Privacy

Who is responsible

Limiter is an independent app project based in the Netherlands. For anything in this statement, write to hello@limiterapp.com.

What this site collects

• Your email address, when you submit the early access form. It is stored trimmed and in lower case, and nothing else about you is asked for.
• A source tag, if you arrived through a link carrying one (for example ?src=reddit). It says where the link was, not who you are.
• The referring page, as sent by your browser in the Referer header, shortened to 256 characters.
• A salted hash of your IP address, to stop the form being flooded. It is a hash and not the address, the salt is a secret held by the server, and the row is deleted within an hour.

That is the whole list. No name, no phone number, no location, no profile. Your email address is never written to a log or to any analytics tool.

Why, and on what legal basis

The purpose is one message telling you that early access to Limiter has opened. The legal basis is your consent under Article 6(1)(a) GDPR, which you give by submitting the form. There is no pre-ticked box anywhere on the site, and the purpose is stated next to the field rather than only here.

The address will not be used for a newsletter, for marketing about anything else, or to build a profile of you. If that ever changes, it would need asking you again.

Where it is stored

In a Cloudflare D1 database, in Cloudflare's Western Europe region. Cloudflare acts as the processor for hosting and for the database, under its data processing terms. Cloudflare also handles the usual request metadata needed to serve and protect a website, including IP address, user agent and the URL requested.

How long it is kept

Your address is kept until the early access message has gone out, or until you ask for it to be deleted, whichever comes first. If the project is abandoned, the list is deleted. Rate limiting rows are deleted automatically within an hour of being written.

Who it is shared with

Nobody. The list is not sold, rented, traded or handed to an advertiser. The only third party involved is Cloudflare, which hosts the site and the database.

Cookies and tracking

This site sets no cookies of its own, runs no analytics, and loads nothing from a third party at all: the fonts, the images and the code are all served from this domain. Cloudflare may set its own short-lived security cookie as part of protecting the site from bots.

Your rights

Under the GDPR you can ask for a copy of what is held about you, ask for it to be corrected, ask for it to be deleted, withdraw your consent at any time, and ask for your data in a portable form. One email to hello@limiterapp.com is enough for any of these, and no reason has to be given. Deletion is done by hand and the reply confirms it.

If you are not happy with how a request was handled, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

The app itself

This statement covers the website only. Limiter is not released yet. The app is built to run without an account and without a server, with the zone database inside the app, so it does not send your location anywhere. A separate statement will cover the app when it ships.