Privacy Policy for theso.io

Last updated: April 2026

At Theso, accessible from theso.io, the privacy of our visitors is one of our main priorities. This Privacy Policy describes what information we collect, how we use it, and the rights you have over it.

If you have additional questions or require more information about our Privacy Policy, do not hesitate to contact us.

General Data Protection Regulation (GDPR)

We are the Data Controller of your information.

Theso's legal basis for collecting and using the personal information described in this Privacy Policy depends on the information we collect and the specific context in which we collect it:

• You have given Theso permission to do so (e.g. joining the waitlist).
• Processing your personal information is in Theso's legitimate interests and not overridden by your rights.
• Theso needs to comply with the law.

Theso will retain your personal information only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, and enforce our policies.

If you are a resident of the European Economic Area (EEA), you have the following data protection rights:

• The right to access, update or delete the information we have on you.
• The right of rectification.
• The right to object.
• The right of restriction.
• The right to data portability.
• The right to withdraw consent.

To exercise any of these rights, contact us at developer@theso.io.

Information we collect

Waitlist signup

When you join our waitlist, we collect the email address you submit. We use it solely to notify you when Theso becomes available and to send you product updates related to that launch. You can ask us to remove your address at any time by emailing developer@theso.io.

Waitlist addresses are stored by our identity provider, Clerk (clerk.com), which acts as a data processor on our behalf. Clerk's privacy policy is available at clerk.com/legal/privacy.

Server logs

Theso.io is hosted on Cloudflare Workers. Cloudflare temporarily records standard request metadata (IP address, user agent, referrer, timestamp) for security, abuse prevention, and operational reasons. We rotate and discard these logs on a short retention schedule and do not use them for marketing or profiling. Cloudflare's privacy practices are documented at cloudflare.com/privacypolicy.

Cookies and consent

We use a single first-party cookie (privacyPreferences) to remember your cookie consent choices. This cookie is strictly necessary and is set without consent. It contains only your category-level preferences and expires after one year.

We do not set advertising, targeting, or cross-site tracking cookies. Analytics cookies (see below) are only set after you opt in.

You can change or withdraw your consent at any time by clicking "Cookie Settings" in the page footer.

Analytics

We use PostHog to understand how visitors interact with our website so we can improve it. PostHog is a privacy-friendly product analytics platform that we use in its EU-hosted, GDPR-compliant configuration — your event data never leaves the European Union.

Analytics is opt-in only. No analytics events are captured until you explicitly accept the "Analytics" category in our cookie banner. We additionally instruct PostHog not to create person profiles for landing-page visitors, which means we do not build long-term identity records from your visits.

PostHog requests are routed through a same-origin proxy on theso.io (rather than directly to posthog.com) so that ad blockers don't silently drop them. The destination is unchanged: PostHog's EU infrastructure.

You can read PostHog's privacy policy at posthog.com/privacy.

Sub-processors

We rely on the following third-party processors to operate this site:

• Cloudflare — hosting, edge compute, and DDoS protection.
• Clerk — waitlist email storage and signup notifications.
• PostHog (EU) — product analytics, opt-in only.

Children's information

Theso.io is not directed at children. We do not knowingly collect Personal Identifiable Information from children under the age of 16. If you believe a child has provided us with personal information, please contact us and we will delete it from our records.

Online policy only

This Privacy Policy applies only to our online activities and is valid for visitors to theso.io with regard to the information they share or we collect on this website. It does not apply to any information collected offline or via channels other than this website.

Consent

By using our website, you consent to this Privacy Policy and agree to its terms.