Privacy: what is stored, where and for how long

Where it is kept

Accounts, lists, the people on them and offers are kept in one Cloudflare D1 database that belongs to this site. Cloudflare chooses where the database lives; the region is not pinned, so it may be outside your country. The pages themselves are static files served by Cloudflare Pages.

What is stored for an owner

• A random account id, the account name you chose for your passkey manager, and when the account was made.
• For each passkey: its public key, its id, a signature counter, the name you gave it and when it was added and last used. Never a fingerprint, a face or any biometric data: those stay on your device.
• A scrambled form (SHA-256) of your recovery code. The code itself is shown to you once and not kept.
• For each signed in device: a scrambled form of its session id, and when it was made, last used and when it expires (90 days after the last use).
• Your email address, only if you add one, used only to tell you how a family answered an offer. Nothing but a confirmation link is sent to it until you open that link. It is the one place an email address of yours is ever stored.
• For each list: its name, the note for families, the questions on the join form, the hold length, whether the total is shown, open or closed, and its time zone.

What is stored for the people on a list

• The adult's name, and a phone number or email address. Only the pro sees these; they never appear on the position page.
• Who the place is for, as a nickname, initials or a pet name, and the answers to the pro's questions (at most 2 KB).
• Their place in the order, status (waiting, offered, placed, left or taken off), the number of missed offers, and a history of what happened and when.
• Each offer: the slot name, when it was made, when the hold ends, and the answer.
• The pro's private note and tags. These are never shown to the family.
• For the position link, the join link and the pro's calendar feed: only a scrambled form (SHA-256) of the secret. The join link and the feed also keep a sealed copy that only this server can open with its own secret key, so the pro can copy them again. A position link keeps such a sealed copy only so that a join sent twice gets the same link back; the copy is dropped when the pro replaces the link. When a link is replaced, the scrambled form of the old secret is kept so the old link can say it was replaced, and it is deleted with the list.

The join form asks who a place is for as a nickname, initials or a pet's name only, and refuses a full name there. The pro cannot add a question whose wording asks for a name, surname, date of birth, birthday, school, address, street or postcode, including spaced or disguised spellings; the server answers Waitkeep does not collect that about a child. Answers to the pro's other questions are checked only for phone numbers and email addresses, so please do not type a child's full name into them.

Limits on how fast requests come

To stop a join link being flooded, the server counts requests per network address in hourly buckets. The address is stored only as a keyed scramble that cannot be turned back into the address, and each bucket is deleted after 2 hours. Network addresses are never written to logs.

How long it is kept

• Your account, lists and the people on them: until you delete them.
• Someone who left a list or was taken off: deleted 90 days after.
• A deleted list: 7 days, while it can be restored, then deleted for good with everyone on it.
• A deleted account and everything in it: 7 days, while you can sign in and cancel, then deleted for good.
• Sessions: until 90 days after the last visit on that device, or until you sign out.
• Passkey sign in requests: 5 minutes. Email confirmation links: 24 hours. Rate limit buckets: 2 hours. Email records: 30 days.

What stays on your device

What you type into the join form, and the position link the server sends back, are kept in your browser's local storage under keys beginning with standinglist until you press I have saved it after joining, so a dropped connection can be retried. If the browser blocks or cannot read that storage, the page says so and nothing is kept. The secret part of a link sits after the # sign, which browsers do not send to any server in the address.

How to see and delete it

On your account page, Download everything gives one file with all of it. Delete my account removes everything after the 7 days above; you can also take single people off a list and delete single lists. A family can take their own name off a list at any time with Take my name off the list on their position page. Requests by email go to [email protected].

Cookies

One cookie, and only for pros who sign in: a session cookie that keeps you signed in for up to 90 days. It cannot be read by page scripts and is never sent to another site. Families get no cookie.

Page counts

Visits may be counted by Cloudflare's own page counter, which sets no cookie and records that a page was opened, never what you typed. There is no other analytics.

Payments

No paid plan is offered at present; if one is added, this page will describe it.

Email

Only pros can receive email, only at an address they added and confirmed, and only to say how an offer was answered: one short email per offer, within a small daily allowance for the whole site. Families are never emailed. Emails carry no tracking images.

Typeface

The headings use an open source typeface under the SIL Open Font License 1.1, served from this site. The licence is at /fonts/OFL.txt.

Changes and contact

If this policy changes in a way that affects what is stored, the change will appear on this page. Questions go to [email protected].