Privacy policy
This policy explains what personal information Thoreon Limited ("we", "us") collects through cruxtape.com, why, who else handles it, and what you can ask us to do with it. It covers the website, the waitlist and the daily plan pilot. We extend it before we sell anything.
Who we are
CruxTape is operated by Thoreon Limited. For anything in this policy, write to [email protected].
What we collect
When you sign up for the pilot or join the waitlist
| Information | Where it comes from |
|---|---|
| Your email address | You type it in |
| Which form you used, and your answers to its three questions (your charting platform, the profile you read, how often you trade ES) | You choose them |
| The address of the page you signed up on, including anything after a "?" in it | Your browser |
| Your browser's user-agent string | Your browser |
| Your IP address, and the country our network provider associates with it | Your connection, via Cloudflare |
| The date and time you joined | Our server |
These are stored in our waitlist database. The waitlist service also writes signups, with your email address and IP address, to its own operational log. The notification email it sends our team carries your email address, IP address, country, browser and the page you signed up on.
A pilot sign-up made on the form since 27 September 2026 is confirmed by one button we email you, and is stored with the pilot's records instead: your email address, your three answers and the time. The button's link, the six-digit code it shows when it opens in another browser, and the value of the cookie that marks the waiting browser are kept with it only as one-way hashes. To limit repeated requests we also keep, for about two days, a one-way hash of your email address and of your IP address with the time of each request. Once you confirm, you are a tester (below). Signing in to your plan page works the same way. A sign-in request, and a sign-up that was never confirmed, are deleted within about two days of the button expiring.
The form also contains a hidden field that people never see. It exists to catch automated spam.
Once you are a tester
- We send the plan and the review to your email address each session of the pilot.
- Your personal link lets our server record when your page is opened. We use no tracking pixels in the emails.
- We record your answer to the one question at the end of each review.
- Anything you choose to tell us about the pilot.
When you visit any page
Our web server records standard access logs: your IP address, the time, the page requested and your browser's user-agent string. Cloudflare, which carries traffic to our site, processes the same connection information to deliver and protect it.
Our pages run no analytics or advertising trackers, and do not ask for your name, phone number or payment details. The plan pages set two cookies, both only for signing in: one for 30 minutes while a browser waits for its emailed button, and one for 30 days that keeps that browser signed in. With the second we store a one-way hash of its value, your browser's user-agent string and when it was last used, and delete them within a few hours of its expiry. Cloudflare may set a short-lived security cookie when it needs to tell people from automated traffic.
Why we use it
- To choose the pilot's testers from the applications.
- For testers: to send the plan and the review, and to learn how the pilot is used from the opens and the daily answers.
- To email you once when something opens to the waitlist.
- To keep the waitlist free of spam and abuse, for example by limiting repeated signups from one address.
- To understand which parts of the site lead people to join.
- To keep the website running and secure.
When you apply or join, our system emails a notification of your signup to our own team. We email you only about the pilot, or once when something opens to the waitlist, and we do not send newsletters.
Who else handles it
| Provider | What it does for us | Where |
|---|---|---|
| Amazon Web Services | Hosts the website, the waitlist database and its logs; sends the signup notification to our team and the emails to you (Amazon SES) | Sydney, Australia |
| Google (Google Workspace) | Hosts our team mailbox, which receives the signup notifications | Google's data centres |
| Cloudflare | Delivers the website, manages our domain name and protects the site from attacks | Global network |
We do not sell your information or share it for advertising.
How long we keep it
- Waitlist records and signup notifications: until you ask us to delete them, we delete your account, or we close the waitlist.
- Pilot records (opens and daily answers): until 90 days after the pilot ends, then deleted, or sooner if you ask or we delete your account.
- The record of a confirmed pilot sign-up (your email address, your three answers and the time): until you ask us to delete it or we delete your account.
- Sign-in requests and sign-ups that were never confirmed: about two days. Sign-in sessions: 30 days, then deleted within a few hours.
- Web server access logs: rotated as they grow; rotated logs are deleted after 14 days.
- The waitlist service's operational log: kept until the server's log storage limit rotates it out.
When an account is suspended or deleted
Our terms let us suspend or delete any account at any time, including one that goes unused or whose holder does not answer when we contact them, and you can ask us to delete yours. Your account is your email address on the waitlist or in the pilot, your personal link, and the records kept with them.
Suspended
We keep its data. Its emails stop and its links do not open until we restore it.
Deleted
Within 30 days of deleting an account, we delete:
- its waitlist record: your email address, the form you used and your answers, the page address, your browser, IP address and country, and the date you joined;
- for a pilot tester: the personal link, the page and its archive and tally, the record of your sign-up and of your sign-ins, the record of what we sent and when your page was opened, your daily answers, and our notes from any call with you;
- the signup notification about you in our team mailbox.
We keep only what the law requires us to keep:
- Nothing is sold today, so there are no payment or tax records. Once anything is sold, those records are kept for as long as New Zealand law requires, which is seven years for business records.
- Web server access logs and the waitlist service's operational log are not edited by hand. Entries about you leave them as they rotate out, on the schedule above.
Your choices and rights
You can ask us to show you the information we hold about you, correct it, or delete it, and you can leave the waitlist or the pilot at any time. Write to [email protected] from the address you signed up with. If you are not satisfied with our answer, you can complain to the privacy regulator where you live. In New Zealand, that is the Office of the Privacy Commissioner.
Age
CruxTape is for adults. Do not apply or join the waitlist if you are under 18.
When we start selling
Nothing is for sale today. Buying anything later would involve more information, such as an account and payment through a payment processor. This policy is updated to describe that before any sale opens.
Changes
We post any change to this policy on this page, with its date.