The pages
HitlistAI does not ask you to create an account. We do not use advertising or analytics cookies, and we do not sell personal information.
If you submit the form, we store the address, a status of pending, active, or unsubscribed, and the times you signed up, confirmed, or unsubscribed. We also store a hash of the confirmation token, a hash of the unsubscribe token, and when the confirmation link expires. The tokens themselves are only in the message we send.
The address stays pending until you open the confirmation link. A hosted email service receives the address and the message so it can deliver that mail. Every message has a one-click unsubscribe link. Using it marks the address unsubscribed. We keep the address so we do not email it again.
We also keep a send log: which address, whether the message was a confirmation or a briefing, and when it was sent. That log is how we stay within the daily send limit.
Signup checks
The form uses Cloudflare Turnstile to reduce automated signups. Turnstile receives the check token and connection data for that request. We store a hash of the IP address from the signup, not the raw address. Repeated attempts from the same network can be slowed by a rate limit.
Hosting
The site is served by Cloudflare Workers. The email list is in Cloudflare D1. The host may keep standard connection logs as part of running the network. We do not use those logs to build a profile. Confirmation and unsubscribe links put the token in the query string, and request logs are set to drop query strings.
Contact
Questions about this page: hello@hitlistai.com.