Privacy

What we store

When you start or submit the join form, we store your answers in our database (Supabase). That includes the basics you type, your interest selections, optional lifestyle answers, and first-party campaign attribution so we can tell which links and example groups led to a signup. City requests are stored separately from signups. Join and city-request writes also store a hashed IP so we can limit abuse. Join writes additionally store the browser user agent. Those values are not sent to Google.

Marketing email requires an explicit unchecked opt-in, separate from email confirmation. You can unsubscribe anytime via the link in our emails, which flips marketing consent off without removing you from the waitlist.

How you found us

This browser keeps a 30-day record (afk_attribution_v1) of the first and latest landing path, referrer host, campaign parameters, and click IDs we see, so we can attach them when you write or submit the form. We write this record on each visit, not only campaign links, and we keep it even if you decline analytics. It does not include your form answers.

Analytics

With your permission, we load Google Analytics 4 (measurement ID G-LSMFHQX3V4, a public identifier) to measure visits and signup progress. The tag loads only after you choose Allow analytics. We do not send your form answers, name, email, ZIP, age, gender, interest labels, or search text to Google. Advertising storage, user data, and personalization stay denied. You can change this anytime from Analytics choices in the footer.

Google Analytics 4 event retention is configured in GA Admin for this property (we intend 14 months, with reset-on-new-activity off). This site does not enforce that period.

Ads

If you allow analytics, Google Ads may import two conversion events from GA4: generate_lead as the primary action (a new join submit) and city_request_submitted as a secondary action. We do not load a separate Ads tag in the browser, and we do not send form answers as enhanced conversions.

Abuse prevention

We use Vercel BotID to process browser and device signals on join and city-request writes so automated abuse is harder. Those signals are not sent to Google Analytics and are not stored as fingerprints in Supabase.

Questions

Requests: hello@allfriendkind.com