Legal
Privacy
What Waitin Zone stores, what it does not, and why.
In force since 26 August 2026
01 What we hold about you#
An account is a username, a password derivation, and an email address. Nothing else is required and nothing else is asked for — no name, no phone number, no billing address.
Your email is stored twice: once in the record so we can write to you, and once as a SHA-256 hash in the column we actually search on. The lookup index is therefore not a mailing list, and it is what enforces one account per address.
02 Credentials, and how they are kept#
- Password. PBKDF2-SHA256 with a salt unique to your account, three chained rounds of 100,000 iterations — 300,000 iterations of work. It is chained because the platform refuses more than 100,000 in a single call. The password itself is never written anywhere. Both counts are stored on the record so either can be raised later without locking anyone out.
- Two-factor secret. Held so codes can be checked. The setup QR code is drawn in your browser; it is never sent anywhere, because an
otpauth://URI contains that secret. - Backup codes. Ten, single use, stored only as hashes.
- API tokens. Stored only as a SHA-256 hash plus the last four characters, which is what the dashboard shows so you can tell two apart. The secret is displayed once, at creation, and cannot be recovered afterwards — not by you and not by us.
A dump of our database hands nobody a working credential of any kind.
03 What a click records#
When somebody follows one of your links we keep four things Cloudflare has already attached to the request: country, device class, browser family, and the referring host — not the full referring URL. The last hundred clicks per link are kept and nothing older.
No cookie is set on the person clicking. No identifier is issued, nothing follows them to the destination, and there is no way for us or for you to tell whether two clicks came from the same person. That is a deliberate limit on the product, not an oversight: it is also why we cannot offer unique-visitor counts.
05 Who else sees your data#
Every company we hand anything to, and exactly what they get:
- Cloudflare — hosts the whole service. All of it passes through them.
- Google Safe Browsing — receives each destination URL once, when the link is created and again if you repoint it, to check it against threat lists.
- Cloudflare Turnstile — checks that a form submission came from a person. Designed not to profile the visitor.
- Resend — delivers the four transactional emails in section 06.
- Vapih Pay and Dodo Payments — take payment. Card details never reach us; we receive a username, a plan name and a date.
That is the complete list. QR codes used to be a sixth entry — they were fetched as images from an outside service, which meant handing that service the link, and on the two-factor screen the secret with it. They are now drawn in your browser and nothing leaves it.
06 What we send you#
Four kinds of message, all transactional: a code to confirm your address, a link to reset your password, a notice when your password or address changes, and a notice when two-factor authentication is switched on or off.
The security notices cannot be turned off. If someone else changes your password, that email is the only warning you will get. We do not send marketing, and your address is never shared or sold.
Mail is sent from no-reply@w8.nz and replies to it are not received by anyone. Section 08 is how to reach us.
07 How long things are kept#
- Links and their click history — until you delete them, or until a paid plan has lapsed for more than fourteen days.
- Clicks — the most recent hundred per link. The hundred-and-first pushes the oldest out.
- Sessions — seven days, or until you change your password, which ends every one of them at once.
- Email codes and reset links — minutes, then they are deleted whether used or not.
- Account and API tokens — until you close the account.
08 Deleting your data#
Deleting a link removes its record and its entire click history immediately, and returns the code to the pool.
Closing your account is self-serve and immediate: Dashboard → Security → Close my account. It asks for your password, your second factor if you have one, and your username typed out, then deletes the account, every link you own, all click history and every API token. Nothing is archived and there is nothing to restore from.
If something needs a person — a question about this policy, or a link that should not exist — use the report form. It reaches us, and it needs no account.
09 Changes to this policy#
The date at the top of this page is when the current version took effect. Changes that affect what we collect or who we hand it to will be described here rather than quietly folded in, and the date will move.