Privacy notice
Version 2026-10-14
Who we are
This waitlist is run by Kejdi Mulla, who is responsible for your data (the data controller). Questions or requests: privacy@irlduel.app. We're building an app for live 1v1 challenges. It doesn't exist yet, and this site measures interest in it.
If you join (18 and over)
We store your email address as you typed it, plus a simplified copy we use to spot duplicate sign-ups; your home country; the username you reserve, if you do; when you agreed, and which versions of the consent text and this notice you saw (if you switch emails back on after unsubscribing, when you did and the versions you saw then); when we sent your confirmation, how often we re-sent it, and when you confirmed; when you earned the founding-player badge, if you do; your personal referral code, and who referred you if you came through a friend's link; whether you've answered the poll or unsubscribed; and where you came from: the video code and campaign tags in the link, the referring website's domain, and the platform, which we take from the link or, inside the TikTok or Instagram app, from the app name your browser reports. Your optional challenge vote is stored with your entry. Your optional poll answer is stored apart from it, with only the question it answers. We also log these steps with their time and where you came from, linked to your entry: signing up, confirming, each vote or change of vote, each share or copy of your challenge link, each friend who joins through it, and unsubscribing. Once you've confirmed, anyone who opens your challenge link sees your username, if you reserved one, and your challenge vote.
If you tell us you're under 18
We store only your age band, where you came from (as above), the date and an optional challenge vote, and log each vote with only the hour it was cast. No email, name or anything else that identifies you.
Visit counts
Each time you open our main page or your status page, it sends one count to our own server: the page, where you came from and, if you pick one, your age band. It carries no identifier, and we keep its time only to the hour. If your browser sends Global Privacy Control or Do Not Track, we skip these counts, and we don't record when you share or copy your challenge link. Cloudflare Web Analytics also measures every page's views and loading speed, and shows us only totals by page, referring site, country, browser, operating system and device type. Cloudflare says it uses no cookies or local storage, doesn't single out visitors by IP address or browser, and doesn't track them across websites. Our site itself uses no cookies or local storage, there are no other analytics, and we never store your IP address or browser details.
Why, and on what basis
With your consent (GDPR Art. 6(1)(a)), we use your entry to email you a confirmation link, tell you whether we're building the app and, if we launch, send launch details and a code to claim your username and badge. We also use it to work out your place in line and to see which videos, platforms and countries bring interest. Visit counts and Cloudflare's page measurements are aggregate statistics we need to judge this test and keep the site fast, which is our legitimate interest (Art. 6(1)(f)). We never sell your data or use it for ads.
Emails
A confirmation email (sent again if you sign up again, up to 3 times in 24 hours), one email saying whether the app goes ahead and, if it launches, one launch email with your claim code. Nothing else. Unsubscribing stops every email, including any claim code. If you sign up again with the same email after that, the confirmation is replaced by an email asking whether to switch emails back on, and they stay off unless you tap its button.
Who handles it for us
Supabase stores the data in the EU, in Ireland. Cloudflare hosts the site, runs Web Analytics on it and protects it from abuse: it sees your IP address briefly for rate limiting, and its bot check, which loads once you answer the age question, also looks at your browser. We store neither. Cloudflare also forwards mail sent to privacy@irlduel.app. Resend sends our emails. All three are based outside the EU: Supabase in Singapore, with support from Supabase, Inc. in the US, and Cloudflare and Resend in the US. Cloudflare and Resend are certified under the EU-US Data Privacy Framework, and the data processing terms of all three include the EU Standard Contractual Clauses, which you can ask us for.
How long we keep it
If we decide not to build the app, we send one email saying so and delete every sign-up, username and poll answer within 30 days. If we build it, we keep your entry until launch plus a claim period that the launch email states, then delete unclaimed entries. You can delete your entry sooner at any time. Once it's deleted, its counts stay only as anonymous statistics, with no link to you. Under-18 counts and visit counts identify no one and are kept as statistics.
Your rights
Unsubscribe or delete your entry with the link in any of our emails. You can also ask for a copy of your data, including as a machine-readable file to take to another service, ask us to correct it or stop using it, and withdraw your consent at any time, which doesn't affect what we did before. Email privacy@irlduel.app. You can also complain to your data protection authority.
Changes
If this notice changes, its version changes. Your entry records the version you saw.