Privacy
FixtureStack is an early-access waitlist, not an advertising business. This page explains what we hold, why, and how to have it deleted. It applies to fixturestack.com and nothing else.
Who’s responsible for this data
The data controller is [Your full name], based in Sofia, Bulgaria, building FixtureStack. You can reach me directly at privacy@fixturestack.com. There is no separate data protection officer — at this size, that’s me.
What we collect, and why
Filling in the early-access form is the only way to give us anything. There’s no account, no login, and nothing is collected just from visiting the page.
| What | Why | How long |
|---|---|---|
| Your email address | To tell you once when early access opens. | Until launch, or until you ask us to delete it. |
| The country you pick, and your biggest obstacle | Deciding which market and which problem we build for first. | Until launch. |
| Your favourite club and dream trip, if you write them | Both are optional. They tell us what the product has to be able to plan. | Until launch. |
| A referral code, and how you found the page | Crediting whoever referred you, and knowing which channel to invest in. | Until launch. |
| Country, from your connection | A rough, automatic check on where interest is coming from — separate from the country you actively choose above. | Until launch. |
| A one-way hash of your IP address | Abuse prevention. We never store the address itself, and the hash cannot be reversed to recover it. | 90 days. |
| Your browser's user-agent string | Distinguishing real signups from scripted ones. | 90 days. |
Our legal basis for processing it
Your email, country and obstacle are processed on the basis of consent — you give them by submitting the form, and you can withdraw that consent at any time by asking us to delete your data (see below). The IP hash and user-agent are processed on the basis of legitimate interest: keeping the form working for real people and out of a bot’s hands.
Who else sees it
Nothing is sold, and nothing is shared with advertisers. A short list of processors keeps the form running:
| Service | What it does | Region |
|---|---|---|
| Supabase (Postgres) | Stores the signup and its answers. | Confirm your project's region in the Supabase dashboard. |
| Upstash Redis | Counts signup attempts per IP to rate-limit abuse. Stores no personal data itself. | Confirm your database's region in the Upstash console. |
| Resend | Sends the one welcome email after a signup. | US-based; see Resend's own privacy policy. |
| Plausible Analytics | Counts visits. Cookieless — sets nothing on your device and does not identify you. | EU (Germany). |
| PostHog | Records signup and error events server-side. No client-side script runs, so nothing loads in your browser. | EU. |
Where a processor is based outside the EU/EEA, they operate under their own published safeguards (such as Standard Contractual Clauses or the EU–US Data Privacy Framework) rather than a bespoke agreement with us.
Cookies and tracking
This site does not use cookies. See the cookie policy for the full detail on how Plausible and PostHog are used instead, and why no consent banner is shown.
Your rights
Under GDPR, you can ask us at any time to:
- see the data we hold about you (access);
- correct anything that’s wrong (rectification);
- delete it entirely (erasure);
- get a copy in a portable format, or have us stop processing it while a request is resolved (portability and restriction);
- object to processing based on legitimate interest, or withdraw consent given for anything else.
Email privacy@fixturestack.com for any of the above and we will act within 30 days — for a deletion request, every row above is removed within seven. You don’t need to give a reason.
If you think we’ve mishandled your data, you can also complain to Bulgaria’s Commission for Personal Data Protection (cpdp.bg) or the supervisory authority in your own EU country.
Age
FixtureStack is not directed at children. You must be at least 16 to join early access. If you believe a child has given us their email, contact us and we’ll remove it.
Changes to this policy
If what we collect changes — most likely once the product itself exists — this page changes with it and the date at the bottom updates. We won’t quietly widen what we collect without saying so here first.
Last updated 2026-09-05