Privacy notice for the sign-up page
Last updated: 6 November 2026. This notice covers only this page (the Android test and the "tell me when it is available" list). The Medusa app has its own privacy policy at app.nirah.nl/privacy.
Who is responsible
The controller is the provider named in the imprint. Contact for anything about your data: privacy@nirah.nl.
What we collect
- Your e-mail address, to write to you.
- Your Google account e-mail address, only if you tick "I want to test the Android app". It is needed to add you to the tester list in Google Play. It is stored encrypted.
- Which boxes you ticked, and the consent record: the time, the version of the wording you agreed to, and a one-way scrambled fingerprint (a keyed hash) of your network address. We cannot turn the fingerprint back into an address; it is only there to show that a sign-up was real if it is ever disputed.
- The link you came from, such as "reddit", "linkedin" or "card" (a short tag in the page address), so we can see which channel works. It is not linked to anything else about you.
- Your browser language (for example "en"), so we know which language to write in.
- Whether and when you confirmed, unsubscribed, or were sent the instructions or the launch e-mail.
This page sets no cookies, uses no analytics or tracking, and loads nothing from other websites. The form is not a third-party form service: it sends your details to our own server.
Why, and on what legal basis
- To run the Android closed test: give you access, send you the instructions and ask for your feedback.
- To send you one e-mail when Medusa is available, if you ticked that box.
The legal basis is your consent (Art. 6(1)(a) GDPR). You give it with two separate, unticked boxes, and we only start after you confirm your address with the link in the e-mail we send you (double opt-in). The confirmation e-mail itself is sent because you asked for it. You can withdraw your consent at any time with effect for the future; what we did before stays lawful.
Who receives your data
- Scaleway SAS (France, EU), our e-mail provider for the confirmation and the test instructions (Transactional Email).
- [Provider for the launch announcement: to be filled in before it is used], for the one "Medusa is available" e-mail.
- Our hosting: our own server, [hosting location and provider to be filled in], where the list is stored.
- Google receives the Google account address only when we add it to the tester list in Google Play, which Google needs to give you access.
We do not sell your data and do not give it to anyone else.
How long we keep it
- Your Google account address: until the Android test ends, or until you withdraw (then within 30 days), whichever is first.
- Your e-mail address and consent record: until you unsubscribe, or until the list is no longer needed. If you never confirm your address, the sign-up is deleted automatically after 30 days.
- After you unsubscribe we keep a minimal record that you did (so we do not write to you again) until you ask us to delete it.
Your rights
You can ask us for access to your data, correction, deletion, restriction, a copy you can take with you, and you can object. You can withdraw your consent at any time, with the "Unsubscribe" link in our e-mails or by writing to privacy@nirah.nl. You may also complain to a data protection authority, for example in the country where you live.
Security
The connection is encrypted. The Google account address is encrypted in our database. The links in our e-mails are single-purpose and the confirmation link works once.