Privacy

Privacy policy

This page explains what the public Featlet website does now and how it connects to the Featlet application.

Last updated: 13 August 2026

The public website

The public website explains Featlet, links to the app, and offers email signup when signup is available. It sends signup details only to the Featlet app.

The public website does not save a theme choice, form draft, or other information in cookies, local storage, session storage, IndexedDB, Cache Storage, or a service worker.

Website visit reports

Featlet uses Plausible to count visits to the homepage and this privacy page, including their regional English versions. Plausible receives the address of the page you open and the address of the page that referred you. Featlet does not send email addresses, signup choices, or anything entered in the signup form to Plausible.

Plausible does not use cookies or save analytics information in your browser. Blocking it does not change the page, its links, or any later signup action. Only authorised Featlet staff can access these reports, which are kept according to Featlet's reviewed retention settings.

This policy explains how Featlet collects, uses, stores, and shares personal information across the public website, the app, hosted pages, widgets, email signup, and support. Personal information means information about an identifiable person.

Who we are and our role

Featlet is an online feedback and feature-voting service operated by Wayne Koorts in New Zealand. Wayne Koorts is the data controller for the public website, Featlet accounts, email signup, platform security and operation, and support correspondence.

Product owners decide why customer content, feedback, and votes are collected through their hosted pages and widgets. For those activities, the product owner may be the data controller and Featlet handles information to provide the service on the product owner’s behalf. A product owner’s own privacy information may also apply.

Where personal information comes from

Featlet receives information:

directly from you when you request early access or product updates, sign in, submit or manage content, vote, or contact support;
from Google when you choose Google sign-in;
from product owners and administrators when they configure a product, publish content, or manage team membership; and
from use of the service, such as timestamps, account and product relationships, votes, delivery results, and limited information needed for security, moderation, and reliable operation.

Featlet does not buy personal information or build advertising profiles from third-party data.

Personal information we collect

When you request early access, product updates, or both, Featlet keeps your email address and the choices you made. We send an email to check that the address belongs to you. Early-access or product-update email starts only after verification and while that option remains available. We do not infer or preselect product updates.

The verification link expires 24 hours after it is issued. A separate removal link applies only to your current signup, so changing a pending signup makes older links unusable. Opening either page does not change anything by itself. Until removal is available on that page, you can ask support to delete your complete signup.

An unverified signup and the record used to send its verification email are kept for no more than seven days. A verified signup is kept while at least one requested email option remains active, or as otherwise needed to handle your request or meet a legal obligation. Complete deletion removes the email address and all its signup choices; Featlet does not keep a marketing profile merely to remember the deletion.

The email provider temporarily processes the address, message, and limited delivery information needed to send verification email. Featlet removes the protected recipient and message content from its completed delivery record. The provider keeps its own delivery records according to the retention settings Featlet has reviewed. Deleted information may remain in rotating backups until those backups expire, but it is not restored as an active signup during recovery.

If you sign in with Google, Featlet receives a provider identifier and may receive your email address and display name. We use this information to create and secure your account and associate it with your product memberships and activity.

Product and feedback data

Product owners and administrators provide product names, lists, feature requests, statuses, branding, policies, team membership, and status updates. People using hosted pages or widgets may provide feature-request titles and descriptions. Content deliberately published on a hosted page is public.

Voting, moderation, and abuse-prevention data

Featlet records accepted votes, their time, and either the signed-in account or a privacy-protecting code created from an anonymous voting value. For anonymous voting, Featlet also creates a limited code from network information and records the general browser family to prevent abuse. Vote records do not keep the raw IP address or full browser identification string.

Feature-request submissions may be checked for spam and abuse using content patterns such as many links, repeated characters, or a recent duplicate. Rate limits and, when required, a Cloudflare Turnstile security check protect public actions. These checks may require another security step, prevent an action, or keep a feature request hidden for human review. They do not make decisions that have legal or similarly significant effects on a person.

Browser storage, connection, and service data

Featlet uses purpose-limited browser storage for sign-in security, account sessions, anonymous voting, and navigation. The application-owned browser-storage page lists exact names, purposes, scopes, and lifetimes. The public website does not save signup drafts, retry details, or theme choices in browser storage.

Normal network requests expose connection information such as an IP address, request time and destination, and browser or network headers to the providers that deliver and protect the service. Featlet may keep limited records of whether a request succeeded, a reference number used to connect related events, and error information needed to secure, operate, and troubleshoot the service. Operational logs do not include form bodies, email-signup addresses or choices, protected email links, or security-check values.

Support correspondence

If you contact support, Featlet and the email providers involved process your sender address, message, any attachment you choose to include, and the reply history. Please do not include personal information that is not needed for the request.

Your choices when providing information

Email signup is optional. Without an email address, Featlet cannot send the verification, early-access, or product-update email you request.
Google sign-in is optional, but its provider identifier and required sign-in information are needed to create or use a signed-in Featlet account.
Providing a feature request or vote is optional. Required fields and security steps must be completed before Featlet can record the action.
Contacting support is optional. Featlet needs a return address and enough information about the issue to reply or act on a request.

What we do not use

Featlet does not sell or rent personal information, use cross-site advertising storage, or add advertising or marketing trackers. The public website visit reports described above never include signup addresses or choices.

How we use personal information

Provide sign-in, account access, product management, publishing, feedback, voting, and requested email signup.
Apply product membership, authorisation, email-signup choice, and security rules.
Remember and deduplicate votes and show signed-in people their voting history.
Check submissions, prevent fraud and abuse, and protect against cross-site requests and other security threats.
Answer support and privacy requests.
Operate, troubleshoot, protect, and improve the reliability of the service.
Meet legal obligations and respond to valid legal requests.

Legal bases for processing

Depending on the activity and your location, Featlet processes information to provide a service or take a step you requested, with consent where required, to meet legal obligations, and for legitimate interests in providing, securing, troubleshooting, improving, and protecting the service and legal rights. We consider those interests against the rights and reasonable expectations of the people affected. Where processing relies on consent, withdrawing it does not affect processing that was lawful before withdrawal. Removing an email signup deletes the complete signup, including any early-access request and product-update choice.

When data is shared

Google processes information when you choose Google sign-in, under Google’s own privacy terms.
Railway hosts the Featlet app and its database and processes data on our behalf.
Cloudflare delivers and protects the public website and provides the Turnstile security check when a feature-request or email-signup action requires human verification. Featlet does not send the form draft or signup details to Turnstile.
Resend sends Featlet’s transactional email and may temporarily process the recipient address, message, and delivery information needed for that purpose. Featlet does not add a signup to a provider mailing list in this flow.
Email providers process support correspondence as needed to deliver the message and reply.
Product owners and the public can see customer-authored content and vote counts when a product owner publishes a hosted page. Management-only identity, security, and abuse data are not published.
Personal information may also be disclosed where required by law or needed to protect legal rights.

Featlet does not give providers permission to use personal information for unrelated advertising or marketing.

International processing

Featlet is operated from New Zealand. Google, Railway, Cloudflare, Resend, email providers, or their infrastructure providers may process information in other countries. Where applicable, we rely on the provider’s contractual and legal transfer safeguards.

How we protect information

Featlet uses reasonable technical and organisational safeguards appropriate to the information and risk. These include access restrictions, sign-in and permission checks, protected network connections, protected short-lived links and security values, restrictions on which websites may send requests, logs limited to information needed for their stated purpose, and controlled backups. Access is limited to people and providers that need the information for the purposes described here.

No internet service can guarantee absolute security. If a privacy breach is likely to cause serious harm, Featlet will notify affected people and the New Zealand Office of the Privacy Commissioner when required by law.

How long we keep other data

Account, product, membership, feedback, publication, voting, moderation, and related security records are retained while needed to provide, secure, and maintain the service or meet legal obligations. We assess deletion requests against those needs. Security backups and protected encryption keys may be retained longer where required to recover or decrypt still-valid service data.

Support correspondence is kept while needed to answer the request, resolve related issues, protect legal rights, or meet legal obligations. Limited service and provider records are kept only while needed for security, troubleshooting, delivery, and reliability, according to the retention settings that apply to them.

Browser lifetimes are more specific: the account authentication ticket has a 14-day sliding lifetime, Google sign-in security cookies last about 15 minutes, and the anonymous-voter cookie lasts up to 365 days. Clearing a cookie does not automatically delete the corresponding server record.

Your privacy rights and complaints

Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a copy of your personal information, and to object to some processing. Where applicable, you may also have a right to data portability. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. We may need to verify your identity before acting on a request.

Please contact Featlet first at [email protected] so we can try to resolve your request or concern. If a New Zealand privacy concern remains unresolved, you can complain to the Office of the Privacy Commissioner. You may also complain to a privacy or data-protection authority that has jurisdiction where you live.

Children’s privacy

Featlet is not directed to children under 13, and we do not knowingly offer accounts to them. Contact us if you believe a child has provided personal information so we can assess and address it.

Changes to this policy

We may update this policy when Featlet’s features, service providers, or legal obligations change. We will publish the revised policy here and update the date above. If a material change affects optional browser storage or how information is used, Featlet will ask for a fresh choice before enabling it.

Contact us

Questions, privacy requests, and complete email-signup deletion requests can be sent to [email protected].

Read about browser storage in the Featlet application.