in betweenBack to In Between
PRIVACY POLICY

Privacy, in plain language.

In Between is still in its pre-launch stage. This page explains what the current website actually collects, where information goes, and the choices you have.

Last updated: August 24, 2026

Your information is not community content.

Joining the early community does not create an account or publish a profile. Conversation requests are delivered privately to Katie. The public maps and member examples currently shown on the site are fictional previews, not real submissions.

01

What we collect

Join the Community

The pre-launch interest form asks for an email address and how you are connected to adoption. It can also collect the community features you are interested in and an optional note about what you hope In Between becomes. The private waitlist record includes those answers, consent choices, consent timestamps where applicable, and record creation and update times.

Optional location information

Adoptees may select a city, region, or country for where they live now and where they were adopted from. The form does not accept a street address, postal code, exact pin, or precise coordinates. The separate map-consent checkbox controls whether those selected places may be used; more detail appears in the location section below.

Request a Conversation

The private contact form collects an email address, connection topic, consent acknowledgement, and any preferred name, message, or contact-method preference you choose to provide. It does not create an account or public story.

Security and request data

Cloudflare processes ordinary request information needed to host and protect the site, such as an IP address, request URL, browser information, timing, and response status. Turnstile processes a short-lived verification token and technical browser or network information to help distinguish people from automated abuse. The rate limiter derives a keyed, pseudonymous identifier from the Cloudflare-provided client address and stores only a request count and reset time for the active limit window; it does not put the raw address in the rate-limit record.

02

How information is used

  • To keep a private record of early-community interest and learn which future community features people value.
  • To send occasional In Between updates only when the optional email-updates box is checked and the email address is confirmed through Kit's double opt-in process.
  • To deliver a private conversation request to Katie so she can respond personally.
  • To create broad, unlinked regional counts only when separate aggregate-map consent is given.
  • To validate submissions, limit abuse, troubleshoot failures, and keep the forms available.

In Between does not currently run advertising, behavioral analytics, session replay, or marketing-tracking software. It does not currently set its own nonessential browser cookies or use browser storage for submitted form information.

03

Service providers

The current site uses a small number of providers to perform the work described here:

Supabase
Hosts the private Postgres tables for early-community signups and unlinked aggregate region counts. The browser cannot read these tables directly through this website.
Kit
Receives information only when someone checks the optional email-updates box. This includes their email, connection type, feature preferences, optional hopes, map-consent yes/no value, consent time, and signup source. Kit requires confirmation before the address becomes eligible for email updates.
Resend
Delivers Request a Conversation submissions to Katie's private inbox. The message is not written to the In Between application database or Kit, but the email and its contents pass through Resend and remain in the receiving inbox. As of this policy's update, Resend documents a 30-day retention period for sent-email data on standard plans.
Cloudflare
Will host the public site and provides Turnstile verification and a Durable Object rate limiter. Cloudflare also produces hosting metrics and short-lived request logs when observability is enabled.
Open-Meteo
Provides city, region, and country suggestions. Search text is sent through the In Between server to Open-Meteo to return suggestions and resolve a selected place. Open-Meteo may keep technical API logs for up to 90 days under its currently published terms.

If you follow a link to Instagram, TikTok, Katie's personal website, or another outside site, that service handles the visit under its own privacy terms.

04

Location and map consent

Location autocomplete processes the text you type so it can show suggestions, but the application does not save, forward to Kit, or aggregate a selected location unless you explicitly check the aggregate-map consent box. Without that consent, the waitlist route does not resolve the submitted place identifiers and discards the location inputs.

With consent, the application resolves only city, region, and country information. The broad adopted-from label may be kept in the private waitlist record. The broad current-location label is converted into a regional count stored in a separate table that contains no email, signup ID, or profile link. Kit receives only the yes/no map-consent value, not the locations.

No real waitlist location is displayed on the current public map. The names, dots, stories, profiles, and locations in the map previews are fictional. Any future member map will need separate privacy and consent controls before real people can appear.

05

Your choices and requests

Email updates

Joining the early community and choosing email updates are separate. The email-updates box is optional and unchecked by default. If you check it, Kit sends a confirmation request. You can unsubscribe from later updates through the link in a Kit email. Unsubscribing from Kit does not automatically delete the separate private waitlist record.

Access, correction, and deletion

You may ask to access, correct, or delete information connected to your email address by writing to hello@inbetweencommunity.com. The request is handled manually across the systems that apply to you. In Between may need enough information to find the right record and avoid changing or disclosing someone else's data.

Public stories and photographs

Sending a private note, joining the early community, or opting into updates does not give permission to publish a story, photo, or profile. Public stories require a separate, explicit permission process with the person sharing them.

06

Retention and security

Retention still needs a final launch decision

In Between has not yet adopted an automatic deletion schedule for private waitlist records. Today, those records remain in Supabase until they are manually deleted. Kit records remain there until they are unsubscribed or deleted. Conversation emails remain in Katie's private inbox until manually deleted; Resend currently documents a 30-day retention period for sent-email data. Cloudflare rate-limit records delete themselves after the active 60-second or 15-minute window. Cloudflare Workers request logs follow the configured plan's retention period, currently no longer than seven days. Provider backups and operational systems may retain limited copies under their own schedules.

A specific waitlist and inbox retention schedule should be chosen and added to this policy before public launch. A deletion request can still be made at any time using the contact address above.

Security

The current implementation keeps database and provider credentials on the server, restricts direct public database access, validates form input, limits request sizes, uses honeypots, verifies Turnstile tokens, and rate-limits submissions. No internet service can promise perfect security, so please share only what feels comfortable and do not submit crisis, therapy, legal, identity-document, or exact-address information.

You can ask what happens to your data.

The current privacy contact is hello@inbetweencommunity.com. If a dedicated privacy address is adopted later, this policy will be updated. Before public launch, Katie still needs to confirm whether this will remain the official privacy-request address.