Stature / Privacy
Privacy Notice
Last updated: September 16, 2026
This notice covers the early access waitlist at stature.finance.
What we collect
When you join, we store your email address, the time you signed up, and the version of the signup consent notice. We remove surrounding spaces and lowercase your email to prevent duplicate entries. We do not ask for a password, wallet, identity documents, or financial information.
Connecting X is optional. If you connect, we store your X account ID, display name, handle, profile photo URL, connection time, and a generated early access card alongside your signup email and permanent waitlist position. We retrieve your profile through X’s authorization service; we do not retain X access tokens or request permission to post for you. Your email address never appears on your card. Downloading or sharing the card makes its profile information and position visible to recipients. Choosing Share on X creates a public, unlisted link to a snapshot of your card. Anyone with that link, including X’s preview crawler, can see the card’s name, handle, photo, and position at sharing time. The link does not expose your email or grant access to your signup. Deleting the signup removes its hosted share pages and images; copies already saved or cached by others may remain.
How we use it
We use your email to send Stature launch updates and early access news, with your consent when you join. Signing up does not send an email immediately.
Storage and service providers
Waitlist information is stored in a private SQLite database on our DigitalOcean server. Daily database backups are kept on the same server for up to seven days. Our hosting provider processes website requests and may keep operational logs, including IP addresses. The waitlist is not publicly readable. We use self-hosted Umami analytics on the same server to understand visits, traffic sources, device types, and approximate countries and regions. We also count page interactions to improve the page: which sections are scrolled into view, clicks on page links and buttons, opened questions, selected product previews, signup starts, accepted signups, forms left incomplete, error categories, and the steps and error categories of connecting X and sharing a card. When a public card link is opened, we count the visit and whether it came from X or from X’s link preview service, using the request’s user agent and referrer. These events contain only fixed labels, never form contents or email addresses. It does not use analytics cookies. Email addresses are not sent to analytics. Our tracking configuration excludes page query strings and URL fragments and respects the browser’s Do Not Track setting. We do not enable session recording or advertising trackers, and use a secure, HTTP-only cookie for up to 30 days to remember your signup and protect X linking and card downloads. The cookie contains a random secret, not your email. Temporary authorization records expire after ten minutes and are cleared on use or a later connection attempt.
Preventing abuse
We use a hidden spam-check field and limit signup attempts. Where the hosting setup provides a trusted IP address, the server converts it into a keyed hash for rate limiting. We store that hash, a short time window, and an attempt count separately from your email. Raw IP addresses are not stored in our waitlist database. Rate-limit windows older than 24 hours are removed on the next accepted submission; they can remain longer when no one is signing up.
Your choices and retention
We keep waitlist details while they are needed for launch communications. You can withdraw consent using the unsubscribe option included in any future launch email or by replying to that email. You can also use that reply channel to request access, correction, or deletion. Sending launch emails requires a monitored reply address and an unsubscribe process; neither email delivery nor an automatic unsubscribe service is enabled on this landing page yet.
A public privacy contact has not yet been set up. We will update this notice when that contact is available or data handling changes. It will also be updated before any investing account features are introduced.