Effective 29 September 2026 · Version privacy-2026-09-29
Privacy notice
This notice covers this website and its email list. Bayawak itself isn't available yet and will come with its own notice.
At a glance
- I collect your email address to tell you when Bayawak can be installed, plus a short progress note about once a month until then.
- Everything else is optional.
- Every email has a one-click unsubscribe. Unsubscribing deletes your address and your answers.
- No selling, no ads, no tracking pixels or tracked links in emails, and no cookies on this site.
- One person runs this: Rudolf Arthur, in Manila, Philippines.
Who is responsible
Rudolf Arthur, an individual in Manila, Philippines, decides how this data is used. Under Philippine law that makes me the personal information controller; under the EU and UK GDPR, the controller. I'm also the person accountable for data protection (the data protection officer). Email: hello@bayawak.dev.
What I collect
- Your email address. Required to join.
- Optional answers, asked after you join: your operating system, which AI agent you use, and one line on what you'd want Bayawak to remember for you. Please don't put anything private or sensitive in that line.
- Where you came from: a short tag from the link you used (for example, a post or the film), if the link had one.
- Your country, as estimated by Cloudflare from your connection. Only the two-letter code is kept.
- Proof of your consent: when you signed up, which version of the sign-up text you saw, when you confirmed your address, and when confirmation emails were sent to you.
- A keyed code made from your IP address, not the address itself, used only to limit repeated sign-up attempts. It's deleted from the live database within 24 hours.
- Delivery records for emails sent to you (sent, delivered, bounced), kept by Resend.
Why I use it
| Purpose | What's used | Legal basis |
|---|---|---|
| Email you when Bayawak can be installed, and about monthly progress notes until then | Email, consent proof | Your consent |
| Decide what to build first | Your optional answers | Your consent |
| See where interest comes from | Link tag, country | Legitimate interest |
| Keep the form safe from bots and abuse | IP code, bot-check signals | Legitimate interest |
| Make sure a restored backup never emails you after you leave | One-way code of your address, dates | Legitimate interest in honouring your choice |
| Count visits | Visit statistics | Legitimate interest |
Consent: Data Privacy Act s.12(a), GDPR art. 6(1)(a). Legitimate interest: Data Privacy Act s.12(f), GDPR art. 6(1)(f). I read the optional answers myself and count them. Nothing is decided about you automatically, and nothing gives other people or systems automated access to your data.
What I don't do
I don't sell or rent your data, use it for advertising, add it to any other list, or share it with anyone except the services named below.
Cookies and your browser
This site sets no cookies. Visit counts come from Cloudflare Web Analytics, which uses no cookies or local storage and doesn't fingerprint visitors. The bot check on the sign-up form (Cloudflare Turnstile) starts when you begin using the form. It keeps one small item in your browser's local storage and sends Cloudflare technical signals, such as your IP address and browser type, so it can tell people from bots. If Cloudflare has to challenge unusual traffic, it may set a short-lived security cookie.
Who handles the data for me
- Cloudflare hosts the site, stores the list, runs the bot check and visit counts, and forwards mail sent to hello@bayawak.dev. Cloudflare also uses bot-check signals under its own responsibility to improve its bot detection (Turnstile Privacy Addendum).
- Resend sends the emails. Resend also keeps delivery records for its own security and abuse prevention (Resend privacy policy).
- Google (Gmail) holds the emails you send me, under Google's own terms and privacy policy.
Cloudflare and Resend work under data processing agreements with me.
Where your data goes
Your data is stored and processed outside your country, including in the United States. I stay responsible for it wherever it's processed. The European Commission has not issued an adequacy decision for the Philippines. Cloudflare, Resend and Google are certified under the EU-U.S. Data Privacy Framework and its UK extension. Their data processing agreements include the EU Standard Contractual Clauses and the UK addendum: Cloudflare DPA, Resend DPA.
How long I keep it
| What | Kept until |
|---|---|
| A sign-up you never confirm | Deleted about 30 days after the last confirmation email, or 30 days after signing up if no email could be sent |
| Your address, answers, link tag, country, consent proof | You unsubscribe, or 30 days after the launch email, whichever is first. If Bayawak hasn't launched by 29 September 2028, I'll ask once whether you want to stay; without a yes, you're removed. |
| After you unsubscribe | A one-way code of your address and the dates you joined, confirmed and left, so I can make sure a restored backup doesn't add you back. Deleted when the list closes. |
| IP code | Deleted from the live database within 24 hours |
| Backup copies of the database | Up to 30 days |
| Resend's copies of emails and delivery records | 30 days |
| Server logs (event and error messages, no email or IP address) | Up to 7 days |
| Emails you send me | Until your question is dealt with, and no longer than 12 months |
Your rights
You can:
- unsubscribe in one click from any email;
- get a copy of your data in a common format you can reuse;
- have it corrected;
- have it deleted, or object to or limit how it's used;
- withdraw your consent at any time. That doesn't undo emails already sent.
Your right to object. Where I rely on legitimate interest (the link tag, your country, the bot check, the unsubscribe code and visit counts), you can object at any time by writing to hello@bayawak.dev.
Write to hello@bayawak.dev from the address on the list, and I'll reply within 15 days. I only send data to the address it belongs to. If a subscriber has died or can't act for themselves, their lawful heirs or assigns can make these requests. Under Philippine law you can also claim damages for inaccurate or unauthorised use of your data.
Complaints
You can complain to the Philippine National Privacy Commission. The Commission generally expects you to raise the problem with me first and give me 15 days to respond. In the EU/EEA or UK, you can also complain to the data protection authority where you live or work (EU list, UK ICO).
Do you have to give me this?
Only your email address, and only if you want the emails. Everything else is optional, and skipping it changes nothing.
Age
The list is for adults. Please don't sign up if you're under 18.
Changes
If I change how your data is used, I'll email you before the change applies, and ask again where a new yes is needed. The date and version at the top always show the current notice.
Contact
Questions or requests: hello@bayawak.dev
Operator: Rudolf Arthur, based in Manila, Philippines.