Privacy Policy

1. Who is responsible for your data

Norply Inc., a Delaware C-Corporation registered at 131 Continental Dr, Suite 305, Newark, DE 19713, USA, is the data controller for the information described here. For any privacy question or request, email founders@norply.co.

2. What we collect, and why

We collect nothing at all unless you submit the waitlist form on the Gainy AI page. When you do, we store one row containing:

• Your email address. Required. This is the only way we can tell you the app has launched.
• Your answers to the optional survey questions: which description fits you, what gets in the way, whether you track calories now and with which app, what you would pay per month, and your free text answer about what would make the app a must-have. Every one of these is optional and the form works without them. We use them to decide what to build first.
• UTM parameters and the referring website (utm_source, utm_medium, utm_campaign, and the referrer), if you arrived from a link that carried them. This tells us which posts and links actually brought people in.
• A two-letter country code, derived by our host from the IP address of your request. We store the country code only. We do not store your IP address in our database.
• The date and time of your signup.

We do not ask for your name, your phone number, your address, or any health information, and we have no way to collect card or payment details anywhere on this site.

3. Abuse prevention

To stop automated signups, the form includes a hidden field that people never see, it rejects submissions completed unrealistically fast, and the server briefly counts requests per IP address to rate limit them. That IP count lives in memory for a matter of minutes and is never written to our database or shared with anyone.

4. Legal basis for using it (UK and EU visitors)

• Consent (Article 6(1)(a) GDPR) for sending you the launch email. You gave it by submitting the form, and you can withdraw it at any moment.
• Legitimate interests (Article 6(1)(f)) for understanding demand for a product we have not built yet, and for keeping the form free of spam and abuse.

5. What we send you

One email when Gainy AI launches. If the launch date moves significantly, or if we cancel the product, we will send a short note saying so. That is the whole plan. There is no newsletter, no drip sequence, and no promotional series. Every email we send will contain a one-click unsubscribe link, and you can unsubscribe at any time by replying to any email or writing to founders@norply.co.

6. Where your data is stored

Waitlist rows are stored in a Supabase (PostgreSQL) database hosted in the European Union, in the eu-central-1 region (Frankfurt, Germany). Access is restricted to the founders of Norply Inc.. Row Level Security is enabled on the table and the public has no insert, read, or update policy, so the database cannot be read or written from a browser. Signups are written only by our own server.

The website itself is hosted by Vercel, which serves it from a global edge network. As a US company, we access our own data from the United States; where personal data of EU or UK residents is transferred to the US, we rely on the European Commission’s Standard Contractual Clauses as included in our providers’ data processing agreements.

7. Who we share it with

We do not sell your personal information, and we never have. We do not share it with advertisers, data brokers, or any third party for their own marketing purposes. The only parties that touch it are the service providers we need in order to run:

• Supabase — database hosting, in the EU, as described above.
• Vercel — website hosting and privacy-friendly traffic analytics.
• An email delivery provider, at the point we actually send the launch email. We have not selected one yet; when we do, we will name it here before your address is uploaded to it.

We would also disclose information if we were legally required to, or to protect our rights or someone’s safety. If Norply Inc. is acquired, waitlist data may transfer to the acquirer, who would remain bound by this policy.

8. Cookies and analytics

This site sets no cookies. Not for advertising, not for analytics, not for anything. There is no cookie banner because there is nothing to consent to.

We do use two things you should know about:

• Vercel Analytics, which counts page views without cookies and without building a profile of you across sites. It records things like the page URL, the referrer, the country, and the browser and device type.
• Your browser’s sessionStorage, under the key norply.attribution. If you arrive from a link with UTM parameters, we keep them there so they survive you clicking between pages before you reach the form. It is not a cookie, it is not sent to any third party, and your browser discards it when you close the tab.

We use no advertising pixels, no Google Analytics, no Meta pixel, no session recording, and no fingerprinting.

9. How long we keep it

We keep your waitlist row until the launch email has been sent and for up to twelve months after that, so we can tell who came from the waitlist. After that we delete it. If we abandon Gainy AI without launching, we will delete the entire waitlist within ninety days of deciding. If you ask us to delete your data sooner, we do it on request rather than on this schedule.

10. Your rights

Wherever you live, you can ask us to do any of the following, and we will act on it:

• tell you exactly what we hold about you;
• send you a copy of it;
• correct it if it is wrong;
• delete it;
• stop emailing you;
• restrict or object to how we use it.

How: email founders@norply.co from the address you signed up with, or tell us which address to look for. We will respond within thirty days, and usually within two business days. There is no charge, no form to fill in, and we will not ask you why.

If you are in the EU or UK, you also have the right to data portability and the right to lodge a complaint with your local supervisory authority. We would rather you gave us a chance to fix it first.

If you are in California, the CCPA and CPRA give you the right to know what we collect, to delete it, to correct it, and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those laws define it, so there is nothing to opt out of, and we will never discriminate against you for exercising any of these rights.

11. Children

This site and our products are not directed at children. We do not knowingly collect personal information from anyone under 16. If you believe a child has submitted their email to us, write to founders@norply.co and we will delete it.

12. Security

The site is served over HTTPS. The waitlist database is reachable only with a server-side key that is never exposed to the browser, and Row Level Security is enabled with no public policy. No system is perfectly secure, but the amount of data we hold is deliberately small: an email address and a handful of multiple-choice answers.

13. About the app

Gainy AI has not launched. When it does, it will have its own privacy policy covering the data the app itself handles, such as food logs, photos, and weight entries. That policy will be published before the app is available to download. This policy covers only this website.

14. Changes to this policy

If we change this policy we will update the “Last updated” date at the top of the page. If a change materially affects how we use data we have already collected from you, we will email you before it takes effect.

15. Contact

founders@norply.co, or Norply Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, USA.