Well365

Privacy Policy

Last updated 25 September 2026

This covers this website and the waiting list on it. It is short because the site does very little: it asks for an email address and it writes to that address.

This policy is published in English. The English text is the version that governs. A translation is being prepared — until it is here, write to hello@well365.io in any of our three languages and we will answer in it.

The short version

  • The only thing we ask for is an email address and the only thing we do with it is write to you about Well365.
  • This site loads Google Tag Manager. It measures how the page is used, and the tags inside it may include advertising and remarketing tags, which can mean seeing our ads elsewhere later.
  • We keep the address you signed up from and the country and city it points to. Nothing else about your visit is recorded.
  • There is one cookie and it exists to make the form work.
  • Write to hello@well365.io and we delete your entry. We will not ask why.

What this covers

This policy covers this website and the waiting list on it and nothing else.

Well365, the app, has not been released. When it is, it will arrive with its own policy describing what happens to the data on your phone — that is a different question with a different answer and answering it here in advance would be a promise about software you cannot yet read.

Well365 is responsible for the data described below. You can reach us at hello@well365.io.

What we collect when you join the list

The whole record, field by field:

Your email address
What you typed. It is the only means we have of telling you the app is open.
The language you were reading
en, ka or ru — so that we write to you in it.
Which form you used
The page carries three sign-up capsules. We record which one you used, so we can tell which part of the page does the persuading.
Three timestamps
When you signed up, when you confirmed and when the record last changed.
A confirmation token
A random string that makes the link in the confirmation email work. It expires 72 hours after it is issued and is erased the moment you use it.
The IP address you signed up from
The address your connection came from at that moment, stored once and never updated. It is what lets us tell a burst of forged sign-ups from a good day and it is the only way to undo one if it happens.
A country and a city
Looked up from that address, on our own server, against a database file we hold. Your address is not sent to a geolocation service — nobody outside is asked where you are. The answer is approximate by nature: it is where your provider routes, which can be a different city and occasionally a different country.

There is no name field, no phone number, no company, no postal address and no profile. If you did not type it into that one box, we do not have it.

What we do not collect

Your email address is never joined to your browsing. The waiting list and the measurement described under Analytics and advertising are separate: the tags run on the public page and are never given the address you signed up with, so nothing we send to Google can be tied back to you by us. We do not sell or trade personal data.

No record of your visit. Reading this site is not logged, counted or attributed. Your address is recorded at one moment and one only — when you submit the sign-up form — and it is stored on that sign-up rather than against your browsing. If you never join the list, we have nothing about you at all. The same address is also counted against a rate limit of five submissions per fifteen minutes, so that nobody can point a script at the form and use us to send mail to strangers; that counter holds no email address and expires with the window.

Nothing from the decoy fields. The form carries three inputs a person never sees and an automated submitter fills in. A filled one rejects the submission. What was typed into them is never stored.

Analytics and advertising

This site loads Google Tag Manager. A tag manager is a container: what runs inside it is configured separately from this site, and it can be changed without the page changing.

Today it carries our measurement of how the page is used — how many people arrived, which sections they read and which of the three sign-up capsules they used. It may also carry advertising and remarketing tags, the kind that let us reach people who have visited this page with advertising on other sites later. Treat that as the honest ceiling of what the container may do rather than a description of a fixed list, because the list can change.

What reaches Google is your IP address, your browser and the page you opened, and — where an advertising tag is active — an identifier that allows a later advertisement to be matched to this visit. What does not reach it is your email address: these tags run on the public page and are never given it, so we do not join a visit to a person on the waiting list.

Google acts for us in this and processes the data in the United States.

If you would rather not take part: any browser-level tracking protection or ad blocker stops the container loading, and the site behaves identically without it. Nothing on this page depends on it.

Cookies

One cookie, PHPSESSID. It holds no personal data of any kind: it is a random identifier for a session kept on our server and that session holds two things — the token that stops another site submitting the form on your behalf and a one-time marker so the thank-you page appears once after you submit rather than on every refresh.

It is HttpOnly, so no script can read it and SameSite=Lax, so it is not sent when another site links to us. It expires when you close your browser.

The tags loaded through Google Tag Manager set cookies of their own. The measurement ones carry a random identifier so two page views from the same browser are counted once rather than twice. Where an advertising tag is active, its cookies are the kind that let an advertisement shown to you elsewhere later be connected to this visit. None of them holds your name, your email address or anything you typed.

If you would rather not be counted, browser-level tracking protection or an ad blocker stops the tag loading entirely, and the site works exactly the same without it.

The only third parties that see you

Three parties see something when this page loads, and this is all of them.

Google Tag Manager (www.googletagmanager.com, Google, in the United States) loads the tags described under Analytics and advertising. It sees your IP address, your browser and which page you opened, and the tags it loads may be advertising tags as well as measurement ones.

Two typefaces are loaded from servers we do not run, which means those servers also see your IP address and your browser’s request:

  • Switzer, from api.fontshare.com (Indian Type Foundry).
  • Instrument Serif, from fonts.googleapis.com and fonts.gstatic.com (Google, in the United States).

That is the complete list. Every image, video and icon on this site is served from this site — the icons are drawn into the page itself rather than fetched.

Email

Confirmation and announcement email is delivered by Namecheap Private Email (mail.privateemail.com), acting for us. They see your address, because delivering a message to it is what that requires.

We do not use a marketing platform. Our email carries no tracking pixel and no rewritten links, which means we cannot tell whether you opened it, when or on what. We would rather not know.

Why we are allowed to hold it

Consent. You typed your address into a box and pressed a button and then you clicked a link in an email to prove the address was yours — which exists so that somebody else cannot put you on this list.

You can withdraw that consent at any moment. Doing so does not make anything that happened before it unlawful and it does not require a reason.

How long we keep it

Until you ask us to delete it or until the waiting list has done its job and we close it — whichever comes first.

Two specifics worth stating plainly:

  • The confirmation token expires 72 hours after it is issued and leaves the record the moment you use it.
  • If you never confirm, the entry stays unconfirmed and we never write to you again. We do not delete unconfirmed entries automatically. Tell us and we will.

Your rights and how to use them

Write to hello@well365.io from the address you signed up with. You can ask us to:

  • show you what we hold. It will be the record described above and nothing else.
  • correct it, if you mistyped it.
  • delete it. We do this on request and we do not ask why.
  • send it to you in a form you can take elsewhere.
  • stop. Withdraw your consent and we stop writing.

We answer within thirty days and usually the same week. We will not put you through an identity check to delete a handful of fields: a reply from the address in question is proof enough.

If you are in the EU, the EEA or the UK, you may also complain to your national data protection authority. We would rather you told us first — but that is a preference of ours, not a condition on a right of yours.

How it is kept

The record lives in our own database, which is not reachable from the internet. It is not sold, rented or shared with anyone but the mail provider named above, who needs the address in order to deliver the message.

Traffic to this site is encrypted in transit. The confirmation token is compared in constant time, so a wrong guess reveals nothing about how nearly right it was and it is erased on use rather than left lying in the row.

Children

The waiting list is not meant for anyone under sixteen and an email address does not tell us anybody’s age. If you are a parent and you find a message of ours in your child’s inbox, write to us and the address goes.

If this changes

The date at the top is the date it last changed.

If a change matters to anyone already on the list — if we begin collecting something new or hand the data to someone not named here — we will say so by email before it takes effect, rather than after.

Contact

Questions, corrections, deletions or an argument with anything above: hello@well365.io.