Privacy Policy

What this covers

This Privacy Policy explains how Mast ("we," "us," "our") collects, uses, stores, and protects personal information when you visit mast.cafe or sign up for our launch announcements. By using the site, you agree to the practices described here.

What we collect

Information you give us

• Email address. Only if you submit the signup form on the home or order page.
• Source tag. Which page you signed up from (e.g., "home" or "order-page"), so we can understand how people find us.

Information collected automatically

• IP address. Used to enforce a rate limit (max 5 signups per IP per hour) and to block spam bots.
• Country code. Two-letter country code derived from your IP (e.g., "US") for the same purpose.
• Browser metadata. User-agent string and a Cloudflare Turnstile verification token, used to confirm you're a human submitting the form.
• Standard server logs. Cloudflare records routine request data (timestamp, URL, status) for security and performance.

What we don't collect

• No tracking pixels, marketing cookies, or behavioral profiles.
• No social-media remarketing tags (no Meta Pixel, no Google Analytics today).
• No third-party advertising trackers.
• No payment information (we don't take orders or payments on this site yet).

How we use it

• To tell you when Mast opens, plus occasional, intentional updates that we think you'll genuinely care about.
• To protect the signup form from spam and abuse.
• To improve the website, anonymously and in aggregate.
• We do not sell your data. We do not share it with marketers, advertisers, or anyone outside the services listed below.

Who processes it

We use a small set of trusted providers to operate the site and deliver email. Each has its own privacy policy.

• Cloudflare — hosts the website, runs the bot-protection challenge (Turnstile), and stores signups in a key-value store. See Cloudflare's privacy policy.
• Buttondown — our email list provider. When you sign up, your email is forwarded to Buttondown so we can send you the launch announcement. See Buttondown's privacy policy.
• Google Fonts — fonts are loaded from Google's CDN when you view the site. Google may log the request. See Google's privacy policy.

How long we keep it

• Signups — retained until you unsubscribe or request deletion.
• Rate-limit data — auto-expires after 1 hour.
• Server logs — Cloudflare's standard retention (typically 30 days or less for the free plan).

Your rights

Depending on where you live (US states with privacy laws, EU, UK, California, etc.), you may have legal rights to access, correct, delete, or restrict our use of your personal information. You can exercise all of these at any time:

• Unsubscribe — one-click link in every email we send.
• Delete — email hello@mast.cafe with "delete me" in the subject. We'll remove your data from our records within 30 days.
• Access — same address. We'll send you everything we have.
• Object to processing — same address.

Children

Mast is intended for an adult and general audience. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please email hello@mast.cafe and we will delete it.

Security

We take reasonable care to protect your information — encryption in transit (HTTPS), access controls on data stores, and minimal collection. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy as Mast grows — when we add online ordering, open a physical location, or add new services. We'll update the "Last updated" date above and, for material changes, notify subscribers by email.

Contact us

For anything privacy-related, write to hello@mast.cafe.