Privacy, at a length you might actually read.

Last updated 21 August 2026. This covers the SolidStock website and waitlist. The app doesn’t exist yet, so it isn’t covered here — it gets its own notice before it ships.

Who this is: SolidStock is built by one person. That person is the data controller for this website and for the waitlist, and is the one who reads any email you send to privacy@solidstock.app. There is no support team to be escalated through.
What is collected: Your email address, two timestamps, a random token, four optional survey answers, and where you arrived from. The full list, field by field, is on the “what I store” page — that page is the detailed version of this section and it is written to be read, not to be skipped.
Why, and on what basis: Your address is used to send you a confirmation email, a build log every other Tuesday, and one email when the app launches. The basis is your consent, which you gave by typing it in and then clicking the link in the confirmation email. You can withdraw it in one click from the bottom of any email, and withdrawing it takes effect immediately.
Who else sees it: Two companies, both acting on my instructions and neither permitted to use your address for anything of their own: Supabase hosts the database, and Resend sends the mail. The site itself is hosted on Vercel, which sees the ordinary request logs any web host sees. Nobody else — no advertising network, no analytics vendor, no data broker, and nobody who paid to be on this list.
How long it is kept: Until you unsubscribe or ask for deletion, or until the project ends. If you sign up and never confirm, the row is cleared out — an unconfirmed address is one I have no permission to use, so keeping it serves nobody.
Your rights: You can ask for a copy of what I hold, ask for it to be corrected, or ask for it to be deleted, and I’ll do it rather than making you prove you meant it. Reply to any email or write to privacy@solidstock.app. If you’re in the UK or EU you also have the right to complain to your national data protection authority, and you don’t have to ask me first.
Cookies: This site sets none. Not “only essential ones” — none. That is why there is no banner asking you to accept anything, and it is a deliberate choice rather than an oversight: a consent popup on a page arguing for straight dealing would be an own goal.
Changes: If this notice changes in a way that affects what happens to your data, the change goes out in the build log with the old and new wording, not quietly with a new “last updated” date at the top.