hookmeapp.com at this site.
HookMeApp, Inc. ("HookMeApp," "we," "us") is a Delaware corporation. We operate hookmeapp.com (the "Site"). This Privacy Policy explains what personal information we collect, the categories and sources under California law, why we collect it, how we use and disclose it, how long we keep it, and the rights you have. It covers the Site as it exists today — a pre-launch waitlist for our Chicago launch. It does not yet cover booking, payments, or pro profiles, which will be added before launch and will require an updated policy.
1. Information we collect
We collect only what you type into the waitlist form, plus the limited technical data Cloudflare needs to tell a human from a bot and to throttle abuse. In the 12 months preceding the Last Updated date, we have collected the following categories of personal information as defined in Cal. Civ. Code § 1798.140(v)(1):
| Category (CCPA label) | What it is here | Collected? |
|---|---|---|
| A. Identifiers | Name, email address, IP address | Yes |
| F. Internet / network activity | Turnstile token, rate-limit counters (rl:{ip}:{hour}) — IP address is listed under Identifiers (A) and collected once via CF-Connecting-IP | Yes — from Turnstile + anti-abuse throttle |
| Other information you provide | Neighborhood (optional free-text/select) | Yes, if you provide it |
| B–E, G–K, and sensitive PI ( | Commercial, biometric, geolocation, professional, education, inferences, SSN, precise location, etc. | No — we do not collect these |
Turnstile adds one more data point at submit time: a one-time Turnstile token and your IP
address, sent server-side to https://challenges.cloudflare.com/turnstile/v0/siteverify
to verify you are human. Cloudflare may use cookies or local storage (e.g.,
_cfTurnstile*) to remember that you passed the check. See
Cloudflare's Privacy Policy.
We do not use Turnstile data for advertising.
2. Sources
- Directly from you — the waitlist form (name, email, neighborhood, and your agreement to these terms).
- Automatically — Cloudflare Turnstile and our Pages Function read your IP address (
CF-Connecting-IP) to verify the bot check and to enforce a per-IP rate limit.
3. Why we collect it — business and commercial purposes
- Maintain the waitlist and notify you when we open your neighborhood (founding-neighbor badge).
- Prevent spam, abuse, and duplicate signups — throttle by IP and dedupe by email.
- Operate, secure, and improve the Site.
- Comply with law and enforce our Terms.
We do not use waitlist information for cross-context behavioral advertising or profiling.
4. Selling, sharing, and disclosing — preceding 12 months
We do not sell or share your personal information.
- Sale/share (Cal. Civ. Code § 1798.140(ah)/(ah)(2)): In the 12 months preceding the Last Updated date, we have not sold or shared personal information, as those terms are defined by the CCPA. We have no actual knowledge that we sell or share the personal information of consumers under 16 years of age.
- Disclosed for a business purpose
(§ 1798.140(ah)(1)) : In the same 12-month period, we disclosed Identifiers and Internet/network activity to Cloudflare, Inc. as a service provider / contractor to provide bot protection (Turnstile) and data storage (KV). The business purpose is operating the waitlist and securing the Site. - Categories disclosed to Cloudflare: Identifiers (name, email, IP) and Internet/network activity (IP, Turnstile token, rate-limit counters).
We do not disclose personal information to any other third party except as described in § 10.
5. Sensitive personal information
We do not collect sensitive personal information as defined in § 1798.140(ae) (such as government IDs, financial account + credentials, precise geolocation, racial/ethnic origin, or contents of communications). We therefore do not use or disclose sensitive PI for purposes beyond those permitted in 11 CCR § 7027(m), and there is no right to limit to exercise.
6. Retention
- Waitlist entries (name, email, neighborhood,
createdAt, consent timestamp/version, IP address) — stored in Cloudflare KV with no automatic expiry, until you ask us to delete them, until we export and clear the list around launch, or until we delete them to comply with law. Email is the key; lowercased. - Rate-limit counters (
rl:{ip}:{hour}) — stored in the same KV namespace, auto-expire after 2 hours (expirationTtl: 7200). - Turnstile verification — the token is single-use and 5-minute-lived; we do not store it after the
siteverifycall.
7. Your rights
Depending on where you live, you may have the right to:
- Know — what categories and specific pieces of PI we have collected, sources, purposes, and third parties.
- Delete — ask us to delete PI we collected from you, subject to exceptions (e.g., security, legal compliance).
- Correct — ask us to correct inaccurate PI we maintain.
- Opt out of sale/share — where applicable. Because we do not sell or share PI, there is no sale/share to opt out of. We describe how to signal this below anyway.
- Limit use/disclosure of sensitive PI — not applicable because we do not collect or use sensitive PI beyond § 7027(m).
- Non-discrimination / non-retaliation — we will not discriminate or retaliate against you for exercising CCPA rights, including if you are an employee, applicant, or contractor exercising them.
California residents also have the right to use an authorized agent (see § 8). If we deny a request in whole or part, you may appeal by replying to our response.
8. How to exercise your rights
Methods
Email admin@hookmeapp.com from the address on the waitlist entry. Put "Privacy Request — [Know / Delete / Correct]" in the subject and include the email address you used to sign up.
Verification
We verify by matching the email address in your request to the lowercased email key in KV. If we cannot verify, we will explain why and may ask for one additional piece of information you provided (e.g., name or neighborhood) to confirm control of the address. We do not require you to create an account.
Authorized agents
An authorized agent may submit a request on your behalf by emailing from their own address and attaching (a) your signed written permission naming the agent and (b) proof of the agent's authority. We may still contact you directly to verify.
What to expect
We will confirm receipt within 10 business days and respond within 45 days (with a possible 45-day extension where permitted, which we will tell you about). There is no fee unless a request is manifestly unfounded or excessive.
Contact for questions
Same address as above — admin@hookmeapp.com (the channel through which we primarily interact with consumers). You can also call +1 773 888 1177.
9. Opt-out preference signals (GPC) and Do Not Track
We do not sell or share personal information for cross-context behavioral advertising, so an opt-out preference signal (such as Global Privacy Control) has no sale/share to suppress. We treat a GPC signal as a valid request to opt out of any future sale/share and we process it in a frictionless manner — it applies to the browser/device sending the signal. We also honor Do Not Track; because we run no advertising trackers, DNT changes nothing about how we treat waitlist data.
10. Cookies and tracking
We run no analytics and no advertising trackers of our own. The only storage set on the waitlist page is from Cloudflare Turnstile (cookies/local storage such as _cfTurnstile*) to remember that you passed the bot check. Turnstile is governed by Cloudflare's privacy policy above. No other cookies are set by the Site today.
11. Who we share with — and who we do not
We disclose PI only to:
- Service providers / contractors: Cloudflare, Inc. (Turnstile bot protection; KV storage). Bound by contract to use the data only to provide the service.
- Legal/safety: if required by law, court order, subpoena, or to protect rights, safety, or the integrity of the Site.
- Business transfer: if HookMeApp is involved in a merger, acquisition, or asset sale, we will notify you before your PI is transferred and becomes subject to a different policy.
12. Security and international transfers
We use reasonable administrative, technical, and physical safeguards — including Cloudflare's infrastructure controls and a bearer-token-gated admin endpoint for exports. No system is perfectly secure. Data is stored in the United States on Cloudflare's network; if you access the Site from outside the U.S., you consent to that transfer and processing.
13. Children
The Site is not directed to children under 16, and we do not knowingly collect PI from children. We have no actual knowledge that we sell or share PI of consumers under 16, and we do not knowingly sell or share it. If you believe a child has submitted PI, contact us and we will delete it.
14. Changes to this policy
We may update this policy. We will post the updated version here and revise the Last Updated date. Material changes that affect waitlist data will be notified by email to the address you provided, where required by law. Continued use after changes means you accept the updated policy.
15. Metrics (11 CCR § 7102)
We are not currently subject to the CCPA data-broker / large-processor metrics reporting in § 7102 (we handle far fewer than 10 million California consumer records). If that changes, we will publish the required metrics or a link to them here.
16. Contact
HookMeApp, Inc. — Delaware corporation
Email: admin@hookmeapp.com
Phone: +1 773 888 1177
Mail: contact us by email for our registered-agent mailing address.
For privacy requests, use the subject line "Privacy Request" so we can route it quickly.