Privacy Policy
Last updated 22 August 2026
This policy covers ammoura.me, the early-access site for Ammoura. It is written to describe what actually happens when you visit and when you join the waitlist, including the technical data our servers record. We would rather tell you plainly than bury it.
1. Who we are
Ammoura ("we", "us") operates ammoura.me. For questions about this policy, or to exercise any of the rights described below, contact [email protected].
For visitors in the UK, EU and EEA, Ammoura is the data controller for the information described here.
2. What we collect
Information you give us
- Email address — when you join the waitlist by typing it in.
- Account details from a sign-in provider — if you join using GitHub, Discord, Google, Facebook or Apple, we receive your email address, the provider's account identifier, and a display name or username. We ask those providers for the minimum needed to identify you by email. We never receive your password, and we do not post anything on your behalf.
Information collected automatically
When you submit the waitlist form, we record technical details about the request and your device. This is more than most sites disclose, so here is the actual list:
| Category | What is recorded |
|---|---|
| Network | IP address, network operator and ASN, TLS version and cipher, HTTP protocol version |
| Approximate location | Country, region, city, postal code, timezone and approximate latitude and longitude, derived by our network provider from your IP address. This is IP-derived and is not GPS data from your device. |
| Device and browser | User agent, operating system and platform, browser client hints, screen and viewport size, colour and pixel depth, device memory, CPU core count, touch support, language preferences, timezone offset, connection type and speed, and your dark-mode and reduced-motion preferences |
| Device characteristics | A canvas rendering fingerprint and your graphics hardware (WebGL) renderer string. These are values that, taken together, can help distinguish one device from another. |
| Request context | The full set of HTTP headers sent by your browser, the referring page, the page URL, and any UTM campaign parameters in the link you arrived through |
| Automated-traffic signals | Bot-detection scores produced by our network provider |
We collect this to understand where interest is coming from and to tell real signups apart from automated ones. We do not use it to build advertising profiles, and we do not sell it.
Analytics
We use Google Analytics 4 on this site. It sets its own identifiers and reports aggregate usage — pages viewed, how visitors arrived, approximate location, device type — to us through Google. Google processes this data as described in its own privacy policy. You can opt out across all sites using Google's browser add-on.
Cookies
We keep our own cookie use minimal. We set:
- join_state — a short-lived security cookie set only when you start a sign-in with an external provider. It exists to prevent request-forgery attacks and expires within ten minutes. This is strictly necessary for that flow to be safe.
- admin_session — set only for site administrators signing in to manage the waitlist. It is never set for ordinary visitors.
Google Analytics sets additional cookies of its own, which are not under our control.
3. Why we use it, and our legal basis
| Purpose | Legal basis (UK/EU) |
|---|---|
| Sending you launch and early-access news | Consent — you gave us your address for this, and can withdraw at any time |
| Preventing spam and abuse of the signup form | Legitimate interests — keeping the waitlist real |
| Understanding traffic and demand | Consent for analytics and device-characteristic data |
| Keeping the sign-in flow secure | Legitimate interests, and strict necessity for the security cookie |
4. Who we share it with
We do not sell your personal information. We share it only with providers who run parts of this service for us:
| Provider | What for |
|---|---|
| Cloudflare | Hosting, network delivery, and storage of waitlist entries |
| Discord | Signup notifications are posted to a private internal channel we control |
| Analytics | |
| GitHub, Discord, Google, Facebook, Apple | Only if you choose to join using that provider — the exchange is between you and them |
We may also disclose information if required by law, or as part of a merger or acquisition, in which case we will say so here before it takes effect.
5. International transfers
Our providers operate globally, so your information may be processed outside your country, including in the United States. Where data leaves the UK or EEA, we rely on our providers' standard contractual clauses and equivalent safeguards.
6. How long we keep it
- Waitlist entries — until Ammoura launches and we have contacted you, or until you ask us to delete them, whichever comes first.
- Technical and device data attached to a signup — kept with that entry and deleted with it.
- Analytics data — retained according to Google Analytics' own retention settings.
If you ask us to delete your data, we do not keep a shadow copy to remember that you asked.
7. Your rights
Wherever you live, you can ask us to give you a copy of what we hold about you, correct it, or delete it. Email [email protected] and we will respond within 30 days.
If you are in the UK, EU or EEA, you also have the right to:
- object to processing based on legitimate interests
- ask us to restrict processing while a request is resolved
- receive your data in a portable, machine-readable format
- withdraw consent at any time, without affecting what happened before
- complain to your local data protection authority
If you are a California resident, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under California law.
8. Security
Traffic to this site is encrypted in transit. Waitlist data is held in access-controlled storage, administrative access requires authentication, and provider credentials are stored as encrypted secrets. No system is perfect, and we will not pretend otherwise — but we do not keep anything here that we do not need.
9. Children
This site is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has signed up, contact us and we will remove the entry.
10. Changes to this policy
If we change how we handle your information, we will update this page and change the date at the top. If the change is significant, we will contact waitlist members directly rather than relying on you to re-read this page.
11. Contact
Questions, requests, or complaints: [email protected].