Your data. Your choice.

Operator and privacy contact

Operator: [operator details pending]. Contact: [email protected]. Privacy requests: [email protected].

Data we process

Waitlist data comprises your email address, chosen locale, platform interest and consent record, including consent version and confirmation timestamps/status. Confirmation and unsubscribe tokens are used to process your requests. The current signup consent version is waitlist-v1; we retain the exact consent text you accepted.

Security processing includes a hashed rate-limit key derived from connection information. Pseudonymised data is still personal data. Cloudflare may process IP address, browser/network information and security signals when serving pages or performing Turnstile checks. Mailgun processes recipient and delivery information for emails.

We do not request your Sony or Microsoft password and do not collect gameplay input or video through this waitlist.

We store campaign tags supplied by the link you used in five UTM fields: utm_source, utm_medium, utm_campaign, utm_content and utm_term (source, medium, campaign, content and term). Each value is accepted only if it contains 1–64 lowercase letters, digits, periods, underscores or hyphens ([a-z0-9._-]); other values are discarded. This is a format limit, not a list of reviewed or approved campaigns. Tags help us understand which channels bring signups, are stored with your waitlist entry and are deleted on the same schedule. Do not put personal information in campaign tags.

How we use information and your choices

We use your email and consent record to process your requested signup and send GTAMouse launch updates. We choose double opt-in: your address joins the confirmed waitlist only after you open the email link and press the confirmation button. This is our verification choice, not a claim that US law universally requires it.

Your locale and platform interest help us provide relevant updates. Campaign tags help us understand which channels bring signups. Security information supports proportionate abuse prevention. Optional analytics stays off unless you make a separate opt-in choice. Joining is voluntary and free; without an email address we cannot send email updates.

Processors and recipients

Cloudflare provides global hosting, the D1 waitlist database and Turnstile security. Mailgun provides confirmation and launch email delivery using its EU service region. Access is limited to the operator’s authorized personnel and providers needed for these purposes. We do not sell waitlist data or disclose it for cross-context behavioral advertising.

International processing

An EU email region does not mean all processing stays in the EU. Provider support, security and subprocessors may operate elsewhere. Where GDPR requires safeguards, transfers must use an applicable adequacy decision or appropriate safeguards such as standard contractual clauses. Contact [email protected] for information about the safeguards relevant to your data.

Retention and deletion

Unconfirmed signups, including those for which delivery failed, become eligible for deletion 14 days after creation. Confirmation links expire after 7 days and cannot be used after expiry; their stored verification data is then eligible for cleanup. Rate-limit keys become eligible for deletion after 24 hours. An hourly cleanup normally removes eligible data within about an hour after these limits pass. A delayed or failed scheduled job can postpone deletion until a successful run.

Confirmed entries are kept until you unsubscribe or request deletion. Otherwise, they become eligible for scheduled deletion 12 months after the GTAMouse product launch or at the start of December 31, 2027 (UTC), whichever comes first; the same hourly cleanup and possible delays apply. Campaign attribution stored with an entry follows the same schedule.

A valid unsubscribe or deletion request deletes the active waitlist record without waiting for the scheduled cleanup. Cloudflare and Mailgun logs and backups follow the providers’ own retention policies; our database cleanup does not instantly erase every provider log or backup. Any record retained to meet a specific legal obligation is limited to that purpose and is not used for marketing.

Withdrawing consent

Use the unsubscribe link in our email or contact [email protected]. Withdrawal is as easy as signup and does not affect processing that was lawful before withdrawal. Changing optional analytics preferences does not automatically remove a waitlist subscription.

Review, corrections and deletion

Email [email protected] to ask what personal information we hold about you, review it, correct your email or preferences, or request deletion. You can also unsubscribe and delete the active waitlist record using the personal link in our email. We may request proportionate identity verification; do not send passwords or private confirmation tokens.

We offer requests for access, correction and deletion to users regardless of location. Where applicable law grants additional rights, you may also request restriction or portability, object to legitimate-interest processing, or complain to the relevant privacy authority. We respond within applicable legal deadlines.

Security and automated processing

We use access controls, verification links and abuse protection. Turnstile and rate limiting may reject suspicious requests; no automated decision with legal or similarly significant effects is intended. Contact us if a security check prevents a legitimate request.

International users and GDPR

Our planned business setup is US-oriented; an operator’s location or a server location alone does not settle which privacy laws apply. GDPR applicability depends on actual establishment, offering goods or services to people in the EU, or monitoring there. Our deliberate multilingual marketing warrants assessment; we do not claim either that GDPR never applies or that it definitely applies to every user.

Where GDPR applies, consent under Article 6(1)(a) supports requested email updates and separate optional analytics; legitimate interests under Article 6(1)(f) support proportionate site security and abuse prevention; a specific legal obligation may require Article 6(1)(c). You may withdraw consent without affecting prior lawful processing. The request channels and rights described above remain available.

California privacy information

The information we collect includes email address, locale, platform interest, consent and confirmation records, campaign attribution and the security information described above. We disclose information to Cloudflare, Mailgun and authorized people as described under providers, not for sale or cross-context behavioral advertising.

You can review your information and request changes or deletion at [email protected]. This policy describes our practices for California visitors as well as other users; it does not claim CCPA coverage or certified compliance. Any additional statutory rights depend on the actual operator and processing facts.

Do Not Track and analytics choices

We do not currently change our site’s behavior solely in response to a browser Do Not Track signal. Optional analytics instead follows your explicit cookie-preference choice and remains off until you opt in. You can withdraw that choice on the cookie-preferences page; this does not unsubscribe you from the waitlist.

Cookie preferences

Policy changes

We post changes on this page and update the effective date. For material changes to purposes or data practices affecting existing subscribers, we also notify them by email before applying the change and seek a new choice where required. A future desktop product or checkout will have its own applicable privacy information.