Privacy notice

What we collect

When you join the waiting list, we collect:

• Your name — so we can write to you by name rather than “Hello there”.
• Your email address — so we have somewhere to send the news.
• Your preferred role, if you choose to give it — player, host, instructor, coordinator, or undecided. The form says it is optional because it is.
• The date and time you joined — so we know the order people joined in. The database stores the moment, to the fraction of a second.
• When the request we are holding was made — which is the moment you signed up, and stays that unless you ask us to put you back on the list after coming off it. Then it becomes the day we started again, because that is the day the request we hold was actually made, and it is what the 30 days below are counted from.
• When we last tried to send your confirmation, and when the company that sends our email took it — two moments, kept so that you are not sent the same confirmation twice, and so that one lost to a problem at our end can be sent later rather than silently dropped. In the ordinary course that means exactly one. We stop short of promising it outright: if the company that sends our email accepts a message and our own record of that fails to save, a later attempt can send a second copy. It is rare, and we would rather say so here than make a promise the system does not keep. We are not able to tell you that we would spot it: the second copy looks like an ordinary send from our side, so if it matters to you, tell us and we will look. Last tried, not first: each attempt overwrites the one before it, so if the first did not get through we no longer hold when that was. The two are usually the same second. Neither says the message reached you — only that it was handed over.
• And if we ever had to ask you a second time, when the first of those messages was handed over — kept only for somebody who came off the list and later asked us to put them back, because then we have to forget that we wrote to them in order to send the new link, and this is what stops that forgetting erasing the fact that the company which sends our email was given your address. Nothing sends anything on the strength of it.
• Whether you confirmed the address is yours, and when — the form is open to anyone, so somebody could type your address into it. Until you press the button in the email we send, we treat what we hold as a request rather than a place on the list: we do not write to you again, you are not in the list we use to send the launch announcement, and we delete the request after 30 days. If you do press it, we keep the moment you did, because that is our record of your agreement.
• Which page you joined from, which today is always the waiting list itself, because that is the only place the form appears. If we ever put the form somewhere else, this would say which — it would still be about the page, never about you. It can only ever be one of a short list of page names we have written down in advance, so nothing else can be smuggled into it.

That is everything the waiting list holds about you. The row also carries a database identifier — a long random string our database gives every row so it can tell them apart. It says nothing about you and means nothing outside our own database, so we do not send it in an access response unless you ask — with one exception, set out below, where it has been written into the note we keep outside the database and goes to you as part of that note.

One thing sits outside it, and we would rather name it than let the sentence above quietly overstate. If you write to us and we CHANGE something as a result — you come off the list, we correct a detail, we erase your record — we keep a short note of that request outside the database: your address, what you asked for, the date you asked, the date and time we started, the date and time it was done, and — if you asked us to correct something — what the corrected value should be, because otherwise we could not put the correction back after a restore. Nothing else, and never the contents of your message.

Two times rather than one, and the second is why. The first is when we decided to act; the second is when it actually happened. They look like the same fact and are not: a request begun and interrupted would otherwise leave a record claiming something we never did, and our own recovery would then read that claim as proof and leave your request unhonoured.

One line in it is not about a request you made. This notice says elsewhere that if we learn we hold details for someone under 18 we delete them, and that deletion keeps a line here too. The same six columns as any other line — the address, that the record was removed because of age, the date, both times, and no corrected value, because there is nothing to correct. It is the same reason as everything else on this page: a restore from an older backup would put the record back, and this note is the only thing that would tell us to remove it again. We would rather say so than have it be the one line nobody had mentioned.

That line is the one place the identifier above can end up. If we removed a record because of age and you then told us you had in fact been 18 when you signed up, we write into that line which signup you meant — by its database identifier, because a date would not say which one. So: that line can hold the identifier; it goes to you with the rest of the note if you ask what we hold, whether or not you asked for the identifier itself; and it outlasts the record it names, because surviving an erasure is what the note is for. It still means nothing outside our own database, and we still never use it to contact anybody.

Asking to see what we hold is not one of those. It changes nothing, so there is nothing for a restore to undo and nothing to put back — and a line about you kept for no purpose is the opposite of what this note is for. We answer, and write nothing down.

This is also the one thing that outlives an erasure, which is the case worth being explicit about: if you ask to be erased, the record goes and this single line stays, for exactly the reason below. One line, not a history. If you had asked us for something before — a correction, say — those earlier lines are replaced by the erasure line rather than kept beside it, so what survives is that you asked to be erased and when, and not what you asked for previously or what value you gave us. And nothing is added afterwards for a request that changes nothing: if you write to us again once you have been erased — to ask what we still hold, say — we answer, and record nothing, because there is nothing for a restore to put back.

Two kinds of thing can be added to that line later, and only these two. One kind is something you told us. The other is a note of what we decided about your line during a recovery from a backup, and which recovery it was. We describe them as kinds rather than as a list, because the list has grown as the recovery procedure has, and a promise that counts them would keep becoming untrue.

• If we could not tell whether an erasure of yours actually completed — it happens, and the paragraph above explains why — we write and ask, and record that you told us you had signed up again, with the date. If putting you back on the list was part of that answer, that action gets a line of its own too, the same as any other thing we do.
• If a record we deleted because you were under 18 comes back in a restore from an old backup, we will write to you and ask one question— whether you were already 18 on the day you signed up. Not whether you are 18 today, which would be a question about the wrong moment. We take you off the mailing list before we ask, so nothing reaches you while we wait, and we put you back only if you tell us you were.
  
  We ask everybody in that situation, including people we may be writing to for the first time, and we would rather say why than have the message arrive unexplained: a restore can bring back the record we deleted or a later one you made yourself, and nothing in our timestamps can tell those two apart. Asking is the only answer that does not risk destroying a signup you meant to make. If you do not reply, we delete the record — because being older now would not make the old one keepable, since you could not have agreed to it at the time.
• And when a recovery from a backup reaches your line, we note what we decided and which recovery it was — that we deleted an under-18 record again, that we held off and asked you, or that we left your row alone. The note names the recovery, not the moment we acted: it is there so that the second half of the same recovery does not undo what the first half decided. Nothing in it is new information about you, and it goes on the line already there rather than a new one, because a new line would move the date every other comparison is measured against.

The first kind exists for a reason that favours you: without it we would put the same question to you again after every restore, indefinitely. The second is a record of what we ourselves did. Neither adds anything you had not already told us or we had not already done, and nothing else is ever added.

It exists for one reason. The database can be restored from a backup taken before your request, and that restore would silently undo it. The note outside the database is the only thing that survives to put it back. It is kept for as long as the waiting list exists — because a restore can happen at any point in that life — and it is deleted when the list ends, along with the list itself.

Who sees it, and the one time it is used to write to you. Nobody sees it but the founder — and you, if you ask what we hold, because your own line in it is part of the answer and we send it to you whole rather than an edited version of it. It is never used for marketing. It is used to write to you, in one situation, and we would rather describe the whole of it than name one example and let “never” quietly cover the rest: when restoring a backup leaves us unable to tell what you had asked for, we write and ask you instead of guessing. That covers a restore that loses a record we had already settled with you, one that brings back a record you had asked us to erase, and one that brings back a record we had removed because of age — in each case the note may be the only place your address still exists, and the alternative to asking you is deciding for you. It is the note doing its job rather than a new use of your address, but it is us contacting you, so it belongs here.

One more place your address can sit for a while, on the founder’s own computer. If you ask to be erased and the database does not come back and say plainly that it is done, the panel she uses has to remember which record she asked about — so that pressing again deletes that one, and not a signup somebody made in the meantime. It remembers it in a cookie on her computer, and that cookie holds your email address and the record’s database identifier, and nothing else: never your name, never your role. It lasts up to thirty days, and the next attempt that settles the question takes it down, whichever way it settles. No script on any page can read it, and no other site can create one in its name.

It is not only on her computer, and we would rather be exact. Her browser sends it to our own server along with her requests to the site, because reading it there is how the panel knows which record to delete — so our application sees it, and so does Vercel, which runs our servers and is named below with the others. Nobody beyond that: it goes to no company we have not named on this page, and to nobody outside them.

What we can promise about it, and what we cannot. We clear it when we erase you, and it goes with everything else when the list ends. What we cannot do is tell you reliably, on the day you ask, whether a copy of it is sitting somewhere: it lives in the browser she signed in with, so a second browser can hold its own copy that the first cannot see. So if you ask what we hold and an erasure of yours was left unfinished, we will tell you that this is a place your address may still be, and that we are clearing it — rather than claim a certainty we do not have. It is the same kind of limit as the backups further down this page, and we would rather name it than round it up.

If you have an account

Consent records

When you agree to our Terms of Service, this Privacy Notice or our Community Standards, we keep a record of which document and version you agreed to, when you agreed, and whether it was at sign-up or later. We use it only to show that you agreed. It is deleted when you delete your account.

What we do not collect

We are being specific, because a notice that lists what it does not do is usually hiding something, and we would rather this not be that kind of notice.

• No phone number. The form does not ask for one and there is nowhere to put one. We will never call or text you.
• No stored IP address, location, or device information. Your IP address is seen briefly, in passing, to slow down anyone hammering the form. It is never written down. That holds for an account too: Supabase’s record of each sign-in, described above, notes our own server’s address and details, not yours.
• No cookies, trackers, or analytics on the pages you use, other than the cookies described above if you have an account. The waiting list and this notice set nothing on your device and call no third party at all — even the typefaces are served from our own site rather than fetched from Google’s.(The private page where we sign in to read the list does set cookies — on the founder’s own computer, never on yours. They are for the sign-in itself, with one exception that can hold your address, described above.)
• Nothing about your health, your finances, or your precise whereabouts.

Why we use it

• To ask whether the address is really yours. One email, sent as soon as somebody puts your address into the form, with a button in it. Press it and your place is held. Ignore it and nothing more happens: we do not write again, you are not on the list we use to send the launch announcement, and we delete the request after 30 days. It is the first of exactly three things we may send you; the other two are below, and you only ever get those if you pressed the button. There is no fourth unless you tell us otherwise.
• To tell you when The Fifth Wind opens. That is what you signed up for, and it is the second of the three.
• To tell you if this notice changes in a way that affects you. That is the third and last, and it is named on the form you filled in. It is not marketing: it is how the promises on this page stay true rather than quietly becoming something you never agreed to. If you have asked to come off the list, we will not send it.
• If we later want to write to you about anything else — news, features, invitations to play — we will ask you first, in that launch email, and only send it if you say yes. The form you filled in promised the confirmation, the launch and a notice change, and nothing more, and we are not going to treat filling it in as agreement to something it did not mention.
• To understand how many people have signed up and what they are interested in, so we build the right thing first.

We will not use your details for anything else without telling you first and giving you the chance to say no.

Who else sees it

Only the companies that run the software for us, and only so they can run it:

• Supabase — stores the list and member accounts, and sends the sign-in emails.
• Vercel — runs the website.
• Google Workspace — holds the mailbox at privacy@fifthwindmahj.com. If you write to us to exercise any of the rights below, they hold your address and the whole of your message for as long as it sits in that mailbox. That is more than the waiting list itself ever sees, because the list holds no message at all — so it is named here rather than left out.
• Resend — sends the email that goes out: the confirmation, and later the launch announcement. The confirmation goes the moment somebody joins, so this is a wider flow than the mailbox above, where we only ever see the people who choose to write to us — but it reaches only the people we have actually tried to write to. Anybody we have not tried to write to yet, whether they joined before sending was switched on or their confirmation has not gone out, has had nothing of theirs reach them. One more kind of email goes through the same company, and it is not to anybody on the waiting list: when we switch it on, a short notice to our administrator that a report was made about one of her own gatherings. It holds her email address and names the gathering, the reason chosen from the list and the day, and never who sent the report or what they wrote. Where a request did reach them — which is the ordinary way it goes — they hold your address and the message, in their own record of the requests we made, whether or not the message itself went: it is the request that hands them the address, not the delivery. Where one failed on its way we cannot tell you whether it arrived, so we assume it may have rather than assume it did not. And one thing more, in anything they did receive: a scrambled label we attach to each message so that a repeat of the same one can be spotted and dropped rather than sent to you twice. It is not your name, your address or the identifier above, and it cannot be turned back into any of them.

They act on our instructions and may not use your details for their own purposes.

We do not sell your personal information, and we do not share it with advertising partners, data brokers, or anyone else for their own marketing. If that were ever to change we would tell you before it did, and ask rather than assume.

The one exception anybody can honestly make: if the company were sold or merged, the list would go with it, and whoever bought it would be bound by this notice. And we would hand over information if the law required it of us.

How long we keep it

We keep your details while the list is live and while you want to hear from us.

If nobody confirms the address, we delete what we hold after 30 days. That is the whole answer for a request that was never answered — your name, your address and everything else listed above goes, by itself, without anybody having to ask us. We think that matters most in the case where somebody else typed your address in: you did nothing, you told us nothing, and the right outcome is that we are not left holding your details because of it. A sweep runs several times a day, so the delay between the 30 days being up and the row going is hours rather than longer.

Unless you told us to stop. That email carries a link to come off the list as well as the button to confirm, and if somebody uses it we have to remember that they did — otherwise the next person to type their address into the form starts the whole thing again, and the promise that “no” stays no would be worth nothing. So a request that was refused is not deleted after 30 days.

And if you ask us to put you back, the 30 days start again from that day rather than from the day you first signed up — because what we do is send you a fresh email asking you to confirm, and the request is the one you have just made. If you do not answer that one either, it goes the same way, 30 days later.

What we keep in that case is the record as it stands, marked as refused — the same treatment as anybody else who comes off the list, which means the details listed further up stay with it rather than being reduced to your address alone. We would rather say that plainly than describe something tidier than what we do. The reason it is not trimmed is that the record is also what tells us whether a company that sends our email was ever given your address, and trimming it would take that away — so the two promises pull against each other and this is the resolution for now. You can ask us to erase it outright at any time, and the address below is the way.

And when it stops being live, we delete it. Once the waiting list has done its job — we have opened, and written to everyone on it — we close the signup form, delete every row in the list, delete the short list of addresses that asked not to be written to, delete the separate note described above, clear the one cookie described above that can still be holding an address, and delete the emails anyone sent us at the privacy address. Not archived, not kept in case it is useful later: a list held after the reason for holding it has gone is exactly what this section exists to rule out. We keep the privacy address answering for a short while afterwards, so that somebody who writes just after we have closed still gets a reply — and by then the reply is that nothing of theirs is held. The one thing outside our reach is the same one named further up — our providers’ own backups, which age out on their schedule rather than ours.

One thing we do not set the clock on. Every email we send goes to Resend as a request to send it, and a request that reaches them leaves a record there — your address, the message, and the scrambled label above — in their own logs rather than in our database. That record exists whether or not the message itself ever arrived with you: it is the asking that makes it. Where a request failed on its way, we cannot tell you whether it got that far. We can delete our copy of you and we do; what we cannot do is reach into their record and pretend otherwise. That stays true if we stop sending: their record does not go away when our key does. It is the same kind of limit as the backups above, and it is named here for the same reason: a notice that only lists the places we control is describing our half of the arrangement and calling it the whole.

If you ask to come off, we keep a single record that you asked — your address and the date and time we recorded it, which is when we actioned your email rather than necessarily when you sent it — and nothing else changes. That sounds contrary, so here is the reason: if we deleted the row outright, nothing would be left to say you had ever asked, and a later restore from an old backup could put you back on a list you had already left. Keeping the note is how “no” stays “no” in ordinary use.

It is not magic, and we would rather say so than let you assume otherwise. That marking is on the row itself, in the same database as the list — so a restore from a backup taken before you asked brings your row back without it, and the database alone has then forgotten. The separate note described further up this page is the thing that does not live in that database, and it is the only reason the marking can be put back at all: our recovery checklist re-applies every request in it before the list is used again.

Two different things, and worth keeping apart. The marking on your row is what makes the export skip you. The note outside it is what survives a restore and puts the marking back.

A third, and it is the smallest. We also keep a short list of the addresses that have asked not to be written to — your address and the date, and nothing else at all. It exists because what you were asking about may already have been deleted by the time you press the link: we delete a request nobody confirms after 30 days, and the link in the email we sent you does not stop working. Without this, a “no” sent on the thirty-first day would have nothing left to be written on, and somebody typing your address into the form a week later would start it all over again. While your address is on that list the form quietly does nothing: no record, no email, and the page says exactly what it says to everybody else. Write to us if you change your mind and we will take it off. If you ask us to erase you completely it goes with everything else — which is the one case where a later signup by somebody else could reach you again, and the reason we say so here rather than leave you to find out.

If you would rather we erased you completely instead, say so and we will, and we accept the small risk that comes with it.

Your choices

• To come off the list: every email we send to people on the list carries an unsubscribe link at the foot of the message. Following it asks you to confirm, and we record from there that the address the message was sent to does not want emails from us — nobody has to read a request and act on it. A link acts on the address it was sent to rather than on whoever opens it, so if an email of ours was forwarded to you, use the link at the foot of one we sent you instead. We also send the two signals that let an email program offer its own one-click unsubscribe, near the sender’s name — whether yours shows it is its decision and not ours, which is why the link in the message is the one we promise. You can also email privacy@fifthwindmahj.com and say so, and we will do it by hand — usually the same day and always within a few. That mailbox is set never to file your message as spam, and it is checked including its spam folder even so — a promise about how quickly we answer is worth nothing if the message can sit somewhere unread.
• To see what we hold about you: email us and we will send it — to the address we hold, and only if the request comes from it. We will reply there to confirm before we send anything, because the sender line on an email can be typed by anyone and a reply to your own mailbox cannot. That is not bureaucracy: an email address is the only thing tying a request to a record here, so without that rule anybody could ask us for your details by naming your address.
• To correct it: email us and we will fix your name, or which of the 5 options you picked, by hand — the same way we take people off the list today. We will confirm with you first, by replying to the address on the record with a short code, and acting only when you send it back. If the address itself is wrong, we cannot correct it, and we would rather say so than promise it: a request to change an address necessarily comes from somebody who cannot receive mail at the one on the record, so we have no way to tell you apart from somebody trying to take over your place on the list. Join again with the address you want. We cannot delete the mistyped one on your say-so either, and for the same reason: nothing lets us tell somebody correcting their own typo from somebody trying to have another person’s record deleted. Do tell us anyway — it is useful to know — but what we can act on is a request from the address itself. If the typo turns out to be a real person’s address, they can write to us from it and we will take them off at once, which is a request we can actually check.
• To have it deleted: email us and we will delete your record from the list — your name, your address, your role, all of it. And the emails you sent us, which are not in the list at all: they sit in the mailbox described further down, and they go too, along with our replies. Otherwise the sentence that follows would be false the moment we wrote it — your own words about yourself would still be here. What we cannot reach is Google’s own backups of that mailbox, or any record of email we sent you held by Resend that sends our email — limits worth telling you about rather than glossing over, and the same kind that makes the line below necessary on the database side. One line survives, and we would rather tell you than surprise you: the note described above keeps your address and the fact that you asked to be erased. It is not a copy of your record, and what it is used for is the list above: it survives a restore so we know to erase you again, it goes to you if you ask what we hold, and it is what we would write from if a restore left us unable to tell what you had asked for. It is there because the database can be restored from a backup taken before you wrote, and that restore would bring your record back — the note is the only thing that would tell us to delete it again. Deleting the note as well is what would make your erasure temporary.

We will not treat you any differently for asking.

Where your details are held

The waiting list is on servers in us-west-2 (Oregon, United States). If you are writing to us from outside the United States, your details will be stored there.

Anything you email us is a separate answer, and it is worth saying rather than leaving you to assume the line above covers everything. Those messages sit in a Google Workspace mailbox on Google’s servers, not on ours, and we do not choose which country those are in.

Email we send you is a third answer, for the same reason. It leaves through Resend, on their servers rather than ours, and we do not choose which country those are in either.

If you are in California

Under the California Consumer Privacy Act you have the right to know what we hold, to receive a copy, to correct it, to delete it, and to opt out of the sale or sharing of your personal information. As set out above, we do neither, so there is nothing to opt out of — but the rest are yours. Email privacy@fifthwindmahj.com with “California Request” in the subject. We will check you are who you say you are before we answer, and we will not treat you differently for asking.

If you are outside the United States

The Fifth Wind is run from California. If you are in the United Kingdom or the European Union you also have the right to object to our using your details, to ask us to restrict how we use them, to receive a copy in a portable form, and to complain to your national data protection authority. Our basis for writing to you is your consent, which you gave by joining the list and may withdraw at any time.

What “restrict how we use them” means here, concretely. The rights above are yours whatever this page says, so we are not going to narrow them. But a notice that says “email us and we will help” and leaves it there is promising a button that does not exist, so here is what actually happens. There are exactly four things we do with your details: we count you in a total, we send you the confirmation once, we will email you when we open, and we will email you if this notice changes in a way that affects you. Ask us to restrict, and we will take you off the mailing side immediately. That part is a button — the same one behind the unsubscribe link in our emails — and it stops both of the emails that are still to come, the notice-change one included. The confirmation has normally gone already by the time you could ask. If it has not — say a first attempt failed and is waiting to be tried again — the same button stops that too: once your request is recorded, and for as long as it stands, we do not start sending it. The one exception is a confirmation we were already in the middle of sending at that moment, which may still arrive. Your row would still be counted in the total, and we are not going to pretend otherwise: there is no way to keep a record and leave it out of a count without building one, and we have not. If being counted is the part you object to, erasure removes the record entirely and that is a button we do have. If you want something between the two, say so and we will tell you plainly whether we can do it and by when, rather than agreeing and quietly not.

Age

The Fifth Wind is for adults. Please do not join the waiting list, or make an account, if you are under 18. If we learn that we hold details for someone under 18, we will delete them.

Changes

If we change this notice we will change the date at the top of it. If the change matters — if we ever wanted to use your details for something new — we would email you about it first, rather than quietly updating the page. That email is named on the signup form and in Why we use it above, so it is part of what you agreed to rather than a second use of your address we never mentioned.

If you have asked to come off the list, we will not send it: coming off means coming off. In that case the change is on this page and nowhere else, which is the trade you chose.