Privacy Policy

1Who we are and who controls your data

Normal is a self-help app in development, operated by [operator legal name], [place of incorporation]. [operator legal name] is the data controller for personal information used to run this waitlist and quiz, send your confirmation and launch emails, and manage the founding offer.

Controller

Normal is the trading name of [operator legal name]

Registered office

[registered office]

Privacy enquiries and rights requests

[privacy email]

Data Protection Officer

[DPO name and email]

2Scope of this Policy

This Policy applies when you visit the Normal waitlist page, answer the quiz, join the waitlist, open our emails or contact us. It should be read with the Terms and Conditions and Cookie Policy.

It does not cover the Normal app itself. The app will have its own privacy policy, published before it launches.

3Our role and the role of our suppliers

We decide why and how your information is used, so we are the controller. Suppliers who process information only on our documented instructions act as our processors and are bound by contractual confidentiality and data protection requirements. If you accept the advertising cookie, Meta Platforms collects data through the Meta Pixel as an independent controller, under its own privacy notice.

4Information we collect

The information collected depends on what you choose to answer. It may include:

• your quiz answers: what you want back most, your age band, what you have tried and whether it worked, when urges usually hit, what would help you most, and which plan you would pick. Your country is set from your device's time zone, so prices show in the right currency;
• your first name, if you give it, and your email address;
• waitlist records: your place in line, a referral code, the code you arrived with (if any), and the wording of the consent you saw;
• where you came from: ad campaign tags in the link (for example utm_source=facebook), which version of the page you saw, and your browser language. We deliberately don't store Meta's click ID;
• communications: anything you send us by email, and records of how a request was handled; and
• technical data: short-lived server logs kept by our host, which include IP addresses, and the cookie choice described in the Cookie Policy.

If you choose to answer the optional quiz after joining, your answers are linked to your email and waitlist record in our database, timestamped only to the hour and never stored with your IP address. Please don't send us anyone else's information.

5Where information comes from

We collect information directly from you, and automatically from your browser or device as described above. If you arrived through a friend's link, we record their referral code, not anything about them.

6Why we use information and our legal bases

Where the UK GDPR or EU GDPR applies, we identify an Article 6 basis and, for special-category data, an Article 9 condition. [where the operator's local data protection law applies, add its lawful conditions here] Our principal purposes and bases are:

You may withdraw consent at any time. We may then be unable to keep your place or send you the launch email.

7Information we need and what happens if you do not provide it

An email address is required to join, and your age is required so we can enforce the 18+ restriction. Everything else is optional: you can leave the page at any point, and your first name is optional. If required information is not provided, you can't join the waitlist.

8How we use sensitive information

Some answers, like wanting your faith, your relationship or your sex life back, can reveal information about religious beliefs or sex life, which UK and EU law treat as special-category data. We collect these answers only with your explicit consent, given when you choose to answer, and store them with your waitlist record. We use them to prepare your plan and, in aggregate, to decide what to build.

We do not use sensitive information for behavioural advertising. We do not make automated decisions about you.

9Who receives information

We may disclose information, on a need-to-know basis, to:

• Cloudflare, which runs and delivers the site, handles each visit in the data centre nearest to you, keeps short-lived logs for security, and, only if our database is briefly unavailable, holds a sign-up for up to 30 days until it is saved;
• Supabase, which stores the waitlist database (sign-ups and quiz answers), with servers in London, UK;
• Resend, which sends your confirmation and launch emails;
• Meta Platforms, only if you accept the advertising cookie. It receives page-visit, quiz-start and sign-up events, never your answers or your email;
• professional advisers acting under appropriate duties of confidentiality;
• regulators, courts, law enforcement or other persons where disclosure is required by law or needed to establish or defend legal claims; and
• a genuine buyer, investor or successor in connection with a reorganisation or transfer of Normal, subject to confidentiality.

We do not sell personal information, and we never share your answers or email for anyone else's advertising.

10International data transfers

[operator legal name] is based in [operator country]. Information may be accessed, stored or transferred in [operator country], the United Kingdom, the United States or another country in which a supplier operates. Where UK/EU restricted-transfer rules apply, we use an available lawful mechanism, such as an adequacy decision or regulation, or contractual clauses such as the UK International Data Transfer Agreement or UK Addendum and EU Standard Contractual Clauses. You may contact the DPO for more information about the safeguard used.

11Security and confidentiality

We use risk-based technical and organisational measures, including encrypted transmission, access-controlled servers and keeping your quiz answers and email apart by design. No internet or storage system is completely secure, so we cannot promise absolute security. If a personal data breach occurs, we will investigate and make the notifications required by applicable law, including to you where required.

12How long we keep information

We keep information only for as long as reasonably necessary for the purpose collected. Our standard starting points are:

You can ask us to delete your email at any time, and we will do it within 30 days.

13Your data protection rights

Depending on the law that applies to you, your rights may include:

• being informed about how your information is used;
• accessing personal information and receiving a copy;
• asking for inaccurate or incomplete information to be corrected;
• asking us to erase or restrict information where the legal conditions are met;
• objecting to processing based on legitimate interests;
• withdrawing consent without affecting processing already carried out lawfully;
• data portability where the relevant UK/EU conditions apply; and
• complaining to a regulator.

To exercise a right, email [privacy email] from the address you signed up with, or reply “delete” to any of our emails. UK/EU laws generally require a response within one month. Some rights are not absolute; for example, we may keep a minimal record needed to show that a request was honoured.

14Withdrawing consent

You can withdraw consent by contacting us or by unsubscribing. We will stop sending you waitlist emails and delete your email. Withdrawal does not affect processing already carried out lawfully. Your quiz answers are deleted along with your email.

15Marketing

We only email you about your place, the launch and anything that changes before then that you would want to know. Every email has an unsubscribe link, plain subject lines and comes from “Normal”. Nothing we send says what it is for. We will not use your quiz answers for targeted advertising.

16Cookies and similar technologies

This page uses two strictly necessary storage items, and the Meta Pixel only if you press Accept. Details, durations and controls are in the Cookie Policy.

17If you are in the US

We don't sell or share your personal information as those terms are used in the California Consumer Privacy Act (as amended by the CPRA), and we don't use it for cross-context behavioural advertising unless you accept the advertising cookie. California residents can request access, deletion or correction by emailing [privacy email]. We won't treat you differently for using these rights.

18Adults only

Normal is for adults aged 18 or over and is not directed to children. We ask your age to enforce this. If you tell us you are under 18, we don't keep your answers or your email, and the advertising cookie is never offered. If you believe a child has submitted information, contact us so we can delete it.

19Automated decision-making

We do not make decisions producing legal or similarly significant effects about you solely by automated means.

20The app, once it opens

The app is being designed so your check-ins stay on your phone. We will publish the app's own privacy policy before it launches, and nothing here changes until then.

21Complaints

Please contact the DPO first if you have a concern, so we can try to resolve it. You may also complain to:

• [operator country regulator, if any];
• the UK Information Commissioner's Office if the UK GDPR applies: ico.org.uk; or
• the supervisory authority in the EEA country where you live or work, if the EU GDPR applies.

You are not required to complain to us before contacting a regulator.

22Changes to this Policy

We may update this Policy when the waitlist, our suppliers or the law change. The latest version will be posted with a revised effective date. If a change matters, we will email you first and obtain fresh consent where a new use requires it.

23Version history

24Contact us

Operator

Normal is the trading name of [operator legal name], [place of incorporation]

Registered office

[registered office]

Privacy enquiries and rights requests

[privacy email]

Data Protection Officer

[DPO name and email]