Privacy Policy
Last updated: August 1, 2026
This policy explains how we handle your data on this site. In short: the only personal data we collect is the email you give us to join the OpenStarterKit Pro waitlist. There is nothing else, and nothing here tracks you.
Who is responsible
OpenStarterKit is run by Michele Canini, based in Italy, who is the data controller. For any privacy question or request, contact us at hello@openstarterkit.dev.
What this policy covers
This policy applies to openstarterkit.dev. The live demo at demo.openstarterkit.dev is a separate deployment that runs on fixture data: see "The demo" below.
What we collect
Only your email address, plus the technical metadata of your signup: the time you requested and confirmed it, the anti-abuse tokens, and which form you used. We do not collect your name, and your IP address is never stored with your subscription. When we send you an email, we also record which links you clicked (standard click tracking, handled by Resend), so we can tell which updates are actually useful. We do not track whether you open our emails: there is no tracking pixel in them.
Why, and on what basis
To send you the Pro waitlist updates (about one short email a week while we build the Pro) and a launch discount. The legal basis is your consent, given when you confirm your subscription through the link we email you (double opt-in). You can withdraw it at any time. Giving us your email is entirely optional: nothing on this site requires it.
Who processes it
Email delivery and the subscriber list are handled by Resend, acting as our processor. This may involve a transfer to the United States, covered by the applicable safeguards (EU-US Data Privacy Framework or Standard Contractual Clauses). Hosting and the database are provided by our infrastructure vendors, also acting as processors. We never sell your data, never use it for advertising, and never share it with anyone else.
Hosting and server logs
The site is hosted on Vercel. Like any web server, it processes the technical data your browser sends with every request (IP address, user agent, page requested) in order to deliver the pages and to protect the site from abuse. Our host keeps these logs for a short period, and they are never used to build a profile of you. The legal basis is our legitimate interest in running the site securely.
How long we keep it
Until you unsubscribe. After that we keep a minimal record so we do not email you again, and you can ask us to delete it entirely at any time.
Your rights
You can ask us for a copy of your data, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. You can withdraw your consent at any time, which does not affect what we did while it was valid. You can also lodge a complaint with a supervisory authority (in Italy, the Garante per la protezione dei dati personali). Just email hello@openstarterkit.dev: we answer within a month, and there is no form to fill in.
We never use your data for automated decision making or profiling.
Unsubscribing
Every email has a one-click unsubscribe link that takes effect immediately.
Analytics
We use Vercel Web Analytics to understand how visitors use this site (pages viewed, referrer, country, browser). The service is cookieless: it does not set any cookie, does not store your IP address, and does not track you across sites. Data is aggregated and cannot identify you personally. The legal basis is our legitimate interest in improving the site.
Cookies
This site sets only technical cookies. Under Article 5(3) of the ePrivacy Directive and the Italian rules that implement it, these need no consent, because they are strictly necessary to deliver the site you asked for. That is why you see no cookie banner: there is nothing here to consent to.
| Cookie | What it does | How long it lasts |
|---|---|---|
__Host-authjs.csrf-token | Security token that protects the site's forms against cross-site request forgery | Session, deleted when you close the browser |
__Secure-authjs.callback-url | Remembers which page to return to after a sign-in attempt | Session, deleted when you close the browser |
Both are set by this domain. Their __Host- and __Secure- prefixes are a
browser-enforced rule: they can only be set over HTTPS by this exact site.
Neither holds personal data, and neither can be read by anyone else.
Your theme preference (light or dark) is kept in your browser's local storage and never leaves your device. There are no analytics, advertising or third-party cookies anywhere on this site, and nothing follows you from one site to another.
The demo
demo.openstarterkit.dev is a live demo of the kit, running as a separate
deployment on fixture data. Signup, magic link, contact and newsletter forms
are switched off there, and signing in with Google or GitHub is disabled: you
get in with one click as a shared demo account, so none of your personal data
is collected. Payments run in Stripe test mode and accept test cards only, so
no real card details can reach it. The demo sets the same technical cookies
described above. Once you are signed in to its dashboard it adds a third one,
__Secure-authjs.session-token, which keeps that session alive for up to 30
days. It identifies the shared demo account you are using, not you, and it is
strictly necessary for the same reason: without it the dashboard cannot know
you are signed in.
Because it collects nothing about you, the demo ships the kit's own placeholder policy, the same one you customize for your product.
Changes
We will post any update to this policy on this page, with a new date at the top.