Privacy policy

Who we are

Two Cups is made by Fraktal Form AS, a company in Norway.

• Organisation number: [ORG NUMBER]
• Address: [ADDRESS]
• Email: [CONTACT EMAIL]

We decide how and why your data is used on this website. In privacy law, that makes us the "data controller". We have not appointed a data protection officer. For any privacy question, write to [CONTACT EMAIL].

What we collect when you join the waitlist

When you type your email and press the button, we collect:

• Your email address.
• A record of your consent: the version of the text you saw under the form, the date and time you signed up, and which page you signed up from.

We then send you an email asking you to confirm. You're only on the list once you click the link in it. When you confirm, our newsletter provider also records the date, time and IP address of your confirmation. This is our proof that you really asked to join.

We don't ask for your name, your birthday, or anything else.

Sign up with Apple. On iPhone, iPad and Mac you can also join with "Sign up with Apple". Then we receive only the email address Apple gives us, which may be a private relay address that forwards to your real one. We use it exactly as described on this page for the waitlist, including the confirmation email. Apple handles your Apple Account sign-in under its own privacy policy.

Why: to send you the confirmation email and one email when Two Cups launches.

Our legal basis: your consent (GDPR Article 6(1)(a)). You give it by pressing the button with the consent text in view. You can withdraw it at any time by clicking "unsubscribe" in any email or by writing to us. Withdrawing doesn't affect what we did before you withdrew.

Joining is your choice. If you don't give us your email, you just won't get the launch email.

We don't track whether you open our emails or click links in them.

What happens when you visit the website

Hosting. Our website runs on Cloudflare Pages and Cloudflare Workers, run by Cloudflare, Inc. in the USA. To show you the page and protect it from attacks, Cloudflare processes technical data about your visit: your IP address, the page you asked for, the time, and what your browser tells it (such as browser type). We don't use this data to identify you.

Bot check. The waitlist form uses Cloudflare Turnstile to check that you're a person, not a bot. Turnstile runs a small check in your browser and sends Cloudflare signals such as your IP address, your browser's user agent and technical details of the connection. It doesn't read what you type into the form. Cloudflare uses these signals for us, to stop bots. Cloudflare also uses them on its own behalf to improve its bot detection, and for that part Cloudflare is responsible itself. Cloudflare says it doesn't use the signals to identify, profile or target anyone. You can read more in Cloudflare's Turnstile privacy addendum. When you sign up with Apple, Apple's sign-in does this job instead, and Turnstile isn't used.

Limiting repeated attempts. When you press the button, we keep a hashed (scrambled) form of your IP address for about 10 minutes, to limit repeated attempts.

Visitor statistics. We may use Cloudflare Web Analytics to count visits and see how fast the page loads. It doesn't use cookies or store anything in your browser, and Cloudflare says it doesn't fingerprint individual visitors. We only see totals, like "200 visits today".

Our legal basis: our legitimate interest in running a working, secure website and understanding, in broad numbers, how it's used (GDPR Article 6(1)(f)). We think this is fair because the data is technical, it isn't used to identify you, and you'd expect any website to do this.

No tracking cookies, nothing saved in your browser

Our website doesn't set cookies for tracking or advertising. Our own code doesn't save anything in your browser: a reading with Vera lives only in the page's memory and is gone when you leave it. There are no ads and no social media trackers.

Talking to Vera

On this website you can sit down with Vera for a free one-card reading. It is scripted: no AI runs while you talk to her here.

Talking to Vera. When you tap to speak, your browser's own speech recognition turns your voice into text. On iPhone and Mac that's Apple, in Chrome it's Google, and they may process the audio under their terms. Two Cups never receives your audio or your words: the reading runs entirely in your browser, and nothing you say or type is sent to us or stored. The microphone is only on from your tap until you send or cancel, and you can always type or pick a topic instead.

The card. The card you draw is picked at random in your browser.

Vera's voice. Vera's voice here comes from recordings made in advance with ElevenLabs; lines without a recording are shown as captions. Nothing is sent to ElevenLabs when you listen.

Who else handles your data

We use a few trusted service providers. They handle your data only on our instructions, under a data processing agreement.

• [NEWSLETTER PROVIDER] stores your email address and sends our emails. It is an EU-based provider.
• Cloudflare, Inc. (USA) hosts the website, runs the waitlist form and the bot check, and provides visitor statistics.

Apple (when you sign up with Apple) and your browser's speech service (when you tap to speak to Vera) aren't our service providers: you use them directly, under their own terms. From Apple we receive only the email address described above; from the speech service we receive nothing.

We don't sell your data, rent it out or share it for advertising. We'd only hand it to anyone else if the law requires us to.

Data sent outside Europe

Cloudflare is a US company, so data about your visit may be processed in the USA. Cloudflare is certified under the EU–US Data Privacy Framework. If that certification were to lapse, Cloudflare relies on the EU's Standard Contractual Clauses instead. Both are approved ways to protect personal data that leaves the EU and EEA.

Your email address is stored by our newsletter provider in the EU.

How long we keep your data

• Your email and consent record: until we've sent the launch email, and then for [12] more months. If you ask us to delete it, we do.
• If you unsubscribe: we stop emailing you right away. We clean up the list once a month, and at the next cleanup we remove your address (or anonymise it, so it no longer identifies you).
• If you never confirm your email: we delete the unconfirmed sign-up after [30] days, at our first monthly cleanup after that.
• Website and security data: Cloudflare keeps it only as long as it needs to run and protect the service. The hashed IP address used to limit repeated attempts is deleted after about 10 minutes. Visitor statistics are only kept as totals.

Your rights

You have the right to:

• See the data we have about you, and get a copy.
• Correct it if it's wrong.
• Delete it.
• Restrict how we use it, for example while we look into a complaint.
• Object to our use of it when we rely on legitimate interest.
• Take it with you in a common format (data portability).
• Withdraw your consent at any time. Just click "unsubscribe" or write to us.

To use any of these rights, email [CONTACT EMAIL]. We'll answer within a month. It's free.

We don't make automated decisions about you, and we don't profile you.

Complaints. If you think we've handled your data wrongly, please tell us first so we can put it right. You also have the right to complain to the Norwegian Data Protection Authority, Datatilsynet. See datatilsynet.no for how. If you live in another EU or EEA country, you can also complain to the authority there.

If you live in the US

You're welcome to send us the same requests, wherever you live. Ask to see, correct or delete your data at [CONTACT EMAIL] and we'll do it. We don't sell your personal information or share it for targeted advertising.

Two Cups is for adults

The Two Cups app is for people 18 and over, and this website is not meant for children. We don't knowingly collect data from anyone under 18. If you think a child has joined the waitlist, write to us and we'll delete it.

Keeping your data safe

The website only works over an encrypted connection (HTTPS). Only the people who run Two Cups can see the waitlist, and we keep access to a minimum.

Changes to this policy

If we change how we use your data, we'll update this page and the date at the top. If the change is big, and you're on the waitlist, we'll email you first.

Contact

Fraktal Form AS · [ADDRESS] · [CONTACT EMAIL]