Privacy

Short, because there isn't much to say.

Last updated: 19 July 2026.

Who is responsible

The data controller for this website and the early-bird list is the maker of Bandura. For anything privacy-related, write to hello@bandura.dev — it's read and answered by a human, not a ticket queue.

What we collect, and why

If you join the early-bird list: your email address, and — only if you choose to answer — which tool you currently use. That's the entire dataset. No tracking pixels in the emails, no enrichment, no third-party ad tech. The legal basis is your consent (GDPR Art. 6(1)(a)): you type your address in, and you confirm it by clicking the link we send (double opt-in). You can withdraw that consent at any time — see below.

Cookies

This site sets no cookies — none, not even "essential" ones — and stores nothing in your browser (no localStorage, no fingerprinting). Analytics, if enabled, is a privacy-preserving, cookie-free page counter: aggregate counts only, no personal identifiers, no cross-site tracking. There is no cookie banner because there is nothing to consent to; this section is the entire cookie policy.

How long we keep it

If you never click the confirmation link, your address is automatically deleted after 30 days — enforced in the database itself, not by a cleanup job we might forget to run. Confirmation links expire after 7 days. A confirmed address stays on the list until you unsubscribe or ask us to remove it.

Where it's processed

Signups are stored and confirmation emails sent via Amazon Web Services (AWS) in the United States (us-east-1). AWS is certified under the EU–U.S. Data Privacy Framework and processes data only on our instructions. The website itself is served by a CDN (static files only — the site has no server of its own). That's the complete list of processors; nobody else touches the data.

What we will not do

No selling, no sharing, no "trusted partners." The list exists to tell you when the product ships, and for nothing else — expect one or two emails total before launch.

Your rights, and getting off the list

Every email has a one-click unsubscribe. Beyond that, you have the right to ask what we hold about you (spoiler: an email address and maybe a tool name), to correct it, to have it deleted, to receive a copy of it, and to withdraw consent — write to hello@bandura.dev and it's handled promptly, by a human. If you're in the EU/EEA or UK and think we've handled your data badly, you also have the right to complain to your local data-protection authority — though we'd appreciate the chance to fix it first.

The product itself

Bandura the app is local-first by design: your flows are files on your machine, your API keys live in your OS keychain or your own .env, and nothing is sent to us. Any future telemetry will be strictly opt-in — that's a product principle, not a policy footnote.