warmhop legal
Privacy notice
What we collect about the people who use warmhop, why, who else sees it, how long we keep it, and what you can ask us to do. If you followed a link and ended up here, the page you want is About this domain.
TL;DR
- We collect what we need to run warmhop: your email, your links, and what you tell us.
- No advertising, no selling your data, no data brokers. We only use it to improve warmhop's own check for telling people from bots, not to train anyone else's models or AI.
- You can download or delete your data yourself, or ask us at privacy@warmhop.com.
- Clicked someone's link? About this domain is written for you.
1.Who we are and how to reach us
This notice covers warmhop.com and explains what we do with data about you, the person creating tracked links: as a visitor, on the waitlist, on the Try page, and as an account holder.
- Who runs warmhop
- warmhop™ is run by an individual founder based in the United States. It is not yet a registered company. That person is the controller of the data this notice describes.
- Privacy questions and requests
- privacy@warmhop.com
- Help with your account
- support@mail.warmhop.com
- Data protection officer (Singapore PDPA) and grievance contact (India)
- privacy@warmhop.com
- EU representative (Article 27)
- None appointed yet. Signups and click recording are switched off for the EU, the EEA and the UK until one is.
2.What this notice covers
It covers this website, the Try page, the waitlist, the warmhop app and the emails we send you.
It does not cover:
- People who click a tracked link. If you followed a link and ended up here, the page you want is About this domain.
- The websites your links point to. They have their own privacy notices.
- Google, GitHub or Microsoft, if you sign in with them. They handle that sign-in under their own notices.
3.Before you have an account
A.The waitlist
If you join, we keep the email address you give us, when you joined, and the page or campaign that sent you. We use the address for two emails: a welcome now, and one when the beta opens. Every email has an unsubscribe link. We rely on your consent for this, and you can withdraw it at any time by unsubscribing or writing to us.
We keep the address until you ask us to remove it. If you never create an account, we delete it no later than 12 months after the beta opens.
B.Page analytics
On warmhop.com and its Try page we count page views, which sections are seen, and button presses. Each count carries a random id that lives in your browser tab and is gone when you close it, the page that sent you, and your rough location (country and city). No cookies, no advertising trackers, and nothing that follows you to another site. It is not linked to your email address. We rely on our legitimate interest in knowing whether the page works. We delete these counts after 12 months. These legal pages carry no analytics at all. In the EU, the EEA and the UK, and wherever we can't tell your country, we collect none of this. We only add one to that day's page-view total for your country, with nothing that identifies you.
C.The Try page's test link
For each click on a test link we keep the time, whether it looked like a person or a security bot, a rough location, and the kind of device. Your IP address, your browser string and the standard headers your browser sends with a page request are read to work that out and are not stored. Test links and their clicks are deleted after 24 hours. The link you made is remembered in your own browser so the page can show it again.
While we tune how we tell people from bots, we may keep a separate research record of what happened to a test link, for longer: when each request came, the verdict, the browser's name and version, which standard request headers were present, the TLS fingerprint of the connection (the same for everyone on the same browser version) and, for requests from a data centre or corporate network, that network's published address range. It also notes whether the link's second step was followed and how quickly, whether the log button in the email was opened, and what the test page saw in its first 30 seconds on screen: whether a tap, scroll or key press happened, whether the page was visible, and whether the browser said it was automated. A small script on that page works this out; it stores nothing on your device and only runs in countries where we record full click details. To tell whether both steps came from the same network, we compare scrambled forms of the address, kept for up to an hour and never saved with the record. Records from one test link share a random code, and once the link is deleted after 24 hours nothing ties that code back to it. It holds nothing that identifies you: no IP address, no browser string, no email address.
D.Emailing yourself the test link
If you ask us to email you the link, we use the address once to send it and do not store it. To stop one inbox getting more than two a day, a scrambled form of the address is kept for up to a day; it cannot be turned back into the address without a key that changes daily. Our email provider, Resend, keeps its own delivery record (the address and the time) for 30 days. We count how many of these emails go out, without the address. We rely on your request for this.
E.Preventing abuse
On all of the above we use your IP address to limit abuse. It sits in a short-lived counter for up to one day and is never written to our database.
Forms that send an email or sign you in (signing in, joining the waitlist, emailing yourself a test link, and the password, code and account-deletion steps in your settings) first run a check from Cloudflare, called Turnstile, that tells people from bots. It loads only on those forms, and on the waitlist and Try page only once you click into the email field. Cloudflare receives your IP address, details of your browser (its user agent and connection fingerprint) and which of our pages asked. We get back a pass or a fail and keep neither. Cloudflare runs the check for us, and also uses the same details as its own controller to improve how it spots bots; see Cloudflare's Turnstile privacy policy. We rely on our legitimate interest in keeping these forms from being abused.
4.What we collect when you have an account
A.Your account
- your email address
- your authentication identity, if you sign in with a provider such as Google
- a display name and time zone, if you give them (both are optional)
- your signed-in sessions: our sign-in provider records the browser and network address of each one, and we show you the device and when it was last active in Settings, so you can end any you do not recognise
- your email and notification preferences
- the account emails we send you (sign-in codes, reset and confirmation links, and notices when your password, email or sign-in methods change): our app writes each one and sends it through Resend, and keeps no copy. To stop abuse we count how many go to each account, for up to a week, and from each network address, for up to a day
B.Your links
- the destination address
- a display name you choose
- any tags you add
- which plan you are on
- the click records for your links, described in About this domain
C.Payments, if you subscribe
Payments are handled by Stripe. We never see or store your full card number. We keep your Stripe customer reference, your plan, its billing period and its status, so we can give you what you paid for.
D.Messages you send us
If you send feedback from the app or email us, we keep your message, anything you attach, and the page you sent it from, so we can answer and fix what you report.
E.Using the dashboard
- ordinary server logs, kept briefly for security and debugging
- error reports when something breaks, which describe the error and the page. Our error monitoring is set not to store your IP address or other personal details.
We do not ask for your phone number, your postal address, or payment details unless and until you subscribe to a paid plan. We do not collect sensitive data such as health, religion or financial account details, and we ask you not to put it in your links or tags.
5.Why we use it, and our legal basis
We use your data only for the purposes below. Where a law asks for a legal basis (for example the GDPR, Article 6), this is the one we rely on:
- Running your account and your links
- Performance of our contract with you (Art. 6(1)(b))
- Emailing you about activity on your links
- Performance of our contract with you
- Taking payment, if you subscribe
- Performance of our contract with you
- The waitlist emails
- Your consent (Art. 6(1)(a)), which you can withdraw at any time
- Keeping the service secure and preventing abuse
- Our legitimate interests (Art. 6(1)(f))
- Knowing whether the website works (page analytics)
- Our legitimate interests
- Keeping tax and payment records, and answering lawful requests
- Our legal obligations (Art. 6(1)(c))
- Enforcing our Terms and defending legal claims
- Our legitimate interests
We do not use your data for automated decisions that have legal or similarly significant effects on you.
7.Emails we send
- When a link of yours is clicked by a person for the first time. You can turn this off.
- A weekly summary, if there was activity. You can turn this off.
- Account, billing and security emails. These we have to send, and they cannot be turned off while you have an account.
- The two waitlist emails, if you joined it.
We do not send marketing email without asking first. Replies to our emails reach a person at support@mail.warmhop.com.
9.Where your data is held
Our providers store and process your data in the United States. If you use warmhop from another country, your data is transferred to the United States, whose privacy laws may differ from yours. We rely on our providers' contractual commitments to protect it to the standard this notice describes.
We do not currently offer the service in the EEA or the UK. If that changes, this section will say how transfers out of those places are covered.
10.How long we keep it
Your account data stays while your account exists.
When you ask to delete your account, it is deleted 7 days later. Signing back in within those 7 days cancels the deletion. You choose what happens to your links:
- Delete everything, the default. Your links, their history, and their tags are removed, and the links stop working immediately.
- Keep the links working. Because your links may be inside documents you have already sent and cannot edit, you can choose to leave them redirecting so nobody following one hits a dead end. If you do, all click history and all tags are deleted immediately. Only the redirect survives, and we remove it entirely after 12 months.
Click data has its own schedule, described in About this domain. Waitlist, analytics and Try page data follow the periods in section 3.
We keep payment records for as long as tax law requires, even after your account is deleted. Deleted data can remain in encrypted backups for a limited time until they are overwritten; we do not restore it from them except to recover from a failure.
11.How we protect it
Data travels encrypted (HTTPS) and is encrypted at rest by our database provider. Access is limited to what each part of the service needs, and the database enforces that every account can reach only its own rows. No method is perfectly secure, so we cannot promise that a breach will never happen.
If a breach affects your data, we will tell you, and the regulators where the law requires it, without undue delay.
12.Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, object to processing based on legitimate interests, or receive it in a portable format. Where we rely on your consent, you can withdraw it at any time.
Much of this you can do yourself in Settings: change your details, download your data, and delete your account. For anything else, email privacy@warmhop.comand we will respond within one month. We may ask you to confirm the request from your account's email address, so we never hand your data to someone else.
Using your rights is free and will never count against you. If we turn a request down, we tell you why, and you can ask us to look at it again by replying.
You can also complain to your data protection authority. If you are in the EU, that is the authority where you live or work.
13.Children
warmhop is not for anyone under 18, and we do not knowingly collect data about them. If you believe someone under 18 has given us their data, tell us at privacy@warmhop.com and we will delete it.
14.Notes for particular places
A.United States, including California
The data we collect is described in sections 3 and 4. We do not sell or share personal information as California law defines those words, and we do not use sensitive personal information. You have the rights in section 12. A Global Privacy Control signal asks a site not to sell or share your data; we already do neither, and on tracked links we also use it to record less (see About this domain).
B.Canada
Your data is processed in the United States (section 9). Questions about how we handle it go to privacy@warmhop.com. You can also contact the Office of the Privacy Commissioner of Canada.
C.Australia and New Zealand
We disclose data to the overseas providers in section 8, in the United States. You can complain to us first and then to the Office of the Australian Information Commissioner or New Zealand's Privacy Commissioner.
D.Singapore, Hong Kong and India
Our data protection officer and grievance contact is privacy@warmhop.com. You can also contact Singapore's Personal Data Protection Commission, Hong Kong's Privacy Commissioner for Personal Data, or the Data Protection Board of India.
15.Changes to this notice
If we change this notice materially, we will tell you by email before it takes effect. Smaller changes, like clearer wording, take effect when we publish them here, and the date at the top always shows the latest version.