What this release keeps, which is nothing you typed

The public Captay site is a set of static pages. It does not open an account, does not set a tracking cookie for a marketing profile, and does not provide a form handler. The launch form validates an email address in your browser. The address is not included in a request body, because the form does not submit.

What the application does not collect

• No account name, because there is no account.
• No API key, seed phrase, or exchange password. There is no field for them.
• No waitlist row. A passed check is a message on the page, not a record.
• No analytics event added by this codebase. If you run a blocker, there is no Captay tracker for it to find.

A host that serves the files may keep ordinary request logs, such as an address, a time, and a path. That is a property of web hosting, not a Captay profile. This application does not add a second log of people who considered the form. It cannot show you a copy of an address you typed, because it never received one.

What a later release might store

Two stores are contemplated and not built. The first is an email address for a notice when the cabinet opens, kept only for that notice and deletable when a contact channel exists to receive the deletion. The second is an API key, stored encrypted, used to trade under the limits, and useless for withdrawal if you created it that way. Neither store has a table, a key-management story you can audit today, or a retention clock that is already running.

Encryption in that future sketch means the key is not sitting in a notebook of plaintext on a server you cannot see. It does not mean the key is safe from a bug that uses it to trade. Trading is the point of having the key. The privacy property is about custody of the secret, not about the market risk of the orders the secret can sign.

What will not be asked

Seed phrases, withdrawal whitelists, photographs of identity documents, and copies of exchange passwords are out of scope for the product as designed. A page that requests them is not implementing this note. There is also no sale of a reader list, because there is no reader list. That is a description of the current build, not a certification from a privacy auditor. No such audit is claimed.

Until a contact channel exists, there is no address at which to file a privacy request, and also nothing in this application to correct. The useful action today is to avoid typing secrets into the form. The form's own confirmation is the whole of the processing.