Buttered Toast
Privacy
What this site collects, and how to get rid of it.
Last updated 23 July 2026
butteredtoast.in is a one-page site for an iOS app that is still in development. The only thing it can collect is an email address, and only if you type one into the notify box and press the button.
No marketing email will be sent to you. Not now, and not later without your explicit confirmation. Right now the site stores addresses and sends nothing at all — there is no mailing system connected to it. If that changes, the first message you receive will be a single confirmation email asking you to click a link, and nothing further is sent unless you click it. An address that is never confirmed is never mailed.
1. What is collected
Only when you submit the notify form:
| Email address | Exactly as you typed it, lower-cased and trimmed. Nothing else about you — no name, no phone number, no address. |
|---|---|
| Time of submission | A timestamp, so the list can be aged out. |
| Network, coarsely | Your country, and your IP address with the last part removed (for example 203.0.113.42 is stored as 203.0.113.0/24). This is kept to spot a flood of automated junk submissions. The full IP address is never stored. |
Browsing the site without submitting the form collects nothing.
What this site does not do
- No cookies. None, of any kind. That is why there is no cookie banner.
- No analytics, no trackers, no advertising pixels. There is no Google Analytics, no Meta pixel, no session recording.
- No third-party fonts or CDNs. Everything the page loads comes from this domain.
- No profiling and no automated decision-making.
- Nothing is sold or shared with advertisers, data brokers or anyone else.
2. Why it is collected
One purpose: to tell you once, by email, when there is a version of Buttered Toast you can actually try. That is the whole of it. The legal basis is your consent, given by typing the address and submitting the form, and you can withdraw it at any time (section 6).
3. Where it is stored
In a PostgreSQL database hosted by Supabase in the ap-south-1 (Mumbai, India) region. The data stays in India. The table is not readable by the website or by any app; it can only be written to by the server-side function that handles the form, using a credential that never leaves the server.
4. Who else touches it
Two processors, both named in full:
| Cloudflare | Serves this website and runs the form-handling function and the anti-bot check (Turnstile). Your submission passes through Cloudflare on its way to storage. Cloudflare, Inc. is based in the United States. |
|---|---|
| Supabase | Hosts the database that holds the address, in Mumbai. Supabase, Inc. is based in the United States; the data itself is stored in India. |
Both are infrastructure providers acting on instruction. Neither is permitted to use the address for their own purposes. Because both companies are based outside India, their staff could in principle access the systems they operate for support and security reasons; submitting the form means accepting that. No one else — no partner, no advertiser, no analytics vendor — receives the address.
5. How long it is kept
- Unconfirmed addresses: 24 months. If the launch email has not gone out and you have not confirmed within 24 months of submitting, the entry is deleted.
- Confirmed addresses: kept until you unsubscribe or ask for deletion, and deleted within 30 days of either.
- If the project is abandoned or the notify list is retired, every entry is deleted.
Deletion means the row is removed from the database, not merely flagged. Encrypted infrastructure backups held by Supabase may retain a copy for a short period afterwards before they roll over; those backups are not used to contact anyone.
6. Your rights
India's Digital Personal Data Protection Act, 2023 gives you specific rights over your data. For a list that holds nothing but an email address, they come down to this — and all of them are exercised the same way, by writing to the contact below:
- Access. Ask what is held about you. The honest answer will be either "nothing" or "this address, submitted on this date".
- Correction. Ask for a mistyped address to be corrected or replaced.
- Erasure. Ask for the address to be deleted. It will be, within 30 days, with no questions asked and no attempt to talk you out of it.
- Withdrawal of consent. Change your mind at any time. Withdrawing consent has exactly one consequence: you stop being on the list. It is as easy to withdraw as it was to give — one message, no form to fill in, no account to create.
- Grievance redressal. If a request is handled badly, say so at the same address; it will be answered. If that does not resolve it, the DPDP Act lets you escalate to the Data Protection Board of India.
Requests are answered within 30 days. Because the only identifier held is the address itself, a request sent from the address in question can be acted on immediately; a request sent from a different address may need confirmation first, so that one person cannot delete another person's entry.
7. Contact
Contact route to be published here. A monitored email address for privacy requests is being set up on this domain and will be printed here before the notify box begins collecting addresses. Until it appears, no address has been collected through this site.
Buttered Toast is an independent project built by one person in India. There is no company entity behind it yet, and therefore no registered office and no appointed Data Protection Officer to name — inventing either would be worse than saying so plainly. If that changes, this page changes with it.
8. The iOS app
This page covers butteredtoast.in only — the website you are reading. The Buttered Toast iOS app is a separate matter with a different and larger data footprint, and it will carry its own privacy notice before it is released to anyone. Nothing on this page should be read as describing the app.
9. Changes
If this notice changes in a way that affects what is collected or who can see it, the date at the top changes and the change is described here. Material changes will not be applied retroactively to addresses already collected: if the purpose ever widens, consent will be asked for again.