Privacy Policy
Privacy policy
This Privacy Policy describes how Impelechy LLC ("Impelechy," "we," "us," or "our") collects, uses, and protects your personal information when you visit https://scriptorio.app (the "Site"). We are committed to protecting your privacy and processing your data lawfully, fairly, and transparently.
This policy covers the website only. The Scriptorio iOS application is covered by a separate document, the App Privacy Policy, which describes the data processed inside the App and in your account.
The Site is a brochure site. It has no signup form, no account registration, and no newsletter. The only place where you can submit personal data to us is the password-reset page, described in Section 2A.
Note on the former waitlist. Before launch, this Site operated an email waitlist. That form has been removed and we no longer collect waitlist signups. The records collected while it was running are retained for one remaining purpose only — to send the launch notification that subscribers asked for — and are then deleted. See Sections 2D and 6.
To exercise any of your privacy rights, email us at [email protected]. We will respond within 30 days — typically much sooner.
01 — Who We Are
Impelechy LLC is a limited liability company registered in the State of Wyoming, United States. For the purposes of EU and UK data protection law, Impelechy LLC acts as the data controller in respect of the personal data collected through this Site.
Impelechy LLC30 N Gould St Ste N
Sheridan, WY 82801 US
Email: [email protected]
02 — What We Collect & Why
The Site collects the absolute minimum data necessary to serve pages, keep the service secure, and let you recover an account password. The subsections below distinguish data you actively submit from data that arises only in transient infrastructure logs or aggregate analytics.
A — Account recovery (password reset)
The pages Forgot password and Reset password exist so you can regain access to an existing Scriptorio account. When you enter your email address there, it is transmitted to Supabase, the authentication provider for the App, which sends you a time-limited reset link. This is the same account system described in the App Privacy Policy.
We do not store this email address on the website side. There is no website database. The address is processed by Supabase against your existing account record; if no account matches, no account is created and nothing is retained.
B — Transient infrastructure logs (not actively retained by us)
The raw IP address of your request may appear briefly in Cloudflare's edge logs for security and abuse purposes. We do not access, retain, or process these logs ourselves; Cloudflare's own retention applies (see Section 6 and Cloudflare's privacy policy).
C — Aggregate site analytics
Cloudflare Web Analytics is active on the Site. This is a cookieless, privacy-first tool that collects only aggregate data: page URL, referrer, browser type, device type, operating system, approximate country/region (derived from IP, not stored), and Core Web Vitals performance metrics. No data is written to your device; no individual profile is created; analytics data is never linked to your identity. Full detail in Section 11.
D — Legacy waitlist records (collection ended)
Until launch, this Site operated an email waitlist whose records were written to a Cloudflare D1 database: email address, signup timestamp, a hashed IP address (HMAC-SHA-256 with a server-side secret key, raw IP discarded at the moment of submission), a truncated user-agent string, and an internal source identifier.
The form has been removed and no new records are created. The existing records are retained for a single remaining purpose — sending the launch notification that each subscriber consented to receive — and are deleted afterwards under the schedule in Section 6. You may request deletion before that point at any time, and every notification we send includes an unsubscribe path.
We do not engage in profiling, automated decision-making, behavioral advertising, or cross-context tracking.
03 — Legal Basis for Processing
For the password-reset flow (Section 2A), processing your email address is necessary for the performance of the contract between us and the account holder, and to take steps at your request before entering into it (Article 6(1)(b) GDPR). Without it we cannot verify which account to send a reset link for.
For the legacy waitlist records (Section 2D), processing continues to rest on the freely given, specific, informed, and unambiguous consent (Article 6(1)(a) GDPR) obtained when you joined, which covered notification at launch. That consent is now being exhausted: once the launch notification is sent, the purpose is fulfilled and the data is deleted. You may withdraw your consent at any time (see Section 8), in which case we delete the record immediately and you receive no further messages.
For the aggregate site analytics described in Section 11, processing is based on our legitimate interest (Article 6(1)(f) GDPR) in understanding overall Site usage. The tool, Cloudflare Web Analytics, is cookieless and stores no data on your device — accordingly, no cookie consent banner is shown for this functionality.
The same lawful basis applies under the UK GDPR, which mirrors the EU framework post-Brexit. Processing is based on your explicit consent as described above.
We process your email address solely for the stated purposes — account recovery, and the pending launch notification for former waitlist subscribers. We do not sell, share for cross-context behavioral advertising, or otherwise monetize your personal information. You may request deletion at any time (see Section 10).
04 — How We Store & Protect Your Data
The Site itself is a set of static files served via Cloudflare Pages. It holds no database and exposes no endpoint that accepts or returns personal data.
Email addresses entered on the password-reset pages are transmitted directly to Supabase over an encrypted connection and are handled under the security measures described in the App Privacy Policy. Nothing is written on the website side.
The legacy waitlist records described in Section 2D remain in Cloudflare D1 until deleted under Section 6. The database has no public network interface — it is reachable only through an internal Cloudflare binding, and the public signup endpoint that formerly wrote to it has been withdrawn. There is no anonymous API exposed to the internet that returns or queries these records.
We implement the following technical and organizational security measures:
- Encrypted transport for every request (TLS 1.3 / HTTPS only)
- A strict Content-Security-Policy restricting which origins the Site may contact
- Subresource-integrity hashes on all scripts served by the Site
- HMAC-SHA-256 hashing of IP addresses in the retained legacy records, using a secret key held in our infrastructure secret store and never written alongside the data, so the database in isolation does not permit recovery of original IP addresses (no raw IPs persisted)
- Access to the remaining database restricted to the account owner via Cloudflare's authenticated dashboard and CLI
- Removal of unused public Worker hostnames to reduce attack surface
No method of electronic transmission or storage is 100% secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security.
05 — International Data Transfers
Impelechy LLC is based in the United States, which is a third country under GDPR. Your data may be transferred to and processed in the United States. Where such transfers occur, we ensure appropriate safeguards are in place, including reliance on:
- Standard Contractual Clauses (SCCs) as approved by the European Commission (for EU residents), and
- UK International Data Transfer Agreements (IDTAs) or UK-approved SCCs (for UK residents),
as applicable to the data processors we engage (see Section 7). You may request a copy of the relevant safeguards by contacting us.
06 — Data Retention
Password-reset requests. No retention on the website side. The reset link itself is short-lived and expires automatically; account data retention is governed by the App Privacy Policy.
Legacy waitlist records. We retain these for whichever of the following comes first:
- Until you withdraw your consent or request deletion (see Sections 8–10), which we action immediately;
- Until 30 days after the launch notification has been sent, at which point the entire waitlist is deleted; or
- Until 6 months from the effective date of this policy, after which the records are deleted whether or not a notification was sent.
Deletion under this section covers the entire signup record — email address, signup timestamp, hashed IP, user-agent string, and source identifier are removed together. We do not retain personal data beyond the purpose for which it was collected.
IP addresses may appear in transient infrastructure logs maintained by Cloudflare and/or hosting providers for security purposes. We do not control the retention period of these logs directly; Cloudflare's retention practices are governed by their Privacy Policy at cloudflare.com/privacypolicy.
07 — Sharing Your Data & Data Processors
We do not sell your personal information. We do not share your data with third parties for marketing or advertising purposes.
We engage the following third-party service providers ("data processors") who process personal data strictly on our instructions and under a written Data Processing Agreement (DPA) compliant with GDPR Article 28 and UK GDPR Article 28:
| Processor | Role | Data processed | Location | Transfer safeguard |
|---|---|---|---|---|
| Cloudflare, Inc. — 101 Townsend St, San Francisco, CA 94107, USA | Site hosting (Cloudflare Pages), CDN and DDoS protection, cookieless aggregate analytics (Cloudflare Web Analytics), and storage of the legacy waitlist records pending deletion (Cloudflare D1). | Raw IP (transient edge logs, not actively retained by us); aggregate page-view, referrer, country, browser, device and performance metrics (analytics); and, until deleted under Section 6, the legacy waitlist record (email address, signup timestamp, hashed IP, user-agent, source identifier). We do not collect sensitive personal data. | USA-headquartered, with global infrastructure across the United States, European Union, United Kingdom, and Asia-Pacific. | Cloudflare Customer DPA + Standard Contractual Clauses (SCCs) |
| Supabase, Inc. — 970 Toa Payoh North, Singapore | Authentication provider for Scriptorio accounts. Receives the email address submitted on the password-reset pages in order to issue a reset link. | Email address submitted for account recovery. No website-side storage. | Project database hosted in the United States. | Supabase DPA + Standard Contractual Clauses (SCCs) |
Cloudflare and Supabase are the only third-party processors engaged for the Site. We do not presently use a separate transactional email provider for website purposes; the pending launch notification described in Section 2D is sent by the controller. If we engage a dedicated email-sending service for website purposes, this section will be updated before any personal data is transferred to it.
All processors are contractually prohibited from using your personal data for their own purposes or for advertising. We review processor security practices before engagement and update this list whenever processors change.
Note on GDPR Article 28
Under GDPR Art. 28 (and its UK equivalent), every controller must have a written DPA with each processor handling EU/UK personal data. The DPA is a B2B contract — it is not a customer-facing document. This section serves as disclosure that such agreements are in place. You may request confirmation that a specific DPA exists by contacting us.
Other disclosure circumstances
- Legal obligations: We may disclose your information if required by law, regulation, court order, or governmental authority.
- Business transfers: In the event of a merger, acquisition, or sale of all or part of our assets, your data may be transferred as part of that transaction. We will notify you via email and/or prominent notice on our Site of any such change in ownership or use of your data, and you will have the opportunity to request deletion before the transfer takes effect.
08 — Your Rights — EU / EEA (GDPR)
If you are located in the EU or EEA, you have the following rights under the General Data Protection Regulation (GDPR):
- Right of Access (Art. 15): You may request a copy of the personal data we hold about you.
- Right to Rectification (Art. 16): You may request that we correct inaccurate or incomplete data.
- Right to Erasure / "Right to be Forgotten" (Art. 17): You may request that we delete your personal data. We will comply unless we have a legal obligation to retain it.
- Right to Restriction of Processing (Art. 18): You may request that we restrict processing of your data in certain circumstances.
- Right to Data Portability (Art. 20): You may request that we provide your data in a structured, commonly used, machine-readable format.
- Right to Object (Art. 21): You may object to processing based on legitimate interests. As our processing is based solely on consent, this right is most relevant via withdrawal of consent.
- Right to Withdraw Consent (Art. 7(3)): You may withdraw your consent at any time by emailing us at [email protected] or by clicking "Unsubscribe" in any communication we send you. Unsubscribe requests are processed within 7 days. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
- Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority. A list of EU data protection authorities is available at edpb.europa.eu.
To exercise any of the above rights, contact us at [email protected]. We will respond within 30 days of receiving your request. We do not charge a fee for exercising these rights.
09 — Your Rights — United Kingdom (UK GDPR)
UK residents have equivalent rights under the UK GDPR and the Data Protection Act 2018, mirroring those described in Section 8 above. You may also lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
10 — Your Rights — United States
If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) grants you the following rights:
- Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, the purposes for collection, and any third parties with whom we have shared it.
- Right to Delete: You may request deletion of your personal information, subject to certain legal exceptions.
- Right to Correct: You may request correction of inaccurate personal information.
- Right to Opt-Out of Sale or Sharing: We do not sell or share your personal information for cross-context behavioral advertising. No opt-out is required, but you may contact us to confirm this at any time.
- Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.
We do not collect sensitive personal information as defined by the CPRA.
How to Submit a Request: Submit a request by emailing [email protected]. We will respond within 45 days (extendable by an additional 45 days when reasonably necessary). We may need to verify your identity before processing your request.
Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), and other states with comprehensive privacy laws may have similar rights. We extend equivalent rights — access, correction, deletion, and opt-out of sale — to all US residents regardless of state, and will respond to requests within applicable statutory timeframes. Contact us at [email protected] to exercise these rights.
11 — Analytics & Usage Data
We use Cloudflare Web Analytics, a privacy-first analytics service provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), to understand how visitors interact with the Site.
Cookieless — No Consent Banner Required
Cloudflare Web Analytics operates entirely without cookies, without local storage, and without device fingerprinting. It does not store any data on your device. Because no information is written to or read from your device, the EU ePrivacy Directive and UK PECR do not require a cookie consent banner for this tool. No cookie banner is shown.
Data collected by Cloudflare Web Analytics
Cloudflare's beacon script transmits the following data points to Cloudflare servers on each page load:
- Page URL visited
- Referrer (the site or source that linked to us)
- Approximate geographic location (country and region level only — derived from IP, which is not stored)
- Browser type and version
- Operating system
- Device type (mobile, desktop, tablet)
- Core Web Vitals performance metrics (LCP, INP, CLS)
All data is aggregated. Cloudflare does not create individual visitor profiles. IP addresses are used only to derive location and are not stored in analytics records.
What we do with this data
- Understand overall visitor volume and geographic distribution
- Identify which referrer channels drive traffic to the Site
- Optimize the page for the devices and browsers our visitors use
- Monitor page performance (Core Web Vitals)
What we do not do
- Link analytics data to your email address or any personal identifier
- Track individual user sessions or journeys
- Share analytics data with advertising networks
- Build individual behavioral profiles
Cloudflare's privacy policy is available at cloudflare.com/privacypolicy.
Processing of analytics data is based on our legitimate interest (Art. 6(1)(f) GDPR / UK GDPR) in understanding aggregate Site usage. Because no data is stored on your device and no personal data is retained in analytics records, this legitimate interest is not overridden by your privacy rights. No cookie consent is required. Data is transferred to Cloudflare servers in the United States under Cloudflare's Standard Contractual Clauses.
Analytics data is collected under our legitimate interest in understanding Site usage. No sale of data occurs. No personal information is retained in analytics records. California residents may contact us for further information.
11b — Cookies & Tracking Technologies
| Cookie / technology | Set by | Purpose | Consent required (EU/UK)? |
|---|---|---|---|
| __cf_bm | Cloudflare (infrastructure) | Bot management and abuse prevention. Required for Cloudflare's network security layer. Expires after 30 minutes of inactivity. | No — strictly necessary |
| cf_clearance | Cloudflare (infrastructure) | Stores proof that a visitor has passed a security challenge (e.g., DDoS protection). Only set when a challenge is triggered. | No — strictly necessary |
| Analytics beacon (no cookie) | Cloudflare Web Analytics | Cookieless JavaScript beacon collecting aggregate page-view and performance data. No data written to your device. | No — cookieless, ePrivacy Directive does not apply |
| Marketing / advertising cookies | — | Not used | N/A |
| Third-party tracking | — | Not used | N/A |
You can control cookies through your browser settings. Disabling strictly necessary cookies may affect Site functionality. Disabling analytics cookies will not affect your ability to use the Site or to reset your password.
The above reflects the current state of this Site. This policy will be updated before any additional third-party scripts, embeds, pixels, or tracking tools are introduced. If you notice a discrepancy, please contact us at [email protected].
For more information about managing cookies, visit allaboutcookies.org.
12 — Children's Privacy
Our Site and the Scriptorio App are not directed to children. We do not knowingly collect personal data from individuals below the digital-consent age applicable in their jurisdiction — typically 13 to 16 in the EU and EEA (varies by member state under GDPR Article 8), 13 in the United Kingdom, and 13 in the United States (COPPA). If you believe we have inadvertently collected data from a child, please contact us immediately at [email protected] and we will delete it promptly.
13 — Changes to This Policy
We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page, and, where we still hold an email address for you, notify you by email. We encourage you to review this policy periodically.
Where required by applicable law, we will seek renewed consent before applying material changes affecting how your personal data is processed.
14 — Contact Us
For any questions, concerns, or requests related to this Privacy Policy or your personal data, please contact us:
Impelechy LLC30 N Gould St Ste N
Sheridan, WY 82801 US
Email: [email protected]
We aim to respond to all privacy-related inquiries within 45 days (US) or 30 days (EU/UK).