analytics and no tracking on this website. The public pages set no cookies; the only cookie is the sign-in cookie of the private playground (section 3).

3. The playground (the Stackrig app)

The simulation runs entirely in your browser. Designs you create are stored only in your browser's local storage (IndexedDB) on your device; we do not receive them. When you create a share link, the design is encoded in the part of the link after "#", which browsers do not send to any server; whoever you give the link to can read the design. Exported files stay on your device.

Sign-in during the private preview: until Stackrig opens, the playground (stackrig.dev/app) is available only to people we invited. The sign-in is provided by Cloudflare Access (Cloudflare, Inc., see section 2, as our processor): you enter your email address, Cloudflare sends you a one-time code, and after signing in your browser stores a cookie (CF_Authorization) that proves the sign-in for up to one week. This cookie is strictly necessary to provide the playground you asked for (§ 25 (2) no. 2 TDDDG). Cloudflare records the email address, IP address, time and result of each sign-in in an access log that we can view; we use it only to manage access. We keep your address on the invitation list until the private preview ends or you ask us to remove it. Legal basis: Art. 6 (1) (b) GDPR (you asked us for access) and our legitimate interest in keeping the preview private (Art. 6 (1) (f)).

4. The waitlist

What we store:

• your email address,
• your optional answers: what describes you best, and whether and how much you would pay,
• the version of the consent text you agreed to, the time of sign-up and of confirmation, and the times and number of emails we sent you (to limit resending),
• cryptographic fingerprints (hashes) of the confirmation and deletion links we sent you – not the links themselves.

We do not store your IP address with your entry. To protect the form against abuse, the number of requests per IP address is counted for one minute by Cloudflare's rate limiter and then discarded.

Purpose: to tell you when Stackrig opens, and to ask you for feedback on the product (for example, whether you would like to talk to us). We evaluate the optional answers only as totals (how many people chose which answer) to decide on the product and its prices. No newsletter, no advertising, no passing on to third parties for their own purposes.

Legal basis: your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time with effect for the future: with the link in every email we send, or on the waitlist page, or by email to [email protected]. Withdrawing deletes your entry immediately.

Double opt-in: after you sign up, we send you an email with a confirmation link. Only confirmed addresses are on the waitlist. If you do not confirm within 48 hours, the link expires and your entry is deleted automatically within the following day. We keep the time of sign-up and of confirmation as proof of your consent for as long as the entry exists.

How long: until you withdraw your consent, and at the latest until 12 months after the public launch of Stackrig on 30 September 2026, whichever comes first. Then all waitlist entries are deleted automatically.

Service providers (processors) for the waitlist:

• Cloudflare, Inc. (USA) runs the waitlist interface (Cloudflare Workers) and the rate limiter; see section 2 for the transfer basis.
• Supabase, Inc., 970 Toa Payoh North #07-04, Singapore 318992, stores the waitlist in a database in Frankfurt am Main, Germany (Amazon Web Services, region eu-central-1). Access from outside the EU by the provider cannot be excluded; it is covered by the EU standard contractual clauses in Supabase's data processing agreement (Art. 46 (2) (c) GDPR).
• Brevo (Sendinblue SAS), 106 boulevard Haussmann, 75008 Paris, France, sends the emails. Data is processed on servers in the EU. Open and click tracking are switched off.

5. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time (Art. 7 (3)). Write to [email protected]. You also have the right to lodge a complaint with a supervisory authority (Art. 77), in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement.

6. Is providing data required?

No. Joining the waitlist is voluntary. Without an email address we cannot tell you about the launch. The two questions are optional.

7. Changes

We update this policy when our services change (for example when accounts or paid plans are introduced). The date at the top shows the current version.