Privacy policy
Last updated: 5 October 2026
Who we are
1RESET is a trade name of (legal entity to follow), located at (address to follow), registered with the Dutch Chamber of Commerce under number (registration number to follow). We are the controller for the processing described here. Questions or requests: hallo@try1reset.com.
What data, why and for how long
| When | What data | Why and on what basis | How long |
|---|---|---|---|
| Waitlist and ads | Your email address; the language of the page; the code of the ad and campaign you came from (utm_source, utm_campaign, utm_content) and the step that goes with it; the website you came from, domain name only (for example "l.facebook.com"); the time and the exact wording of your consent. Optional, if you fill it in later: your first name, your country as a country code and your choice from a fixed list of "what you'd like to change" (no free text, no health data). | Putting you on the waitlist, having you confirm your address and emailing you once when you can install the app. Counting sign-ups per ad so we know which ad works; that counting uses the code only, not you. Basis: your consent (art. 6(1)(a) GDPR), given with the checkbox on the form. | 24 months after your last contact with us (signing up, confirming or an email from us). If you don't confirm your address we delete your data after 30 days. If you unsubscribe we delete it immediately. The counts per ad are kept without personal data. |
| Confirming and unsubscribing | A random token in the confirmation and unsubscribe links; the time of confirmation. | Proving the address is yours (double opt-in) and allowing you to unsubscribe without logging in. Basis: consent and our legitimate interest in emailing real addresses only. | As long as your sign-up. |
| Protecting the form | A keyed hash of your IP address (HMAC with a secret that changes daily). We do not store the IP address itself. | Preventing abuse: at most twenty sign-ups per address per hour, and a brake on wrong admin keys. Basis: legitimate interest (art. 6(1)(f) GDPR). | One hour. |
| Ad measurement, only with consent | If you accept cookies on the waitlist page or tick "share my sign-up with Meta": a hash of your email address (SHA-256, not reversible), your IP address and browser at the moment of signing up and, if present, the Meta cookies _fbp and _fbc or the click code fbclid. Meta never receives your address itself. | Telling Meta that a sign-up followed an ad (the "Lead" event), so Meta can target the ads better and we can measure per ad. Basis: consent. Without consent this does not happen and the waitlist works exactly the same. | We only keep whether you consented and whether the event was sent. Meta keeps data under its own privacy policy. |
| Your own counts in the browser | Which steps you take on the website and where you came from, stored in your own browser (localStorage), 7 days for the origin. | So the page remembers which ad you belong to and a later sign-up still counts for that ad. This only leaves your browser when you sign up, as the code attached to your row. | Until you clear your browser storage; origin expires after 7 days. |
| The sleep quiz and sleep plan | Your answers to the sleep quiz and the short questions in the sleep plan. | They stay in your own browser. We do not receive them; there is currently no link to an email service or phone number. | Until you clear your browser storage. |
| Ordering and paying | Not applicable yet: ordering and paying are not open. Once they are, we update this policy first. |
Who we share data with
We never sell your data. We use these providers, with whom we have a data processing agreement or whose standard data processing terms we accept:
- Vercel Inc. (United States): hosting of the website and the server function that handles your sign-up. Transfer based on the EU standard contractual clauses and the EU-US Data Privacy Framework.
- Upstash Inc.: the database holding your sign-up, in a data centre in the European Union.
- Our email service (Resend or Postmark): sends the confirmation email and the email when the app is ready. Receives your email address for that.
- Meta Platforms Ireland Ltd.: only if you consent to measurement (see above). Independently responsible for what Meta does afterwards.
- Google LLC (Google Fonts): the typefaces on these pages are loaded from Google; Google sees your browser's IP address when that happens.
Cookies and measurement
We set no cookies of our own. On the waitlist pages we ask once whether the Meta pixel may load. If you say "no thanks", nothing from Meta loads and your choice is kept in your browser so we don't ask again. If you accept, Meta's pixel loads and Meta sets cookies (_fbp, _fbc); after your sign-up we also send the hashed event from the table above. You can reverse your choice by clearing your browser storage for try1reset.com. The other pages of the site carry no pixel and no third-party analytics.
Your rights
You may access, correct or delete your data, restrict processing, object, and receive your data in a readable file. You can withdraw consent at any time: via the unsubscribe link in every email (we then delete your sign-up immediately) or by email. Write to hallo@try1reset.com; we reply within a month. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority in your own country.
Security
Connections are encrypted (https). The database is only reachable with a secret key. Our own reporting on the waitlist contains no email addresses, only counts per ad and a non-reversible hash.
Changes
If what we process changes, we update this policy and the date at the top. For a material change we email you if you are on the waitlist.