Privacy policy
This policy covers the website trycaboo.com and the Caboo waitlist. It does not cover the Caboo app, which has not launched and will have its own policy.
1. Who is responsible
Alexander Bär & Leonard Wiskow
Im Rittergut 1A
06618 Naumburg (Saale)
Germany
Phone: +49 152 29373845
Email: privacy@trycaboo.com
2. The short version
We ask for one thing: your email address, so we can tell you when Caboo is ready. You confirm it by clicking a link we send you. You can leave at any time, and we do not track you while you are here.
3. No cookies, no tracking
This site sets no cookies and stores nothing at all in your browser. It loads no scripts, fonts or images from anyone else: every file comes from trycaboo.com, including the typefaces.
There is no analytics of any kind, no advertising or measurement pixel, no session recording, no behavioural profiling and no embedded third-party content.
That is why you are not seeing a cookie banner. There is nothing to consent to. Your
browser also never talks to our email provider directly: the form posts to our own address
/api/waitlist, and our server makes the request from there.
4. Hosting and technical data
The site is hosted on Cloudflare Pages, and the one server-side endpoint runs as a Cloudflare Pages Function. Cloudflare also provides our DNS, content delivery and protection against automated abuse of the signup form.
To deliver a page and to keep the form from being abused, Cloudflare processes technical connection data such as your IP address, the time of the request, the page requested and your browser's user agent. We do not combine this into profiles and do not use it for analytics.
Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in operating the site securely and reliably.
Cloudflare, Inc. is based in the United States. A data processing addendum under Art. 28 GDPR is in place, and transfers outside the EU are covered by the European Commission's standard contractual clauses, as set out in Cloudflare's customer data processing addendum.
5. Joining the waitlist
What we collect:
- your email address;
- a source category, if you arrived through one of our own links (see section 7);
- the record of your confirmation, kept by our email provider as proof of consent.
That is the whole list. No name, no date of birth, no location, no gender, and nothing about your relationship or your partner. The waitlist form asks for an email address and nothing else.
What we use it for: to send you Caboo launch updates and occasional product news: early access, beta timing, meaningful updates before launch, and the App Store launch itself. Not a daily newsletter, not third-party advertising, not partner offers.
Legal basis: Art. 6(1)(a) GDPR, your consent, together with § 7(2) no. 3 UWG for sending email.
6. Double opt-in
Submitting the form does not subscribe you. It asks our email provider to send you a confirmation email. Only when you click the link in that email do you become a confirmed subscriber and join the waitlist.
The confirmation link is generated by our email provider, not by us. This is how we verify that the mailbox belongs to whoever typed the address, and it is what stops somebody signing you up without your knowledge. If you never click, you never hear from us again and the unconfirmed request expires.
After confirming you land on https://trycaboo.com/waitlist-confirmed. The time of the
request and of the confirmation are recorded as evidence of consent, which we are required
to be able to demonstrate under Art. 5(2) and Art. 7(1) GDPR.
7. Where you came from
Links we post on our own social profiles may carry a parameter such as
?src=tiktok. If one is present, we store a single value from a fixed list
(tiktok, instagram, x, youtube,
direct or other) so we can tell which of our channels people
actually come from.
This is not cross-site tracking. No cookie is set, no full referrer URL is stored, nothing
is shared with the platform you came from, and nothing follows you anywhere. A visit
without such a parameter is simply recorded as direct.
8. Our email provider: Brevo
We use Brevo (Sendinblue GmbH, Köpenicker Straße 126, 10179 Berlin, Germany, part of the Brevo group) to manage the waitlist and to send email. Brevo processes your address on our behalf under a data processing agreement pursuant to Art. 28 GDPR.
Brevo stores your address, sends the confirmation email, records your confirmation, delivers later product emails, and handles unsubscribes and suppression.
Brevo states that contact data for European customers is stored on servers within the European Union. Where Brevo uses sub-processors outside the EU, those transfers are covered by the standard contractual clauses in its data processing agreement.
Email we send comes from Caboo <hello@trycaboo.com> on our own authenticated domain. Replies to that address reach us through Cloudflare Email Routing.
9. Your address stays here
Your waitlist address is held by Brevo and nowhere else. It is not copied into a database of ours, and it is not transferred into the Caboo app's systems. If you later create an account in the app, that is a separate step with its own consent.
Our server logs record the outcome of a signup attempt, a duration and an error code. Never the address itself.
10. How long we keep it
- Confirmed subscribers: until you unsubscribe or withdraw your consent, or until the waitlist has served its purpose.
- Unconfirmed requests: only for as long as our email provider keeps an unconfirmed double opt-in request. If you never confirm, you do not become a subscriber.
- After you unsubscribe: we send you nothing further. A minimal record may be kept so that the unsubscribe itself is honoured and so we can demonstrate that consent existed and was withdrawn.
- Technical logs: according to Cloudflare's own retention for the services we use; we do not keep a separate copy.
11. Withdrawing and unsubscribing
You can withdraw your consent at any time, with effect for the future. The simplest way is the unsubscribe link at the bottom of any email we send. It works immediately and needs no explanation. You can also just write to privacy@trycaboo.com.
Withdrawing does not affect the lawfulness of what we did before you withdrew.
12. Deletion
Ask and we will delete your data. Write to privacy@trycaboo.com.
13. Your rights
Under the GDPR you have the right to:
- ask what data we hold about you and get a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data deleted (Art. 17);
- have its processing restricted (Art. 18);
- receive it in a portable format (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- object to direct marketing at any time, with no reason needed (Art. 21(2));
- withdraw consent at any time (Art. 7(3));
- complain to a supervisory authority (Art. 77).
For any of these, write to privacy@trycaboo.com.
14. Complaints
You can complain to any supervisory authority. The one responsible for us is:
Landesbeauftragte für den Datenschutz Sachsen-Anhalt
Otto-von-Guericke-Straße 34a
39104 Magdeburg
poststelle@lfd.sachsen-anhalt.de
https://datenschutz.sachsen-anhalt.de
15. Encryption
The site is served over HTTPS only. Your connection, including anything you type into the form, is encrypted in transit.