Privacy policy

What we collect

When you join the waitlist, we store:

• your @ohio.edu email address
• whether you said you’d like to volunteer
• when you signed up, and whether and when you confirmed your email
• a one-way fingerprint (a hash) of the link in your confirmation email. We never store the link itself.

To keep out spam and bots, and to run the site:

• We keep a one-way, keyed hash of your IP address for up to 24 hours, to limit how many sign-ups come from one network. We don’t store the address itself, and the hash can’t be turned back into it without a secret key only our server has.
• Cloudflare Turnstile, our spam check, looks at your IP address and technical details of your browser and device to tell people from bots, and may set cookies that are strictly necessary for that check. Cloudflare doesn’t use this for advertising. See their Turnstile privacy addendum.
• Like any website host, Vercel keeps short-lived request logs (such as IP address, browser type and the page requested) to run and secure the site.

If you email us, we receive your message and email address, and keep them as long as we need to reply.

What we don’t do

• We don’t sell your information or share it with advertisers.
• We don’t add you to anyone else’s mailing list.
• We don’t use advertising or analytics cookies, and we don’t track you across other websites. No third party collects information about your activity over time or across sites through ours.

How we use it

• to confirm that the email address is yours
• to tell you when Sava launches
• if you offered to volunteer, to send you volunteer training details
• to reply when you contact us
• to keep the waitlist free of spam and abuse

We send the confirmation email, the launch announcement, and, for volunteers, training details. The launch announcement and volunteer emails include a way to unsubscribe.

Who processes it

These companies handle your information only to provide their service to us. Your information is stored in the United States.

• Supabase stores the waitlist (our database) (privacy policy)
• Vercel hosts the website (privacy policy)
• Cloudflare runs the spam check (Turnstile), our domain’s DNS, and forwards email sent to us (privacy policy)
• Resend sends our emails (privacy policy)

We’d only share your information otherwise if the law requires it, or to protect someone’s safety.

How long we keep it

• Sign-ups you never confirm are deleted automatically 30 days after the last confirmation email.
• IP address hashes are deleted automatically after 24 hours.
• Confirmed sign-ups are kept until Sava launches and we’ve sent the launch email, then deleted.
• Volunteers are kept until their training is done, so we can email them about it, then deleted.

You can ask us to delete your information sooner at any time.

Seeing, correcting or deleting your information

Email hello@joinsava.com from the address you signed up with and tell us what you’d like: a copy of what we hold, a correction (for example, to stop being a volunteer), or deletion. We’ll reply within 30 days. To stop getting emails, use the unsubscribe link in the launch or volunteer emails, or just ask.

Do Not Track

Some browsers can send a “Do Not Track” signal. Because we don’t track you across sites or use advertising or analytics, there’s nothing for it to switch off, and the site works the same whether or not your browser sends it.

Children

The Sava waitlist is for college students and isn’t meant for children under 13. We don’t knowingly collect information from them, and if we learn we have, we’ll delete it.

Keeping it safe

The site only works over an encrypted connection (HTTPS). The waitlist can’t be read or changed from the website or by the public; only our server can add to it, and only the Sava team can see it. No system is perfectly secure, but if a problem ever affects your information, we’ll tell you.

Changes to this policy

When we change this policy, we’ll update the date at the top. If a change affects how we use information you’ve already given us, we’ll email you before it takes effect. The Sava app will have its own, fuller policy before it launches, covering location sharing and trusted contacts.

Contact

Questions about this policy or your information: hello@joinsava.com.