This notice explains what information the Hapimatic website collects,
what happens when you sign in with Google, and how we use that
information. It covers the public Hapimatic website at
hapimatic.com. Separate terms govern the hosted Hapimatic
service; see section 6, "The hosted service".
1. What the website collects
The Hapimatic website uses no third-party analytics service or advertising tracker, runs no tracking script, and sets no advertising or tracking cookies. The only cookies it uses are the functional sign-in cookies described in section 2.
When you arrive through a link carrying one of our
campaign tags (utm_ parameters in the address), our gateway
adds one to a daily total kept for each tag and page; it stores only
these daily totals (the date, the tags, the page, and the number of
visits) and nothing that identifies you or your visit, such as your IP
address, your browser details, or a cookie.
To run and protect the service, our gateway records operational events — such as sign-in attempts, errors, and request handling — in the server's system journal. These logs are kept for operational and security purposes under the server's default log rotation, and they are not used for analytics or advertising.
Some log lines written when you take an account action include the email address you signed in with.
The website has no checkout and does not collect payment information.
If we later add any other analytics or measurement, we will update this notice before it takes effect.
2. Signing in with Google
You can sign in to Hapimatic with a Google account. When you do, you
are sent to Google to authorise the sign-in, and the website asks Google
for the openid, email, and
profile scopes.
From what Google returns, the gateway uses only your email address and Google's account identifier for your account, and only after Google confirms your email address is verified. It does not store your Google profile, such as your name or picture.
Access is limited to approved addresses: sign-in is refused unless your verified email address is on the service's allowlist.
To route you to your workspace, the gateway stores one record: a mapping from your email address (and the subdomain you use) to your instance. This mapping is kept only on the gateway, is never sent off the gateway over the network, and is held in a local database with restricted file permissions on the server.
To keep you signed in, the gateway sets one session cookie named
gateway_session. It is an HttpOnly,
Secure cookie scoped to hapimatic.com itself —
it is never sent to any instance subdomain — and it expires one hour
after sign-in.
During sign-in, a few short-lived cookies are used to complete the exchange with Google. They expire within ten minutes and are cleared once sign-in finishes.
You sign in at /login.
3. Contacting us
If you contact us about a hosted pilot — for example through the
site's contact link, which reaches admin@hapimatic.com — we
receive your email address and the message you choose to send. We use
them only to reply to you, apart from counting how many such messages we
receive each week; that weekly number records nothing about you. If you
ask to be added to the waiting list for the hosted service, we also keep
your email address on that list, and use it only to contact you about the
hosted service, until you ask us to remove it.
If you ask to join the waiting list for the open-source core — through the
"Email us here" link on the site's coming-soon page, which also reaches
admin@hapimatic.com — we receive your email address and the message
you choose to send. We use them only to reply to you and to tell you when the
open-source core is published.
If you send a message through the "Talk to Matt" form on a talk's links page, we keep what you type there (your name, how to reach you, what you do if you choose to say, and your message), with the time and the talk it came from, on the website's own server and nowhere else. Only Matt Starfield reads it, we use it only to reply to you, and we keep it until you ask us to remove it, as section 5 describes.
If you use the interest form on this website, we store what
you enter — your name, your business name if you give one, the size of your
company if you pick one, your email address, the topics you tick, your message,
and any images you attach — on the website's own server and nowhere else, so that
we can reply and keep track of who is interested. We remove the details embedded
in images, such as location and camera data, before storing them. Only Matt
Starfield reads what you send. We count how many submissions arrive each week;
that number records nothing about you. We delete each submission 12 months after
you send it, or sooner if you ask us at admin@hapimatic.com, as
section 5 describes.
4. Who is responsible
The Hapimatic website and the hosted Hapimatic service are operated
by Solid Product Design. For any privacy question or request, contact
admin@hapimatic.com.
5. Your choices and requests
You can ask what information we hold about you, and ask us to correct
or delete it, by emailing admin@hapimatic.com. We respond
to access and deletion requests.
6. The hosted service
If you use the hosted Hapimatic service (a separate, paid offering), its own hosted-service terms — a separate future document — govern that service, including how long your data is kept after it ends (30 days after the effective end of service).