Privacy Policy

You can reach us at this address with any privacy question.

What we store: your name, your email address, the time you signed up, the consent text you saw at that moment, and the language of the page (German or English).

We also generate two codes: an internal access code that lets you in first at launch and invite people, and a share ID for your personal invite link.

Why: We email you when oft launches and occasionally send a short update. We send you your access to the app.

Legal basis: your consent (Art. 6(1)(a) GDPR). We store the time and wording of your consent so we can prove it (Art. 6(1)(c) and Art. 7(1) GDPR).

Withdrawal: You can withdraw your consent at any time by emailing hallo@getoft.com. We will then delete your entry. Withdrawal applies to the future.

Minimum age: The waitlist is for people aged 16 and over.

Providing your data is voluntary. Without a name and email address, we cannot add you to the waitlist.

After signing up, you can share your personal link, for example via WhatsApp. It only contains your share ID, not your name or email address.

If someone signs up through your link, we store your share ID as the source of their entry. This shows us who invited whom. We use it to understand how often oft is recommended and possibly to reward people who invite others later (Art. 6(1)(f) GDPR, our interest in fair and measurable referrals).

Sharing itself happens in the app you choose for it. We receive no data from that. Processing in that app is governed by its own privacy policy.

Vercel: The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. The servers delivering the site are located in the EU (Dublin, Ireland). When you visit, Vercel processes technically necessary data such as IP address, time, requested page and browser details to deliver the site and protect it from abuse. This data is stored only briefly.

Convex: We store the waitlist in a database operated by Convex, Inc., San Francisco, USA. The database is located in the EU (Ireland).

We have data processing agreements with both providers (Art. 28 GDPR). Because both are based in the US, access from the US cannot be ruled out. Such transfers are safeguarded by the EU-US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses (Art. 45 and Art. 46 GDPR).

Legal basis: our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR); for waitlist data, your consent (section 2).

We set exactly one cookie: oft-language. It remembers whether you want to see the site in German or English. It only contains de or en and is deleted after 365 days.

This cookie is strictly necessary for the site to work in your language, so no consent is required (Section 165(3) Austrian Telecommunications Act 2021). We use no other cookies, trackers or analytics tools.

Our font is hosted on our own server. Loading the site does not connect to Google or any other font provider.

Instagram, TikTok and YouTube are only linked, not embedded. No data flows to these platforms until you click a link. From then on, their privacy policies apply.

When you email us, we process your email address and the content of your message to reply (Art. 6(1)(f) GDPR). Emails to hallo@getoft.com are forwarded to our inbox via ImprovMX Incorporated, 8 The Green STE D, Dover, Delaware 19901, USA. ImprovMX is our processor, and the transfer to the US is safeguarded by Standard Contractual Clauses. We delete your message once your request is settled and no retention obligation applies.

We keep waitlist entries until you withdraw your consent, and no longer than 31 December 2026. If we decide earlier not to continue oft, we delete the waitlist sooner.

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can withdraw consent at any time (Art. 7(3)). Just email us at hallo@getoft.com.

If you believe we are not processing your data correctly, you can lodge a complaint with the Austrian Data Protection Authority: Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.

We make no automated decisions and do not create profiles about you (Art. 22 GDPR).