Privacy Policy
Last updated 24 October 2026
This policy explains what we collect when you use myupdu.com, why, who helps us run it, and the choices you have. We collect information to run the waitlist and investor form and use Google Analytics to understand how the site is used. We do not sell your information or use Analytics advertising features.
1. What we collect, and why
| What | Why | Legal basis |
|---|---|---|
| Your email address, when you join the waitlist | To keep your place, send you your private link, tell you when your batch opens, and send you news about the launch | Taking the steps you asked for (contract), and your consent for launch news, which you can withdraw at any time |
| Your place, batch, referral code, private key, how many friends joined with your link, and the invites you sent | To run the waitlist and its referral queue | Contract |
| Your email address and the fact that Google has verified it, if you choose Continue with Google. Nothing else from your Google account: not your name, photo or contacts | To add you to the waitlist without a confirmation email | Taking the steps you asked for (contract) |
| The link you arrived from (a referral code, and campaign tags such as utm_source) | To credit the person who referred you and to see which channels bring people | Our legitimate interest in running the referral queue and measuring our own campaigns |
| Your answers to the optional survey on your waitlist page: what you ship, your team size, what breaks most and which AI tools you use, plus anything you type under “Other” | To decide what to build first. Your answers do not change your place on the list | Your consent, given by choosing to answer. Ask us and we delete your answers |
| A friend’s email address, when you invite them | To send them one invitation from you | Your and our legitimate interest in passing on an invitation you asked us to send |
| Your name, email, organisation, investor type, location, website and message, when you request the investor pack | To assess fit, reply to you and, if appropriate, share materials | Your consent, given on the form, and steps you asked us to take |
| Your IP address and a reCAPTCHA score, when you load a page or send a form | To stop bots and abuse, and to keep the site within its limits | Our legitimate interest in keeping the site available, secure and free of spam |
Your place on the waitlist is worked out automatically from when you joined and how many friends joined with your link and confirmed their email. You have a place only once you have confirmed yours. It decides only the order in which access opens, and has no legal or similarly significant effect on you.
2. Emails we send
When you join, we send one email with your private link. Opening it confirms the address is yours, and only then do you get a place on the list and launch news. If you ask for it again, we send it up to three times, 30 seconds apart, then at most once every 15 minutes. If someone types your address into the form again, we send your private link to you, never to them. An address that is never confirmed stays in our records, unused, and gets no other email from us. If you join with Google, Google has already confirmed your address, so instead we send one email with your place and your private link. When your batch opens we email you a link to get started. With your consent we also send occasional launch news; every one of those emails has an unsubscribe link.
3. Invites to friends
If you invite someone, we email them once, saying who invited them. We do not add them to any list or email them again unless they join. Please invite only people you know and who would expect to hear from you. If you received an invite and want your address deleted, email us.
4. Bot protection and rate limits
Our server reads your IP address on every request to apply rate limits, so one visitor cannot overload the site or the forms. It keeps that address in memory only, for at most an hour after your last request, and writes only an anonymous, salted hash of it to our logs. Our hosting provider may keep its own access logs.
When you use a form, we use Google reCAPTCHA v3 to check that you are a person. It looks at how the page is used and returns a score; it shows no puzzle. Since 2 April 2026 Google provides reCAPTCHA as our data processor, under its Cloud Data Processing Addendum. reCAPTCHA sets one cookie, _GRECAPTCHA, which it needs for this check. We load it from www.recaptcha.net, only once you start using a form.
5. What your browser stores
We set one cookie of our own, and only if you choose Continue with Google: updu_google, which ties Google’s answer to the browser that asked, so nobody else can finish your sign-in. It lasts at most ten minutes and is deleted when the sign-in ends. The site also stores a few things in your browser so it works:
- On this device until you clear it (local storage): your referral code and private key, so this browser can reopen your spot. Also the last waitlist count this browser saw, and your spot’s last answer (place, batch and the invites you sent), so the page can show them at once while it fetches fresh ones; the spot is not shown from it after a week.
- A copy of the site itself (the browser’s cache, kept by a service worker): the pages, scripts, fonts and pictures, so a return visit opens at once. It holds nothing about you.
- For this visit only (session storage): the referral code and campaign tags you arrived with, and the result of your signup.
Clearing your browser’s site data removes them. Your private link from the welcome email still works afterwards.
Google Analytics uses cookies such as _ga and _ga_6H2VN53PHM to distinguish visits and measure page views and interactions, including signup and referral-sharing events. Google receives usage and device information and the network information needed to receive these requests. Our Analytics configuration removes query strings and fragments from page and referrer URLs, so private waitlist keys are excluded from these fields. We disable Google signals and advertising personalization. You can block Analytics using your browser’s privacy controls or the Google Analytics opt-out browser add-on.
6. Who helps us run the site
These providers process information for us, only on our instructions:
| Provider | What they do | What they receive |
|---|---|---|
| Railway | Hosts the website and its server | Your requests, including IP address |
| redirect.pizza | Sends visits to myupdu.com (without www) on to www.myupdu.com | That request, including IP address |
| Google (Apps Script and Sheets) | Stores waitlist and investor requests | The details you submit |
| Google (reCAPTCHA) | Checks forms for bots | Page interaction data, IP address |
| Google (Analytics) | Measures site visits and interactions | Page URLs without query strings or fragments, usage and device information, cookie identifiers and network information |
| Google (Sign in with Google) | Confirms your email address, only if you choose Continue with Google | That you are signing in to our site; you sign in on Google’s own page, never on ours |
| Plunk | Sends our emails | Email address and the email’s content |
| unpkg | Serves open-source code the pages run on (React) | IP address, when your browser loads a page |
Some of these providers are based in, or process data in, the United States and other countries outside the UK and EU. Where that happens, we rely on the safeguards the law requires, such as adequacy decisions or standard contractual clauses.
7. How long we keep it
- Waitlist details: until you ask us to delete them, and no longer than [24 months] after we open access to everyone.
- A friend’s address who never joins: [12 months].
- Investor requests: [24 months] after our last contact, unless we go on to work together.
- IP addresses in our server’s memory: at most an hour after your last request.
8. Your rights
Depending on where you live, you can ask us to show you the information we hold about you, correct it, delete it, limit how we use it, give you a copy to take elsewhere, or stop using it for something you object to. Where we rely on your consent, you can withdraw it at any time; that does not affect what we did before. Email myupdu@gmail.com. We reply within one month.
If you are in the UK or the EU and think we have handled your information wrongly, you can complain to your data protection authority, such as the UK Information Commissioner’s Office (ico.org.uk). We would be grateful for the chance to put it right first.
If you live in California or another US state with a privacy law: we do not sell your personal information, and we do not share it for cross-context behavioural advertising.
9. Children
The site is for businesses and professionals. It is not meant for anyone under 16, and we do not knowingly collect their information. If you think a child has given us their details, email us and we will delete them.
10. Security
The site is served only over HTTPS. Your spot can be opened only with your private key, not with your public share link. Forms are rate limited and checked for bots, and our stored data is reachable only through our server. No system is perfectly secure, so if you think something is wrong, please tell us.
11. Changes
If we change this policy, we will update the date at the top. If a change matters to how we use your information, we will tell you by email before it applies.