Privacy

Member privacy policy

This notice covers the current website and waitlist. The separatemember privacy policy describes member data, health records, messaging and retention when those features are enabled. It is approved for publication but does not enable member registration.

What the waitlist form stores

One row per address, with these fields and no others:

• Your email address, lowercased.
• The time you first signed up and the time the row last changed.
• The stage you picked, if you picked one. Leaving it blank stores nothing.
• The word landing, which records that the form on the front page was the one you used.
• The two-letter country code Cloudflare attaches to the request. Not your IP address, not a city.

The row lives in a Cloudflare D1 database attached to this site. Nothing is copied to a mailing-list provider, a CRM, or an advertising platform.

Member sign-in, when enabled

Email sign-in requests will use your email address to send a six-digit verification code. The server will store keyed hashes (HMAC) for code checks and request limits. Email addresses and network addresses used for those limits will be represented by keyed hashes. The queued verification email, including its destination and code, will be encrypted in storage before delivery through the configured email service.

Successful sign-in will set a session cookie for this host only, with a seven-day expiry. It will use Secure, HttpOnly, and SameSite=Lax settings: it travels over HTTPS, page scripts cannot read it, and browsers restrict its use on requests from other sites. This cookie keeps you signed in; it is not used for advertising.

Private drafts, when enabled

The draft editor will keep one recovery copy per account in this browser's local storage, including your text and any save awaiting confirmation. A confirmed save also stores a copy in your account. Saving a draft does not publish it.

Browser copies remain on the device until replaced or cleared. On a shared device, keep any text you need and use the draft review to clear this account's browser copy before signing out, or clear this site's browser data when you finish. Signing out does not clear draft recovery. Clearing all browser data for this site removes its recovery copies and session cookie; it does not delete drafts already saved to your account. Deleting an account draft in the editor retains its browser copy so you can recover the text.

Community text screening, when enabled

Community composers will keep separate browser recovery copies for each community or conversation, scoped to your account. They include your text and the original command when a submission is awaiting confirmation. You can review and clear each copy in the community area. Signing out will keep these copies on the device; clearing them will not cancel a submission that already reached the server.

Text submitted for an audience of all signed-in members may be sent to TypeSafe's Jev service for safety screening. This can include relevant parent text for a reply. Private drafts, private messages, and private Journey entries are outside this screening boundary.

This processing is disabled until the processor is approved and its required credentials are configured. Member terms, privacy and community rules are approved for publication. Member access remains disabled pending deployment and live configuration.

Community reports, when enabled

Reporting requires a separate approved notice. Before submitting, you will see that notice and its evidence retention period. Enabled intake will save the exact reported post or comment revision and your note as restricted safety evidence on Cloudflare. Report evidence is not sent to TypeSafe. A receipt confirms storage, not staff review or action. Your report history will contain receipt metadata without evidence text or staff findings.

The report form will keep your reason, note and pending retry details in this browser for your account. It will not copy the reported post or comment body into that recovery record. Signing out will keep the browser copy. You can review and clear each report copy separately; clearing it does not cancel or delete a report already received by the server.

Private Journey sync, when enabled

Private Journey sync requires a separate approved notice and your explicit opt-in. Enabled sync will store your submitted Journey records in a separate private Cloudflare database for your account. This website will not import existing device or demo records automatically. Turning sync off will stop cloud access and retain cloud records; it is not a deletion request.

Journey fields and pending commands will remain in account-scoped browser recovery after sign-out or opt-out. You can review and clear each browser copy separately. Clearing a local copy does not delete cloud records or cancel a write the server already received. Review these copies before leaving a shared device. This website does not offer cloud purge or dose and stock sync.

Message reports, when enabled

Message reporting requires a separate approved notice and retention setting. Enabled intake will save the reported live message revision and your note as restricted Cloudflare evidence. This member-initiated report does not automatically screen private messages or send them to TypeSafe. The server may accept a proof of an unchanged message read within the prior 24 hours; this does not restore access to conversation history. Your report history contains receipt metadata without the message body or note. A receipt confirms storage, not staff review or action.

The message report form will keep your reason, note and pending retry details in a separate account-scoped browser copy. It will not copy the received message body into that record. Signing out keeps this copy. Review and clear it separately on a shared device; clearing cannot cancel a report already received by the server.

Account exports and deletion requests, when enabled

Enabled export intake will request a private copy of your own account data and Journey records. An archive covers a collection window and expires 24 hours after it is made ready. Downloading requires recent sign-in. The browser checks the complete archive in memory before offering a file, up to 64 MiB; archive contents are not saved in browser recovery storage.

A deletion request requires a separate account review. If accepted, it closes account access, ends sessions and makes exports unavailable. Accepted intake does not confirm completed erasure. This service cannot confirm completed account deletion, and a request may remain pending. Browser drafts and other recovery copies remain on this device.

Pending request details stay in account-scoped browser recovery after sign-out. Deletion requests also save a random key for checking minimal request status without a member session. You can save this key to a private recovery file. Anyone with the file can check that request's minimal status while the key is valid. The admission response supplies its expiry when received; a lost response can leave the expiry unknown. The key is sent in a request header, never in the page address. Reviewed clearing affects only the browser copy and cannot cancel a request. Losing the key can prevent future status checks.

What the site does not do

• We use PostHog for page visits, interactions, scroll positions, engagement, performance, errors and masked session replays. PostHog uses a random browser identifier in local storage. You can turn off usage and diagnostics at the bottom of the page. We do not use advertising tracking pixels.
• No advertising and no sale of personal information.
• The waitlist does not set a cookie. Enabled member sign-in will use the session cookie described above.

Cloudflare serves the site and keeps its own request logs, which include IP addresses. That is how the hosting works. We do not read those logs to build a profile of you.

What we will send you

One email, when the first circles open. If the plan changes and there is a reason to write sooner, it will be about PepClub and it will include a way to stop hearing from us.

When member email sign-in is enabled, requesting a code will also request a verification email.

Removing your address

Write to hello@joinpepclub.com from the address you signed up with and the row is deleted. There is no unsubscribe link in the form itself, because the site has not sent you anything yet.