Privacy policy

Last updated October 29, 2026 · version 2026-10-29

This page explains what happens to the email address you leave on warpstead.com to be told when there’s something to try. It’s the only personal data this site asks you for. What the Warpstead app sends, and when, is in the section on the app below.

Who is responsible

The data controller is Roberto Cristoferoni, Italy, who develops Warpstead. For anything about your data, write to hello@warpstead.com.

What we collect

• Your email address, once you confirm it with the link we email you.
• When you signed up, when you confirmed, and which version of this policy was online when you signed up, as a record of your consent.
• Where you heard about Warpstead, only if you choose to tell us: once you confirm, it’s added to a count per source (YouTube, Reddit, and so on). It is never stored next to your email address.
• Your IP address, only to stop automated abuse of the form: it is turned into a pseudonymous fingerprint (a hash with a secret key) that expires after one hour. It is never stored next to your email address.

If you don’t confirm, your address doesn’t go on our list. It travels, encrypted, inside the confirmation link, which stops working after 48 hours. So that the form can’t be used to send you the same email again and again, we keep a pseudonymous fingerprint of the address (a hash with a secret key) for 24 hours. Mailjet, which delivers the confirmation email, keeps your address in its own system — as a contact and in its sending logs — whether or not you confirm. Write to us and we’ll have it deleted.

This site doesn’t use cookies for analytics or advertising, and doesn’t follow you from one day to the next or onto other sites. Our hosting provider may set strictly necessary security cookies to protect the site from attacks.

Visit counts

To know how many people come by and what they try, each page sends one small count to our own server when it opens, and the browser preview sends one the first time you use a feature (adding a note, going full screen, and so on). We keep only daily totals: the page or feature, your country as Cloudflare detects it, phone or desktop, and the name of the website that linked you here.

To count each person once a day, your IP address and browser identifier are turned into a pseudonymous fingerprint (a hash with a secret key and the date). For that day it links the pages and features you used; after that day it’s deleted, at the latest when the next visit arrives or when we read the totals. Your IP address and browser identifier are never stored, and counting saves nothing on your device: no cookies, no local storage. Legal basis: our legitimate interest in knowing whether the site works (Art. 6(1)(f) GDPR).

We also use Cloudflare Web Analytics, which counts page views without cookies and without fingerprinting you; Cloudflare processes it on our behalf, as described below.

The browser preview remembers a few of your choices, such as the theme and the width of some panels, in your browser’s local storage. They stay on your device and are never sent to us; clearing your browser’s site data removes them.

Why, and on what legal basis

• To email you when there’s something to try: news such as version 1.0 and, if you registered a PC from the app, your founder price. Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by submitting the form and confirming your email.
• To send you the confirmation email, which you asked for by submitting the form, and to protect the form from abuse. Legal basis: our legitimate interest in keeping the service working (Art. 6(1)(f) GDPR).

We won’t send you newsletters or marketing about anything else, and we won’t sell or share your address with anyone for their own purposes. Leaving your email is optional: if you don’t, you simply won’t get the message.

How long we keep it

Until you unsubscribe or ask us to delete it, and in any case no longer than 24 months after you confirmed: after that, it’s deleted automatically. Every email we send you after you confirm includes a link to unsubscribe.

The Warpstead app

The app runs on your computer and sends us nothing on its own: there’s no account and no usage statistics. We don’t receive your files, your searches, what’s on your canvas or the tags the AI gives your images.

It connects to the internet in three cases. While the beta is running, it reads the current date from the headers of www.microsoft.com, www.cloudflare.com and www.google.com, a request that carries no data about you, so that the end of the beta doesn’t depend on your computer’s clock. The first time you turn on the AI features, it downloads an open AI model (Qwen) from Hugging Face; after that, tags and descriptions are made on your computer and your images are never uploaded. In the same way, the first time you turn on search by photo content, it downloads another open model (SigLIP 2) from Hugging Face, and your photos are read on your computer and never uploaded. And the web pages you open on the canvas come from the sites you visit, as in any browser: those sites can set cookies, which stay in the app’s folder, and their own privacy policies apply.

Reports you choose to send. After a crash, or from “Report a problem”, you can send us a report, and nothing leaves your computer until you press Send. It contains what you write, your email address if you give one (only so we can answer), the Warpstead and Windows versions and a package the app puts together when you open the Report tab: Warpstead’s full logs, which include the names of files and folders open in your nodes and can mention windows and websites you used in the app; Windows crash and hang reports for Warpstead from the last three days; a description of your PC (screens, graphics card and driver, the app’s settings); and, if you marked a moment, a snapshot of the windows of the programs in your nodes at that instant, with their class, position and owner but never their titles. A screenshot is included only if you tick “Attach the screenshot from that moment”, which is off by default. Your Windows user name and computer name are replaced in every text file, and the tab lists every file in the package before you send it. Reports arrive at warpstead.com through Cloudflare; the package is kept there for at most 30 days, and we move reports and packages to our own computer, delete them from the server, and delete our copy after six months. Your IP address is used only to limit how many reports can arrive in an hour or packages in a day, as a pseudonymous fingerprint (a hash with a secret key) that expires after one day at most, and is never stored with the report. The app shows a reference code after sending: write to us with it and we’ll delete that report straight away. Legal basis: your consent, given by pressing Send (Art. 6(1)(a) GDPR).

Registering this PC as a founder. During the beta the app offers to register your computer, so that you keep the founder price, or get the free license if you’re among the first 100, when version 1.0 comes out. Nothing is sent until you press “Register this PC”. The app then sends your email address, the Warpstead version and a code derived from your computer: a hash of the identifier Windows gives each installation. The code can’t be turned back into that identifier and says nothing about you or your files; it only lets us recognise the same PC later, for example when you activate a license. We keep it with the registration date for 24 months. Your address goes through the same confirmation as the form on this site: you get an email, and only when you confirm does it join our list, with the code next to it. Your IP address is used only to limit attempts, as for the form. Legal basis: your consent, given by pressing the button (Art. 6(1)(a) GDPR). Write to us and we’ll delete both.

Your workspaces, the search index, the photo fingerprints for search by content, the AI tags and your settings are kept in the app’s folder on your computer. When you uninstall Warpstead, Windows deletes that folder too. Your own files stay where they are.

Who processes it for us

The site and the list of addresses are hosted by Cloudflare, Inc., which acts as our data processor under its Data Processing Addendum. Cloudflare may process data outside the European Economic Area; those transfers are covered by the safeguards in that addendum, including the European Commission’s Standard Contractual Clauses. Emails, starting with the confirmation email, are delivered by Mailjet (Sinch group), which acts as our processor under its Data Processing Agreement and stores data in the European Union. We’ve turned off open and click tracking: our emails contain no tracking pixels and no rewritten links.

Your rights

You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. You can withdraw your consent at any time, without affecting what happened before. Just write to hello@warpstead.com or use the unsubscribe link.

If you think your data is being handled unlawfully, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali, or with the authority of the country where you live or work.

No automated decision-making or profiling takes place. The form isn’t meant for children under 14.

Changes

If this policy changes, the new version is published here with a new date. If the change affects how we use addresses already collected, we’ll ask for your consent again.