Privacy Policy
This policy covers the smughal.com website and the waitlist you can join on it. It is short because the site does little: it describes what SMughal Labs does, and it lets you leave an email address so we can tell you when a product ships.
The Suhbah mobile app has its own, much longer policy, because it handles far more data. If you are looking for that one, it is at suhbah.app/legal/privacy.
1. Who we are
This site is operated by SMughal Labs LLC, a New Jersey limited liability company (“SMughal Labs”, “we”, “us”). We are the controller of the personal information described here. Reach us any time at privacy@smughal.com.
2. What we collect
Waitlist signups
If you enter your email address into a waitlist form, we store:
- the email address you typed;
- the source — which page or product the signup came from, so we email you about the right thing; and
- the referring URL your browser sent, so we can tell which pages bring people in.
That is the whole record. We do not ask for your name, your employer, or your phone number, and there is no hidden profiling behind the form.
Technical data
Our hosting provider records ordinary web-server data when you visit — your IP address, user agent, the URL requested and the time. We use it to keep the site up, debug problems, and stop abuse. The waitlist endpoint also uses your IP address to rate-limit submissions, so one bot cannot flood the list. Your IP address is not stored in the waitlist record.
Your IP address indicates your approximate area — usually your city. We do not use it for anything except security, abuse prevention and debugging, and we do not build a profile or a location history from it.
Email you send us
If you email us, we keep the message and your address so we can reply and keep track of the conversation.
3. How we use it
- To tell you when a product is ready. That is the only reason the waitlist exists.
- To answer you when you get in touch.
- To keep the site working and secure — availability, debugging, abuse and rate limiting.
- To understand which pages work, using aggregate, cookieless analytics (section 7).
We do not sell your personal information, and we never will. We do not share it for cross-context behavioral advertising, we run no advertising, and we do not use your data to train machine-learning models for anyone outside SMughal Labs.
4. Who we share it with
Only the service providers that run parts of this site for us, under contract and only for the purposes we set:
| Provider | What they do | What they get |
|---|---|---|
| Vercel | Hosting and cookieless web analytics | Request metadata, IP address, user agent, page views |
| Supabase | The database the waitlist is stored in (hosted in the United States) | Your email address, signup source and referring URL |
| Resend | Sends our email, including the notice that tells our team a signup arrived | Your email address and the contents of the message |
We may also disclose information where we reasonably believe the law or valid legal process requires it, or where it is necessary to prevent fraud or imminent harm. If SMughal Labs is ever acquired or merged, your information may transfer as part of that deal, and we will say so before it becomes subject to a materially different policy.
5. How long we keep it
- Waitlist entries — until the product launches and we have told you, or until you ask to be removed, whichever comes first.
- Server and security logs — a short operational period, then they age out.
- Email — as long as we need it for the conversation and our records.
6. Your privacy rights
Wherever you live, you can ask us to access, correct, delete or export what we hold about you. Email privacy@smughal.comwith “Privacy request” in the subject. We verify the request is really yours, then respond within 45 days, telling you if we need the single 45-day extension the law allows. You may use an authorized agent, with your written permission and verification of your identity. Every marketing email we send also carries a one-click unsubscribe link.
If we refuse a request, you can appeal.Reply to our response, or email the same address with “Appeal” in the subject. We will reconsider and write back within 45 days with our decision and our reasons. If we still say no, we will tell you how to complain to your state Attorney General.
US state privacy laws. If you live in California, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Delaware, New Hampshire, Nebraska, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, Iowa or Utah, you have rights to confirm and access what we process, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale, and profiling with legal or similarly significant effects. We do none of those three things. We collect no sensitive personal information through this site — no precise geolocation, no government identifiers, no biometrics, no health data. You will not be treated differently for exercising any of these rights.
Opt-out preference signals. Because we do not sell or share personal information, a Global Privacy Control signal has nothing to switch off here. If that ever changes, we will treat GPC as a valid opt-out request.
Outside the United States. We operate from the US and our data is stored there. We extend the rights above to anyone who asks. If you are in the EEA, UK or Switzerland, you may also complain to your national data protection authority — we would appreciate the chance to put it right first.
7. Cookies and analytics
This site sets no advertising cookies and does no cross-site tracking. There is no consent banner because there is nothing to consent to.
We use Vercel Web Analytics to count page views and see which pages people find useful. It is cookieless and does not follow you across other websites. It reports aggregate numbers to us, not a profile of you. If you would rather not be counted, browser tracking-protection and content blockers stop it, and nothing on the site breaks when they do.
8. Security
Traffic is encrypted in transit with TLS and data is encrypted at rest. The waitlist table sits behind row-level security in the database, so it cannot be read from the browser. Our forms carry rate limiting and bot traps. No service can promise perfect security, and we will not pretend otherwise — if a breach affects your personal information, we will notify you and the relevant regulators as the law requires.
If you are a security researcher and you find a vulnerability, please report it to security@smughal.com rather than exploiting it. We appreciate good-faith disclosure and will not pursue researchers who follow it.
9. Children
This site is for adults and is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child has given us information, email us and we will delete it.
10. Changes
We will update this policy as the site changes. When we make a significant change we update the version stamp at the top of this page. Material changes will be announced here before they take effect.
11. Contact
SMughal Labs LLC
Email: privacy@smughal.com
Please put “Privacy request” in the subject line so it gets routed quickly.
See also our Terms of Use.