Privacy
What this site collects, why, and how to make it go away. Short version: an email address if you choose to give us one, and nothing else.
Last updated
The short version
CoCAD is a one-person software project. This website exists to show what is being built and to let you join a waitlist. If you join, we store your email address so we can tell you when the beta opens and send occasional development updates. That is the whole purpose. We do not sell, rent, or share your address, and you can have it deleted at any time by replying to any email we send or writing to hello@cocad.ai.
There are no tracking cookies, no analytics scripts, no advertising pixels and no session recording on this site today — which is why you have not been asked to dismiss a cookie banner. If that ever changes, it will be described here first, and any analytics we add will be the cookieless kind that cannot follow you to another site.
What we collect, and when
If you join the waitlist, we store:
- the email address you typed;
- your queue position and the date and time you joined, because beta invitations go out in queue order;
- whether you have confirmed the address;
- a referral code — a random 8-character string, not derived from your email — so that a link you share can be credited to you, plus the code of whoever referred you if you arrived through someone else's link;
- your answers to the two optional questions on the confirmation page, if you answer them.
We do not ask for your name, your company, or anything else, and the form has exactly one field. The two questions on the confirmation page (which operating system you use, what you would build) are asked after you have joined, they are genuinely optional, and skipping them changes nothing about your place in the queue.
Two single-purpose random tokens are also created: one in the confirmation email, which is destroyed the moment you click it, and one that lets the confirmation page attach your optional answers to your entry. Both expire after 60 days. To stop one connection signing up hundreds of addresses, we also keep a count of signups per IP address for one hour. It is a counter against the address, not a record of who you are, and it is not kept after the hour is up.
If you only read the site, we do not store anything about you. Our host (Cloudflare) processes the ordinary technical information every web request carries — your IP address, browser type and the page requested — to serve the page and to protect the site from attack. We do not build profiles from it and we do not have a database of visitors.
The anti-spam check. The waitlist form is protected by Cloudflare Turnstile, a privacy-preserving alternative to reCAPTCHA. Completing it sends your IP address to Cloudflare so it can judge whether you are a bot. Turnstile does not track you across websites and does not serve advertising.
The dark/light switch. Your theme choice is saved in your own browser's local storage, under the key cocad-theme. It never leaves your device and it is not a cookie — nothing about it is sent to us.
Why we have it, and the legal basis
We use your address for one thing: launch news and occasional development updates — roughly monthly, each one showing real progress rather than describing it. That is the same sentence printed next to the signup form, on purpose: the consent you give covers the ongoing development log, not just a single launch announcement, so that nobody has to be re-consented later.
Where the GDPR applies, our legal basis is your consent, given by submitting the form, and you may withdraw it at any time without giving a reason. Serving and protecting the website itself rests on our legitimate interest in keeping it online.
Who else touches it
Two companies process data on our behalf, and no others:
| Who | What they do | What they see |
|---|---|---|
| Cloudflare | Hosts the site, stores the waitlist, runs the anti-bot check, routes our email | Your email address; ordinary request data such as your IP address |
| Resend | Delivers the email we send you | Your email address and the message we sent |
Both are United States companies, so your address is stored and processed in the United States. Neither is permitted to use it for their own purposes. We do not share your address with anyone else — not with advertisers, not with data brokers, and not with a "partner". If CoCAD were ever sold or wound down, we would tell the waitlist by email before anything moved, and you would be able to leave first.
How long we keep it
Until you ask us to delete it, or until the waitlist has done its job — once CoCAD has launched and the invitations are sent, the queue itself is no longer needed, and addresses that have never opened an email are removed rather than kept forever. Unsubscribing removes you from the mailing list; asking for deletion removes the record entirely.
Your choices
- Unsubscribe — every email has a one-click unsubscribe link. It works immediately and you never have to explain yourself.
- See what we hold, correct it, or delete it — email hello@cocad.ai from the address in question. There is no form and no account to log into; a person (and no dark patterns) answers, normally within a few days and always within 30.
- Depending on where you live, you may also have the right to a copy of your data in a portable format, to object to processing, and to complain to your data-protection authority. Ask and you will get all of it — the entire record is one line long.
- We do not sell or share personal information as those terms are used in California law, so there is nothing to opt out of.
Children
This site is not directed at children. You must be 13 or older to join the waitlist. If you believe a child under 13 has given us an address, write to hello@cocad.ai and it will be deleted.
The CoCAD application
The app is not released yet, so it collects nothing from anybody. When it ships, this page will carry a plain table of exactly what the application sends, when, and what is in it — and the design posture it is being built to is: no analytics, no usage telemetry without your explicit consent, files on your disk, and an update check that only happens if you ask for one. Those promises are worth judging when the software exists to test them against; until then, treat this paragraph as a statement of intent rather than a fact about a product you can run.
Security
The site is served over HTTPS only, the waitlist is stored in Cloudflare's key-value store with access restricted to the site's own code, and the credentials that reach it live outside the source repository. No system is perfect; if you find a problem, please write to hello@cocad.ai rather than publishing it, and you will get a real reply.
Changes
If this policy changes in a way that affects what we do with your address, we will email the waitlist before it takes effect. Smaller corrections are made in place and the date at the top of this page changes.
Contact
hello@cocad.ai reaches the person who wrote this. A postal address will be published here before the first newsletter goes out, because bulk email law requires one.