Ondar Website & Waitlist Privacy Policy
Last updated: August 30, 2026
Effective date: August 30, 2026
1. Scope and operator
Waystar Communications LLC, doing business as Ondar (“Ondar,” “we,” “us,” or “our”), operates ondar.co and its pre-launch waitlist. This Policy explains the information processed through that website, registration form and related communications.
This Policy does not describe data collection by a released Ondar app or active TestFlight/beta product. We will provide the applicable disclosures before those products begin collecting additional information.
The current registration form does not request health records, HIV/STI status, medications, biometric verification, identity documents or GPS location. However, participation in a dating-service waitlist can itself be sensitive. We do not treat an email address linked to a registration as anonymous.
2. Information you provide
We collect:
- Email address: to manage your registration, communicate about access and respond to your requests.
- City: to understand where people want Ondar to become available and communicate about relevant launch availability. Enter a city, not a street address or precise meeting location.
- ZIP code, if you choose to provide it: to better understand demand within a city as we decide where to launch next. This is optional.
- Referral code, if you arrived through one: to credit and measure referrals.
- Communications and choices: information you send when contacting us, and records of privacy choices and registration notices presented to you.
Please do not send medical information, intimate images, identity documents or other people's personal information through the waitlist or ordinary support email.
3. Technical information and collection timing
Website delivery and security. Our infrastructure receives connection information, including your IP address and browser request headers, to deliver the website and protect the form. Cloudflare supplies an approximate country, region and city derived from IP information. This is not GPS tracking and can be inaccurate.
Registration processing. When you submit the form, we process the submission timestamp, a form submission identifier, browser and device information derived from the User-Agent header, and the result of the anti-bot check. We store a salted SHA-256 hash of the IP address in our waitlist database rather than the raw IP address. That hash is pseudonymous information, not a guarantee of anonymity. Our hosting and security providers necessarily receive network information; the database hashing step does not mean no provider receives your IP address.
Optional measurement. With your permission, we collect page and landing-page information, referring-page information, campaign parameters such as UTM source, medium, campaign, content and term, available Google/Facebook advertising click identifiers such as gclid and fbclid, and Google Analytics client/session identifiers when Analytics is enabled. We also measure form interactions, such as starting a form, elapsed completion time and submission errors. Some measurement therefore occurs before a completed registration, but only after the relevant optional choice. Security and necessary error handling are separate.
Click identifiers indicate a campaign or referral; their presence does not by itself mean that Ondar sends your registration to Facebook or Google Ads. We do not use the waitlist to build advertising audiences or upload customer lists to advertising platforms.
We do not capture the contents of fields as you type for behavioral analytics. Completed registrations and necessary form-event records are stored in our database; optional measurement is governed by your analytics choice.
4. Why we use information
We use the information described above to:
- Operate the website and waitlist, prevent duplicate or abusive submissions and maintain security.
- Understand demand by city and send requested access or launch communications.
- Contact people who volunteer for testing; participation in subsequent research remains voluntary.
- Understand optional survey responses and improve the planned product.
- Measure website performance and campaign effectiveness where you permit optional measurement.
- Respond to questions, privacy requests and legal obligations.
We do not use registration responses to diagnose health conditions, create public profiles, train general-purpose AI models or publish testimonials without a separate, appropriate permission. We do not use sensitive registration information for third-party targeted advertising.
5. Providers and recipients
The website uses the following providers, with different roles and access:
| Provider | Role and information involved |
|---|---|
| Supabase | Stores final waitlist registrations and form-event records, including the information described above that is appropriate to each record and your choices. |
| Cloudflare, including Turnstile | Provides network/security services, IP-based regional information and bot protection. Turnstile processes connection/browser signals; our server sends the verification token and IP address to Cloudflare to verify the challenge. Ondar stores the pass/fail result, not the verification token, in its registration records. |
| Google Tag Manager / Google Analytics 4, when enabled | Tag Manager manages permitted tags; Analytics measures permitted website activity after your analytics choice. Google processes browser/network and measurement information under its applicable terms. We do not send form answers, email addresses or sensitive registration information to Analytics. |
Authorized personnel and contractors may access information as necessary to operate and secure the waitlist or respond to requests. Email infrastructure used to deliver or reply to communications processes the recipient address and message information necessary for that communication. We restrict providers acting on our behalf through applicable service terms and data-processing arrangements.
We may also disclose limited information when legally required, to address security incidents or unlawful activity as permitted by law, or to establish or defend legal claims. A business restructuring or transfer does not authorize disregard of existing privacy commitments or applicable notice and consent requirements.
We do not publish the waitlist or make participants' responses visible to other participants. We do not sell personal information or share it for cross-context behavioral advertising. Service-provider processing described here is not permission for unrestricted independent advertising use.
Provider information: Google Privacy Policy, Cloudflare Privacy Policy, Turnstile Privacy Addendum and Supabase Privacy Policy.
6. Cookies, measurement and privacy choices
Essential website and anti-bot functions operate to provide and secure the service. Optional analytics and campaign measurement are controlled separately. You can accept or reject optional analytics and change your choice using Privacy choices in the website footer. Rejecting analytics does not prevent you from joining the waitlist.
When optional Analytics is enabled, Google may use cookies or similar identifiers to recognize a browser across visits. It may process website activity over time; its broader handling of information is described in Google's Privacy Policy. Our integration does not authorize disclosure of your registration answers or use of the waitlist for cross-site advertising.
A recognized Global Privacy Control signal is treated as a request to disable optional analytics and advertising-related measurement in that browser. Traditional “Do Not Track” signals do not independently change our processing; use Privacy choices to manage optional measurement. These signals are distinct.
Browser settings may also restrict cookies. A preference can be browser-specific and may need to be set again after clearing browser storage. Withdrawal stops future optional collection; contact us separately to request deletion of information already collected.
7. Location of processing
Ondar's website servers and primary waitlist database are hosted in the United States. Providers such as Google and Cloudflare operate international infrastructure and may process information in other countries under their service arrangements. U.S. hosting does not mean every provider operation or access occurs exclusively in the United States.
If applicable law requires safeguards for an international transfer, we use the safeguards required for that transfer. Visiting from another country does not waive your legal rights.
8. Retention
We keep registration information while needed to manage your place on the active waitlist and provide the communications you requested. If you leave the list, request deletion or the waitlist closes, we delete or deidentify information no longer needed for those purposes, subject to applicable legal requirements.
Measurement, diagnostics and security records are reviewed separately. Retention depends on their purpose, sensitivity, whether they remain linked to a person, and whether an unresolved security incident or legal obligation requires preservation. We do not retain optional research or measurement indefinitely merely because storage is available.
We may keep limited records necessary to honor an unsubscribe request, demonstrate a privacy choice, comply with law or resolve a genuine dispute. Such records are restricted to those purposes. Backup deletion follows the applicable backup lifecycle and legal deadlines; a backup restoration must not reactivate a withdrawn marketing preference or defeat an applicable deletion request.
9. Your choices and requests
You can request access to, correction of or deletion of your waitlist information; leave the waitlist; withdraw optional research or analytics consent; or ask a privacy question by emailing privacy@ondar.co. Use the email address you registered with where possible. You do not need an app account.
We may take proportionate steps to confirm that a request concerns your information. Do not send an identity document unless we specifically explain why it is necessary and provide an appropriate method. We respond within the deadlines applicable to the request and explain any lawful refusal or extension.
You can stop promotional emails using the unsubscribe method provided in them or by emailing us. We honor promotional opt-outs within ten business days. Necessary responses to your requests and legally required notices may still be sent.
Depending on your location and applicable law, additional rights may include portability, objection or restriction, opting out of sale or targeted advertising, limiting certain sensitive-data uses, and appealing a denied request. To appeal, email the same address with “Privacy Appeal” in the subject. We will explain our decision and applicable complaint options. We do not unlawfully discriminate for exercising privacy rights.
California residents may have rights under applicable California privacy laws; applicability depends on the law and its thresholds. This Policy itself supplies our website privacy disclosures; there is no separate, unlinked California supplement. We do not disclose waitlist information to third parties for their own direct marketing.
Where European, UK or similar laws apply, necessary registration processing is used to fulfill your requested service, security processing is based on legitimate interests where permitted, optional measurement and optional sensitive research rely on consent, and legally required processing relies on the relevant obligation. You may contact us about the applicable basis or complain to your competent data-protection authority.
10. Adults and security
The website and waitlist are for adults aged 18 or older who meet the applicable age-of-majority requirement. If you believe a minor has registered, contact privacy@ondar.co. We investigate and remove information collected contrary to our age restrictions, subject to necessary legal or security preservation.
We use safeguards appropriate to the information, including restricted database access and measures to protect information in transit. No website is completely secure. Hashing an IP address does not anonymize a registration that also contains an email address.
11. Sensitive information and future products
Our Consumer Health Data Privacy Notice addresses the current website and any information covered by applicable consumer health privacy laws. Being LGBTQ+ or using a dating app does not itself establish a medical condition.
We will update the relevant notices and obtain required permissions before introducing additional data collection for an active beta or app. This Policy does not authorize future health, biometric, precise-location or messaging features merely because they may be planned.
12. Changes and contact
We identify the effective date of updates and provide appropriate notice of material changes. Posting a revised policy or your continued browsing does not replace consent where consent is legally required.
Waystar Communications LLC d/b/a Ondar
Privacy: privacy@ondar.co
Address: 2100 Ponce de Leon Blvd, 111M, Coral Gables, FL 33134, United States