Privacy Policy

§ 01Controller

This privacy policy explains how WithoutBall processes personal data when you visit withoutball.com (the “site”). It is written to meet the information duties of Articles 12–14 of the EU General Data Protection Regulation (GDPR).

Controller within the meaning of Art. 4(7) GDPR: WithoutBall, [postal address — completed before launch]. All inquiries — general, privacy, and data-subject requests — reach us at info@withoutball.com.

A data protection officer has not been appointed, as the statutory thresholds for a mandatory appointment are not currently met.

§ 02At a glance

The site uses exactly one third-party analytics service: Google Analytics 4. It is enabled by default and can be switched off with one click — declining takes effect immediately, expires the analytics cookies, and is remembered; no advertising signals are ever enabled.

Hosting runs on Cloudflare Pages; this produces technically necessary connection logs (IP address, user agent) used solely to deliver and secure the site.

The early-access waitlist stores three things: your email address, your site language, and the page you signed up from — nothing else.

All fonts are served from our own domain. Loading a page triggers no request to Google Fonts or any other font CDN.

§ 03Hosting and connection logs (Cloudflare Pages)

The site is a static website hosted and delivered by Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, served through Cloudflare’s global content-delivery network. When you access the site, Cloudflare processes connection data: your IP address, user agent (browser and operating system), the requested URL, the time of access, and the transferred data volume.

Purpose and legal basis: this processing is required to deliver the site reliably from a location near you and to protect it against attacks and abuse (including DDoS mitigation). The legal basis is Art. 6(1)(f) GDPR — our legitimate interest in the secure, stable operation of the site. The log data is not merged with other data sources and is not used by us to identify individual visitors.

Cloudflare acts as our technical service provider (processor, Art. 28 GDPR) under Cloudflare’s data processing addendum; connection logs are kept by Cloudflare for a short period for security purposes and then deleted. For transfers to the USA, see the international-transfers section below.

§ 04Web analytics (Google Analytics 4 — on by default, opt out anytime)

We use Google Analytics 4 (GA4) to understand, in aggregate, how the site is used. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Analytics is enabled by default and switched off the moment you decline. Unless you have declined, the GA4 script loads with Google Consent Mode v2 configured restrictively: only analytics_storage is granted; the advertising signals (ad_storage, ad_user_data, ad_personalization) remain permanently denied — WithoutBall runs no advertising. A cookie notice on your first visit and the “Cookie settings” control in the footer let you decline at any time.

While enabled, GA4 processes: a pseudonymous client ID (stored in the _ga cookies), the pages you visit, the referrer, an approximate location derived from your IP address, and device and browser characteristics. GA4 does not log or store your full IP address; it is processed transiently to derive coarse geolocation and route the request.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding, in aggregate and without advertising use, how the site is used. You can object at any time with effect for the future (Art. 21(1) GDPR): open “Cookie settings” in the site footer, or the cookie notice itself, and choose Decline. Declining is remembered, stops analytics from loading on every future page view, and expires the _ga cookies immediately.

Google may transfer data to Google LLC in the USA; see the international-transfers section. Analytics event data is retained in Google Analytics for at most 14 months.

§ 05Early-access waitlist

When you join the waitlist, we process exactly three data points: the email address you enter, your chosen site language, and the page you signed up from. We deliberately collect nothing else.

Purpose: to contact you about early access to the WithoutBall platform — launch notifications and early-access invitations. Legal basis: your consent, Art. 6(1)(a) GDPR, given by submitting the form; you can withdraw it at any time with effect for the future.

Processing runs through Google Apps Script: the form submits to an endpoint we operate, and Google (Google Ireland Limited, with possible transfer to Google LLC, USA) stores the data on our behalf as processor within our Google account. See the international-transfers section.

Retention: until the platform launches and the waitlist is dissolved, or until you request deletion — whichever comes first. To be removed at any time, email info@withoutball.com; we delete your entry promptly.

§ 06Contact by email

When you email info@withoutball.com, we process your email address, the content of your message, and any data it contains, in order to handle your request. Legal basis: Art. 6(1)(b) GDPR where the contact relates to a (pre-)contractual matter, otherwise Art. 6(1)(f) GDPR — our legitimate interest in answering inquiries.

Correspondence is deleted once the matter is resolved, unless a statutory retention duty requires keeping it longer.

§ 07Cookies and local storage

The only cookies the site sets are the two Google Analytics cookies below — set by default and expired immediately when you decline analytics. Beyond those, the site uses a small set of functional localStorage entries that store only your own choices and actions on your device, send nothing to any server, and are therefore consent-exempt under § 25(2) no. 2 of the German TDDDG (storage strictly necessary for a service you explicitly request). The complete inventory:

You can change your analytics decision at any time via “Cookie settings” in the footer, and clear all entries through your browser’s site-data controls.

• wb.lang (localStorage) — remembers your site language (EN/TR/DE), whether you picked it in the language menu or it was matched automatically to your browser’s language on your first visit. Lifetime: until you delete it. Functional; no consent required (§ 25(2) no. 2 TDDDG).
• wb.theme (localStorage) — remembers your light/dark theme choice. Lifetime: until you delete it. Functional; no consent required (§ 25(2) no. 2 TDDDG).
• wb.consent (localStorage) — records your analytics decision (your choice, the version of the notice it was made against, and its timestamp) so your opt-out is honored on every visit. Lifetime: until you delete it. Functional; no consent required.
• wb.hintDismissed (sessionStorage) — set when you dismiss the language-suggestion banner so it stays hidden for the rest of your visit. Lifetime: until the browser session ends. Functional; created only if you dismiss the banner.
• wb_wl_ts (localStorage) — the time of your last waitlist submission, used to rate-limit repeated submissions. Lifetime: until you delete it. Functional; created only when you use the waitlist form.
• wb_wl_h (localStorage) — the waitlist duplicate check: a short, non-cryptographic fingerprint (hash) of the address you submitted — not the address itself — so the form can tell you locally, without contacting any server, that you are already on the list. Lifetime: until you delete it. Functional; created only when you use the waitlist form.
• _ga (cookie, set by Google Analytics) — distinguishes visitors via a pseudonymous client ID. Lifetime: up to 2 years. Set by default; expired immediately when you decline analytics.
• _ga_* (cookie, set by Google Analytics) — maintains session state for the GA4 property. Lifetime: up to 2 years. Set by default; expired immediately when you decline analytics.

§ 08Self-hosted fonts

The site’s fonts (Inter and Space Grotesk) are served from our own domain as self-hosted files. Unlike embedding fonts from Google Fonts or another CDN, loading a page here sends your IP address to no font provider. This is a deliberate privacy-by-design choice.

§ 09Recipients and processors

We never sell personal data and use no advertising networks. Personal data reaches only the following processors — and public authorities only where the law requires it:

• Cloudflare, Inc. (USA) — site hosting and delivery via its global CDN (connection logs). Active on every visit.
• Google Ireland Limited (Ireland), with possible transfer to Google LLC (USA) — web analytics. Active unless you decline.
• Google Ireland Limited / Google LLC (Google Apps Script) — waitlist processing and storage on our behalf. Active only when you join the waitlist.

§ 10International data transfers

Where personal data is transferred to the USA — to Cloudflare (hosting) and to Google (analytics unless you decline; waitlist processing when you sign up) — the transfer rests on the European Commission’s adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR), under which both providers are certified. Where the framework does not apply to a transfer, we rely on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with supplementary measures.

§ 11Retention

We keep personal data no longer than the purpose it was collected for requires:

• Connection logs (Cloudflare Pages): a short security window controlled by Cloudflare, then deleted.
• Analytics event data (GA4): at most 14 months, then deleted by Google.
• Analytics, language, and theme decisions: stored only on your device (wb.consent, wb.lang, wb.theme) until you change or delete them.
• Waitlist entries: until launch or until you request deletion via info@withoutball.com.
• Email correspondence: until the matter is resolved, plus statutory retention periods where applicable.

§ 12Your rights

Regarding your personal data, you have the following rights against us under the GDPR:

For analytics you may object at any time with effect for the future (Art. 21(1) GDPR) via “Cookie settings” in the footer — declining stops analytics and expires its cookies immediately. Where processing rests on your consent (the waitlist), you may withdraw it at any time with effect for the future (Art. 7(3) GDPR) via email. To exercise any right, email info@withoutball.com; we answer within one month.

You also have the right to lodge a complaint with a data-protection supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, your workplace, or the place of the alleged infringement.

• Access (Art. 15) — confirmation whether and which of your data we process, and a copy of it.
• Rectification (Art. 16) — correction of inaccurate data and completion of incomplete data.
• Erasure (Art. 17) — deletion of your data where a ground for erasure applies.
• Restriction of processing (Art. 18) — restriction while a matter is contested.
• Data portability (Art. 20) — receipt of the data you provided in a structured, commonly used, machine-readable format.
• Objection (Art. 21) — objection at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f); we then stop unless compelling legitimate grounds prevail.

§ 13No automated decision-making; no obligation to provide data

We use no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

Providing personal data is neither legally nor contractually required to visit this site. Without the technically necessary connection data (IP address) the site cannot be delivered; everything else — analytics and the waitlist included — is optional.

§ 14Changes to this policy

We update this policy when the site or the product changes — for example when the platform launches. The current version, with its effective date, is always published at this address. Where a change affects consent-based processing, we ask for consent anew.

§ 15Effective date and pre-launch status

Effective date: July 9, 2026.

WithoutBall is pre-launch. This policy accurately describes today’s site; a review by qualified legal counsel will be completed before launch, and any resulting changes will be published here.