flutterfly

Privacy Policy

Last updated: 2 November 2026

Please read this Privacy Policy carefully.

This privacy policy (the “Privacy Policy”) describes how the persons named in Section 1, operating under the brand name flutterfly (“we”, “us” or “our”), collect, use, share and otherwise process personal data in connection with the website flutterfly.app and its subpages (the “Website”) and the flutterfly waitlist (the “Waitlist”; together with the Website, the “Services”). This Privacy Policy applies to the Services only. The flutterfly app will be governed by a separate privacy policy.

We apply the same level of protection to everyone, regardless of where they live. We process personal data in accordance with applicable data protection laws, including the Swiss Federal Act on Data Protection (“FADP”), the EU General Data Protection Regulation (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), which uses the same article numbering as the GDPR, US state privacy laws such as the California Consumer Privacy Act (“CCPA”), the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”), the Brazilian General Data Protection Law (“LGPD”) and the Australian Privacy Act 1988. Section 10 sets out additional information required under specific laws.

1. Who is responsible for your data?

The controllers responsible for the processing of your personal data are:

Mira Faltermeier, Lily Mappin and Noah Koller
Marktgasse 11, 9000 St. Gallen, Switzerland
Email: legal@flutterfly.app

We jointly determine the purposes and means of the processing and are therefore joint controllers within the meaning of Art. 26 GDPR. You may exercise your rights against any one of us, and we will respond to your request jointly. Please direct any questions or requests relating to this Privacy Policy to the email address above.

2. What do we collect?

a) What do you enter in the form?

When you join the Waitlist, we collect the following personal data, which you provide to us voluntarily:

  • your email address; and
  • if you so choose, your request to receive updates and news from us.

In the form, you also confirm that you are 18 or older and that you agree to our Terms of Service and this Privacy Policy. We check these confirmations when you sign up but do not store them with your entry.

The Waitlist does not ask for any information about your eating habits, your health or your body. Please do not enter such information in the form.

The Waitlist is only open to persons aged 18 or older (see our Terms of Service). If you indicate in the form that you are under 18, you cannot sign up, and we do not store the information you entered. The Website is not directed at children. If we learn that a person under 18 has nevertheless signed up, we will delete their personal data.

b) What is created when you sign up?

Upon sign-up, the following information is generated and stored with your entry:

  • the label “Waitlist”, which indicates how you joined; and
  • the date and time of your sign-up, your email preferences and whether you have confirmed your sign-up.

Because we use a double opt-in process, our email provider sends you a confirmation email on our behalf after you sign up. Your sign-up is complete once you click the link in that email. The link opens a confirmation page operated by our email provider, so your browser connects directly to our email provider, which receives your Technical Data (see Section 2 c)) and records that you have confirmed your sign-up.

c) What technical data is processed?

When you visit the Website or open a link in one of our emails, our service providers automatically receive technical data, including your IP address, the time of your visit, the page requested and your browser type (collectively, “Technical Data”).

When you submit the sign-up form, your browser sends your entries to our server, which Cloudflare operates on our behalf, not directly to our email provider. Our server checks your entries and forwards them to our email provider, which stores the Waitlist. Our server does not pass your IP address on to our email provider, and we do not store your IP address with your Waitlist entry. However, when you click the confirmation link or any other link in our emails, your browser connects directly to our email provider, which then receives your Technical Data, including your IP address.

To protect the sign-up form against automated sign-ups, we use a hidden form field and limit repeated sign-ups from the same IP address. For this purpose, Cloudflare briefly uses your IP address to count sign-up attempts.

d) What do we not collect?

We do not collect payment details, precise location data, your contacts, your exact date of birth or any information from social networks.

3. Why do we process your data, and on what legal basis?

We process your personal data in accordance with the FADP and, where applicable, the GDPR. The GDPR requires us to specify a legal basis for each purpose of processing:

  • Operating the Waitlist, sending you the confirmation email and contacting you about the launch of flutterfly (performance of our agreement with you, Art. 6(1)(b) GDPR);
  • Sending you updates and news, provided that you have opted in by ticking the separate box in the sign-up form (your consent, Art. 6(1)(a) GDPR);
  • Ensuring the security of the Website and preventing spam and automated sign-ups (our legitimate interest in a secure Website, Art. 6(1)(f) GDPR); and
  • Responding to your requests and recording that you have unsubscribed (compliance with our legal obligations and our legitimate interest, Art. 6(1)(c) and (f) GDPR).

If you do not tick the box for updates and news, we will not send you any. We will only email you about your sign-up, the launch of flutterfly and important changes to the Waitlist, such as changes to this Privacy Policy. You can opt in later by writing to us.

The provision of your personal data is voluntary. Without your email address and your confirmation that you are 18 or older, however, we cannot add you to the Waitlist.

4. What cookies do we use?

We do not use cookies for analytics or advertising purposes.

If our service providers set a cookie or similar browser storage at all, it is solely one that is strictly necessary to deliver the Website securely.

Any cookie or similar browser storage set by our service providers is strictly necessary within the meaning of Art. 5(3) of the ePrivacy Directive (Directive 2002/58/EC) and the national laws implementing it, since it serves exclusively to protect the Website and ensure its proper functioning. It is not used to track users across other websites. Consequently, it is permanently enabled and is set without prior consent; for users in Switzerland, this is permitted under Art. 45c of the Telecommunications Act. The legal basis for any related processing of personal data is our legitimate interest in the secure operation of the Website (Art. 6(1)(f) GDPR).

You may block or delete cookies at any time through your browser settings. If you do so, certain functions of the Website, including the sign-up form, may not work as intended.

In addition, we do not use analytics tools, tracking pixels (also known as web beacons) or social media plugins, and our emails do not track whether you open them or click on links.

5. Who do we share your data with?

We share your personal data only with carefully selected service providers that host the Website, protect the sign-up form against automated sign-ups, store the Waitlist and send our emails on our behalf. These service providers may process your personal data solely on our instructions and under data processing agreements, and never for their own purposes. Upon request, we will tell you which service providers we use.

We do not sell your personal data or share it for advertising purposes. In particular, we never upload the Waitlist to social media or advertising platforms, for example to target advertisements at you or at persons similar to you.

We disclose personal data to public authorities only where required by law.

6. Is your data sent to other countries?

Our service providers are based in the United States.

Your personal data may therefore be processed in the United States and in other countries in which they operate.

For personal data from the EU, the EEA, the UK and Switzerland, our service providers are certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, which the European Commission (Art. 45 GDPR), the UK government and the Swiss Federal Council (Art. 16(1) FADP) recognise as ensuring an adequate level of protection. Where these frameworks do not apply, we rely on the standard contractual clauses approved by the European Commission (Art. 46 GDPR) and recognised in Switzerland. We rely on the same safeguards for transfers from other countries whose laws require them.

7. What happens in a business transfer?

We may establish a company under Swiss law (for example, a limited liability company (GmbH)) to operate flutterfly and transfer the Waitlist to it. That company would then assume our role as controller and may use your personal data only as described in this Privacy Policy.

We may also sell or transfer flutterfly in whole or in part to another company, for example in connection with a merger, an acquisition or insolvency proceedings. In such a transaction, the Waitlist may be among the business assets transferred, and the acquiring company may use your personal data only as described in this Privacy Policy.

Before any such transfer, we will notify you by email, and you may ask us to delete your personal data if you do not wish it to be transferred.

Such a transfer does not constitute a sale of your personal data. If we discontinue flutterfly without a transfer, we will delete the Waitlist (see Section 8).

8. How long do we keep your information?

We retain your personal data only for as long as necessary for the purposes described in this Privacy Policy:

  • Waitlist data: until we have informed you that the app is available in the app stores, or until we decide not to launch the app. We will then delete it within three months.
  • Unconfirmed sign-ups: if you do not confirm your sign-up within 30 days, we delete your entry. We do this at regular intervals, so deletion takes place no later than 60 days after you signed up.
  • Unsubscribing: if you unsubscribe, we stop emailing you immediately. We keep your entry, marked as unsubscribed, so that we do not contact you again by mistake. Upon request, we will delete it completely.
  • Deletion requests: we delete your personal data within one month of receiving your request.
  • Technical Data: retained by our service providers for a limited period for security and troubleshooting purposes, in accordance with their retention practices, and then deleted.

9. What rights do you have?

Wherever you live, you have the right to:

  • request access to the personal data we hold about you and obtain a copy;
  • have inaccurate personal data corrected;
  • have your personal data deleted;
  • receive your personal data in a commonly used, machine-readable format;
  • object to, or request the restriction of, the processing of your personal data; and
  • withdraw your consent at any time. Every email contains an unsubscribe link, and you may also write to us. The withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal.

To exercise these rights, please contact us at the email address set out in Section 1. To verify your identity, we may ask you to write to us from the email address you used to sign up. We will respond within one month, or within such shorter or longer period as your local law prescribes. Exercising your rights is free of charge, and we will not discriminate against you for doing so.

You also have the right to lodge a complaint with a data protection authority. Section 10 lists the competent authorities for certain regions.

10. What else applies in your region?

European Union and EEA

You have the rights set out in Articles 15 to 21 GDPR.

You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21 GDPR).

You may lodge a complaint with the supervisory authority in your country of habitual residence, place of work or place of the alleged infringement.

United Kingdom

The UK GDPR grants you the same rights. You may lodge a complaint with the Information Commissioner’s Office at ico.org.uk.

Switzerland

The FADP grants you comparable rights. You may lodge a complaint with the Federal Data Protection and Information Commissioner at edoeb.admin.ch.

United States, including California

In the preceding 12 months, we have collected the following categories of personal information: identifiers (email address, IP address) and internet or other electronic network activity information (requests to the Website). We collect this information from you and your browser, for the purposes described in Section 3, and retain it for the periods described in Section 8. We disclose it only to the service providers described in Section 5, for business purposes.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use sensitive personal information.

We have not done so in the preceding 12 months, and we have no actual knowledge of selling or sharing the personal information of consumers under 16 years of age. We do not use the Waitlist to draw conclusions about your health.

Depending on your state of residence, you may have the right to know what personal information we collect, to access, correct and delete it, to opt out of its sale, sharing, use for targeted advertising and profiling (none of which we engage in), and not to be discriminated against for exercising these rights. We honour these rights for everyone. You may designate an authorised agent, who must provide us with your written permission. If we decline your request, you may appeal by replying to our response; if we decline your appeal, you may contact the attorney general of your state.

Canada

We collect your personal information with your consent, and you may access and correct it as described in Section 9. Your personal information is stored outside Canada, as described in Section 6, and may be accessible to the authorities there. You may lodge a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Brazil

Under the LGPD, you have the rights set out in Article 18, including the rights to confirmation, access, correction, anonymisation, portability, deletion and information about sharing. You may lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

Australia

Under the Australian Privacy Principles, you may access and correct your personal information. Your personal information is disclosed to service providers in the United States, as described in Section 6. If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner at oaic.gov.au.

11. Do we make automated decisions about you?

We do not engage in automated decision-making, and we do not create profiles about you.

12. How do we keep your data secure?

The Website is served exclusively over encrypted connections (HTTPS) and uses browser security settings that protect against common attacks. Only the three of us have access to the Waitlist. Our service providers protect personal data with industry-standard measures. If a data breach poses a risk to your personal data, we will notify you and the competent authorities as required by law.

13. Will this policy change?

We will update this Privacy Policy if the Services or the applicable law change. The date at the top of this page indicates the latest version.

If a change materially affects how we use your personal data, we will notify you by email before the change takes effect.