Privacy Policy
Effective date: 20 July 2026
Applies to: the Prapp waitlist website (prapp.co and our Cloudflare Pages host) and related emails
Controller: Geist 0
Contact (privacy): privacy@prapp.co
1. Who we are
This Privacy Policy explains how Geist 0 (“Geist 0,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information when you visit the Prapp marketing site, join the waitlist, confirm your email, or receive related emails from us.
Prapp is a product published by Geist 0.
| Field | Detail |
|---|---|
| Trade name | Geist 0 |
| Legal form | Eenmanszaak (sole proprietorship) |
| KVK number | 42050834 |
| BTW (VAT ID) | NL005457442B15 |
| Place of establishment | Hilversum, Netherlands |
| Publisher site | https://www.geist0.com |
| Product site | https://prapp.co |
| Privacy contact | privacy@prapp.co |
| General contact | hello@prapp.co · contact@geist0.com |
A full street postal address appears in commercial emails we send (for example launch updates), as required for those messages.
We have not appointed a Data Protection Officer. For privacy requests, email privacy@prapp.co.
2. Scope
This policy covers:
- Visiting landing, Privacy, Terms, check-inbox, and confirmation pages
- Submitting an email address to join the waitlist
- Confirming your email (double opt-in)
- Optional invite / referral attribution (
ref) when that feature is enabled - Cookie choices on the site
- Confirmation emails and early-access / launch emails after you confirm
It does not cover the Prapp mobile app (profile, on-device recipe library, or AI features). App data practices will be described in a separate policy when the app launches. Prapp does not host imported recipes on our servers.
The Site may be reachable worldwide. We apply one protective standard described here. Where local law gives you mandatory rights, those rights apply to the extent required. This policy is in English; translations (if any) are for convenience only.
3. Email collection (waitlist)
At this stage, the only personal data we ask you to type is your email address.
| Step | What we process |
|---|---|
| You submit the form | Your email (normalized), a pending signup record, and security signals below |
| We send confirmation | Delivery through our email provider; a one-time confirm token |
| You click Confirm | Your status becomes confirmed; the token is consumed |
| You do not confirm | Pending data is deleted or suppressed after a short period (see Retention) |
Purpose (matches the form): so we can email you about Prapp early access and launch updates. The form states: “We’ll email you about early access.”
Joining is not consent for unrelated third-party marketing, list rental, or partner campaigns. It is not a user account with password, payment, or health data. It does not guarantee access on any date or on any particular product terms.
How we obtain consent for launch emails: you submit the form with that purpose disclosed and Privacy / Terms linked, then you confirm via the link in email (double opt-in). Only after confirm are you a confirmed subscriber for launch updates. We may keep records reasonably needed to demonstrate that process (for example confirmation time and token state).
4. Personal information we collect
4.1 You provide
| Data | When |
|---|---|
| Email address | Waitlist form |
| Confirmation | You click the confirm link |
| Message content | If you email hello@ or privacy@ |
4.2 Collected automatically
| Data | Why |
|---|---|
| Device / browser signals | Deliver the site; security |
| IP address | Rate limiting and abuse prevention — not for marketing profiles |
| Bot-check data | Cloudflare Turnstile verification |
ref / UTM (if present) |
Optional attribution / campaign context |
| Essential cookies | See Cookies |
4.3 We do not collect on the waitlist
Passwords, payment cards, government IDs, precise GPS, dietary preferences, allergies, or other health/profile data. Those are out of scope for this waitlist form.
5. Purposes of use
- Operate the waitlist and send a transactional confirmation (and resend) email
- After confirm, send early-access / launch updates about Prapp matching the form purpose
- Optional invite attribution when that feature is live and you use a valid
ref - Secure the service (Turnstile, rate limits, abuse prevention)
- Respond to your requests
- Comply with law
Optional analytics: we do not use optional analytics on the waitlist today. If we add a vendor later, we will update this policy, name the vendor, and load it only after you choose Accept all.
6. Legal bases (GDPR / UK GDPR)
| Purpose | Legal basis |
|---|---|
| Confirmation email and waitlist operation | Consent and/or steps at your request before a contract (Art. 6(1)(a)/(b)) |
| Launch / early-access emails after confirm | Consent (Art. 6(1)(a)) — double opt-in |
| Security, rate limits, abuse prevention | Legitimate interests — keeping the Site secure and usable (Art. 6(1)(f)) |
| Essential cookies | Strictly necessary / legitimate interests |
| Optional analytics (if added later) | Consent only |
| Legal compliance | Legal obligation (Art. 6(1)(c)) |
You may withdraw consent for launch emails at any time via unsubscribe or privacy@prapp.co. Withdrawal does not affect processing already completed lawfully.
For commercial electronic mail, we also follow applicable e-privacy / Telecommunicatiewet rules: prior consent for marketing-style launch updates, and an easy opt-out in those messages.
7. Sharing and processors
We do not sell, rent, or trade waitlist emails. We do not add your email to unrelated third-party marketing lists.
We use service providers (processors) who process data on our instructions:
| Provider | Role |
|---|---|
| Resend | Email delivery and related delivery metadata |
| Cloudflare | Hosting (Pages), DNS, edge Functions, Turnstile, inbound Email Routing, and KV storage for pending/confirm/rate-limit data |
We may disclose information if required by law, to protect rights and safety, or in a corporate transaction with appropriate safeguards.
8. International transfers
Geist 0 is established in the Netherlands. Some processors (including Resend and Cloudflare) may process data in the United States or other countries outside the EEA/UK.
Where required, transfers rely on appropriate safeguards such as the provider’s Standard Contractual Clauses (SCCs) / UK addendum and their data processing terms. Details are available in each provider’s current DPA / privacy documentation. We minimize waitlist data to reduce transfer risk.
9. Retention
| Data | Retention |
|---|---|
| Unconfirmed emails and tokens | About 30 days, then delete or suppress |
| Confirmed waitlist emails | Until you unsubscribe or ask us to delete, or we end the waitlist purpose — unless law requires longer |
| Security / rate-limit data | Short operational periods (hours to days) |
| Consent / confirm records | As long as reasonably needed to demonstrate consent and handle disputes |
10. Your rights
Depending on where you live, you may have rights to access, correct, delete, withdraw consent, object or restrict certain processing, data portability, and to lodge a complaint with a supervisory authority.
In the Netherlands, you may contact the Autoriteit Persoonsgegevens (AP) (https://autoriteitpersoonsgegevens.nl). In the UK, the ICO; elsewhere, your local authority.
California / similar US state laws: We do not sell waitlist emails and do not knowingly “share” them for cross-context behavioral advertising. You may request know / delete / correct rights by emailing privacy@prapp.co.
How to exercise: email privacy@prapp.co with the address you used on the waitlist. We respond within one month (or sooner if required by law). We may need to verify your request.
We do not use waitlist data for automated decisions that produce legal or similarly significant effects about you. Security automation (rate limits, Turnstile) may block abuse; that is for protection, not marketing profiling.
11. Children
The Site and waitlist are for people 18 or older. We do not knowingly collect personal information from anyone under 18. Contact privacy@prapp.co if you believe a minor signed up; we will delete the data promptly.
12. Cookies
| Category | Use |
|---|---|
| Essential | Run the site, security, remember your cookie choice, abuse prevention |
| Optional analytics | Not used today |
Banner choices: Reject all · Essentials only · Accept all. Closing the banner without choosing does not enable optional analytics. Until we enable a named analytics vendor, all three choices have the same practical effect for analytics (none load).
13. Security
We use HTTPS, access controls, processor agreements, rate limits, bot checks, and one-time confirm tokens. No online transmission or storage is perfectly secure. Use an email inbox you control.
14. Changes
We may update this Privacy Policy. We will change the Effective date above. For material changes, we may notify confirmed subscribers by email or post a prominent notice on the Site.
15. Contact
privacy@prapp.co (privacy and rights)
hello@prapp.co (waitlist / product)
contact@geist0.com (publisher)
Geist 0 · Hilversum, Netherlands · KVK 42050834