Privacy Policy

The controller of your personal data is EcoStack Technology OÜ (registry code 16935780, VAT EE102714663), Pallasti tn 50-18, 11413 Tallinn, Estonia. For any privacy question or request, write to [email protected].

• Account data: email address, display name, and the sign-in method you use (password, email link, GitHub or X). With GitHub or X we receive your name, username, avatar URL and verified email from that service.
• Membership and order data: grid, square, price, order and payment status, timestamps, and the terms version you accepted. We never receive your card number; Stripe tells us only whether and how much was paid.
• Participation: your votes (stored so you can change them; only aggregate results are ever published), ideas, feature requests and beta sign-ups.
• Public profile: the name, headline, link and colour you choose to show on your square and, on a 2×2 or 3×3 square, the image you upload (re-encoded, without its original metadata such as location), and their moderation status.
• Waitlist: the email address and platform you leave on the waitlist page. We send a confirmation and then an email when a new grid of that platform opens.
• Developer partner applications: your name, email address, the platforms, links and descriptions you send us, and our internal notes on the application.
• Communication: emails we send you (receipts, poll and update notices) and in-app notifications. Every optional email has a one-click unsubscribe link; receipts and account emails are always sent.
• Technical data: IP address, browser and request data in security logs (see section 6), and the cookies described in the Cookie Notice.

• Providing your membership, voting, updates and receipts: performance of our contract with you (GDPR art. 6(1)(b)).
• Bookkeeping, tax and consumer-law obligations: legal obligation (art. 6(1)(c)).
• Security, fraud and vote-manipulation prevention, and moderation of public content: our legitimate interests (art. 6(1)(f)).
• Anything optional, such as the waitlist or future marketing emails, only with your consent (art. 6(1)(a)), which you can withdraw at any time.

We do not sell personal data, show third-party advertising, or make decisions about you based solely on automated processing.

Our database and application run on our own servers in Tallinn, Estonia (hosting provider WaveCom AS, Tallinn, Estonia). Backups are stored in the EU.

We share only the data each provider needs, under data-processing agreements:

• Stripe (payments): name, email, amount, payment details you enter on Stripe's page.
• Resend (transactional email): your email address and the message content.
• Cloudflare (network security and delivery): IP address and request data.
• GitHub and X (sign-in, only if you choose them): they learn that you signed in to BeforeTheApp.
• Developer partners see aggregate poll results and, for beta invitations, only the data needed to invite you. They never see individual votes or your email without an invitation you accepted.

Some providers process data outside the EU/EEA. Such transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework or on Standard Contractual Clauses.

• Account, profile and participation data: while your account exists; a square image until you remove or replace it. When you delete your account, your profile, email address and sign-in methods are erased immediately and you are signed out everywhere; votes in open polls are withdrawn, votes in closed polls remain only as anonymous totals, and ideas you posted stay without an author.
• Orders and payment records: 7 years from the end of the financial year, as required by the Estonian Accounting Act.
• Developer partner applications: up to 24 months after our last contact, or until you ask us to delete them; longer only if they become part of a signed partnership agreement.
• Waitlist entries: until you unsubscribe or ask us to remove them, and no longer than 24 months after you signed up.
• Security logs: with the full IP address for 90 days, to investigate abuse and attacks; after that kept permanently for security, with the IP address shortened so it no longer points to a single connection, and without cookies, sign-in tokens or link codes.
• Backups: up to 14 days.

You have the right to access, correct, delete, restrict and object to the processing of your data, and to data portability. On your account page you can edit your profile, download an export of your data and delete your account yourself. For anything else, or if you prefer, write to [email protected]. We respond within one month.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the authority of your country of residence.

We update this policy when our processing changes. Material changes are announced by email or on the site.