Drew Waitlist Privacy Policy
1. Who we are
The Drew waitlist is run by Drew App, To be added, Victoria, Australia. In this policy, "we", "us" and "Drew" mean that entity.
Privacy contact: hello@drewai.app.
We handle personal information under the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs).
2. Collection notice
Drew App collects your email address to hold your place on the Drew waitlist, count your referrals, show you your position on your own private waitlist page and, if you tick the box, send you updates. If you choose a display name, we show it publicly on the leaderboard. Our website host, Netlify, and our email provider, Resend, store and process data in the United States. If you don't give us an email, we can't add you to the list. See this policy for how to access or correct your details, or complain.
3. What we collect
| What | Examples | Why |
|---|---|---|
| Contact details | Your email address | To hold your place and email you |
| Display name (optional) | A name you choose for the public leaderboard | To show you on the leaderboard (you can remove it at any time, and change it once every 7 days) |
| Waitlist and referral details | Your referral code and link, the code of whoever referred you (if anyone), when you signed up and confirmed, and how many people who joined through your link have confirmed | To run the line fairly and work out your position |
| Consent records | When you signed up, when you confirmed, which wording you saw, and whether you ticked the updates box | To prove consent under the Spam Act |
| Account password | The password you choose for your waitlist page. We store only a salted, scrambled ("hashed", using scrypt) copy, never the password itself, so we can't see or tell you what it is. | To let only you log in to your waitlist page |
| Sign-in cookie | One cookie called drew_s holding a random sign-in code. It's set only when you log in, can't be read by scripts on the page (HttpOnly), is sent only over secure connections, and lasts 30 days unless you log out. We store a hashed copy of the code to check it. | To keep you logged in. It's strictly necessary for the log-in to work. We don't use cookies for tracking, analytics or ads. |
| Security details | A scrambled ("hashed") copy of your IP address and of the email typed into the log-in form, with counts of sign-up, log-in and password-reset requests in the current hour, and a count of recent failed log-ins for each email | To stop bots, repeated sign-ups and password guessing, and to lock log-ins for 15 minutes after repeated failed tries |
| Messages to us | Anything you send us by email | To reply to you |
We don't need sensitive information (for example health, religion or political views). Please don't send it.
We don't ask for your friends' email addresses or phone numbers. We only know someone was referred by you because they used your link. Drew never emails or messages your friends for you.
If we receive personal information we didn't ask for, we'll destroy or de-identify it if the law allows (APP 4).
4. How the fairness checks work (plain English)
We want the line to be fair. So we run a few checks when you sign up.
- Rate limits. We count sign-up requests from each IP address so we can block anyone sending too many at once. We store only a scrambled ("hashed") copy of the IP address, never the address itself, and delete these counts after about 2 hours.
- Email normalising. Gmail treats different spellings as the same inbox. For example, jo.smith@gmail.com, josmith@gmail.com and josmith+drew@gmail.com all reach the same person. We treat those as one email, so each person gets one place. We still send email to the address you typed.
- Double opt-in. You only join the line once you click the link in our confirmation email.
- Referrals. A referral only counts once the person you referred confirms their own email.
5. Automated decisions
Your position is worked out automatically, using the rule in the Waitlist Terms (section 4). A person reviews it before we remove anyone from the list or take away a referral. You can ask us to explain or review a decision by emailing hello@drewai.app.
6. How we use your information
- To send you the confirmation email and add you to the line once you confirm.
- To work out your position and count your verified referrals.
- To show you your position and referral link on your private waitlist page.
- To send you updates, if you ticked the box.
- To send factual emails about your place, your result and beta access.
- To stop bots, fraud and abuse.
- To reply to you, and to meet our legal obligations.
We don't use your information for anything else without telling you first.
7. Your position and the public leaderboard
We show a public leaderboard of the top spots on getdrew.app, and we may show the same leaderboard on our other Drew websites, such as drewai.app. It lists a position, a label and a verified referral count. When you join, you can choose to give us an optional display name. If you give one, it's shown publicly on the leaderboard as your label. If you don't, you're shown with a generic label such as "Member #12". You can add, change or remove your display name at any time from your private waitlist page. If you remove it, you go back to the generic label. Your display name is public, so don't use your full name or anything that identifies you unless you're happy for anyone to see it. When you remove it, or leave the waitlist, we stop showing it straight away. The leaderboard never shows anyone's email, referral code or who joined through whose link. A pinned founder row shows the total number of verified referrals across all members. It doesn't show anyone's details.
- Your own waitlist page shows your position, the provisional Founders and Beta lines, how many verified referrals you have, and your referral link. It's protected by the password you set, so only you can see it once you've logged in. The link in your confirmation email works once, to set that password. Share your referral link instead. The lines and positions shown are provisional until the final list.
- Your page shows the spots just above and below yours as a position, a referral count and each member's display name if they chose one (otherwise a generic label). It never shows anyone's email, or who joined through whose link.
7A. Things we don't collect yet
The Waitlist Terms describe things that come later, such as invites for the final top 500, payments for the paid beta and the launch offer, referral credits after launch, Drift and team enquiries. We don't collect any information for those yet. We'll update this policy before we do.
8. Emails (APP 7 and the Spam Act 2003)
- We send one confirmation email when you sign up. It asks you to confirm your address. If you ask us to resend it, we send it again.
- We send updates about your place in line, beta waves, invites and the launch offer only if you consent, by ticking the box on the form.
- We send factual emails to everyone confirmed: your cut-off result and your beta access link. These contain no promotion.
- Every email says who we are and how to contact us.
- Every update email will have a free unsubscribe link. No login needed. We act on it within 5 working days. You can also unsubscribe by emailing hello@drewai.app.
- We never sell or rent our list.
9. AI and your waitlist data
- Drew is an AI product, but we don't use your waitlist data to train AI models, and we don't send it to AI model providers.
- If this ever changes, we'll update this policy first and ask for your consent where the law requires it.
10. Who we share it with
We share personal information with service providers who help us run the waitlist. They may only use it to provide their service to us.
| Provider | What it does | Where data may be held |
|---|---|---|
| Netlify, Inc. | Hosts the waitlist website, runs its server functions and stores the waitlist, referral and consent records | United States (and Netlify's global edge network) |
| Resend | Sends our confirmation and update emails | United States |
We may also share information with our professional advisers, with a buyer of our business (who must follow this policy), or when the law requires it.
We don't sell personal information.
11. Sending information overseas (APP 8)
Our providers store and process your information outside Australia, in the United States (Netlify and Resend). Sign-ups from the waitlist form (your email, whether you ticked the updates box, and any referral code) are stored with Netlify, Inc. in the United States. Your email address is passed to Resend so it can send you our emails.
Before we send information overseas, we take reasonable steps so the provider handles it in line with the APPs. For example, we use reputable providers and rely on their contract and data processing terms. Under Australian law, we generally remain accountable for how those overseas providers handle your information.
12. Security and how long we keep it (APP 11)
- We encrypt data in transit. Only the people who run the waitlist can access the data. No system is completely secure.
- We keep waitlist data until you leave the list, or 12 months after Drew's public launch, whichever is first. Then we delete or de-identify it, unless you've become a customer or the law says we must keep it.
- Your password is stored only as a salted scrypt hash. Nobody at Drew can read it. Password reset links work once and expire after 30 minutes.
- Sign-in sessions end when you log out, when you set a new password, or after 30 days.
- The hashed IP and email counts used for rate limits are deleted after about 2 hours. Failed log-in counts are cleared after a successful log-in or after about 15 minutes.
- If you unsubscribe, we keep a small record so we don't email you again.
- If a data breach is likely to cause serious harm, we'll tell you and the OAIC, as the Notifiable Data Breaches scheme requires.
13. Access, correction and deletion (APPs 12 and 13)
Email hello@drewai.app to:
- see the information we hold about you;
- fix anything that's wrong; or
- delete your details. This removes you from the waitlist.
We may need to check it's really you. We'll reply within 30 days. It's free.
14. Complaints
Email hello@drewai.app. Tell us what happened. We'll acknowledge your complaint within 7 days and aim to resolve it within 30 days.
If you're not happy with our answer, you can complain to the Office of the Australian Information Commissioner (OAIC): www.oaic.gov.au, phone 1300 363 992.
15. Age
The waitlist is for people aged 18 or older. We don't knowingly collect information from anyone younger. If you think a child has signed up, email us and we'll delete it.
16. If you live in the EU, UK or EEA (GDPR)
If the GDPR or UK GDPR applies to you:
- Drew App is the controller.
- Legal bases: your consent (for update emails and for showing your display name), and our legitimate interests (running a fair waitlist and referral programme, and stopping fraud).
- Your rights: access, correction, deletion, restriction, objection, data portability, and withdrawing consent at any time.
- Transfers: your data goes to Australia and the United States. We rely on each provider's data processing terms for these transfers. Email us for details.
- You can complain to your local data protection authority.
17. If you live in California (CCPA/CPRA)
If California law applies to us:
- What we collect: identifiers (email address, a hashed IP address, and your display name if you choose one), and waitlist activity (sign-up, confirmation and referrals).
- Sources: you, your browser, and the referral link you used.
- We don't sell or "share" personal information for cross-context behavioural advertising.
- We don't use sensitive personal information for purposes that would create a right to limit.
- Your rights: to know, access, correct and delete your information, and not to be treated differently for using these rights.
- To make a request, email hello@drewai.app.
18. Changes
We'll post updates here and change the date at the top. If a change is significant, we'll email waitlist members who've agreed to emails.
See also the Waitlist Terms. ← Back to Drew