Privacy
Not Rest Inc. · Last updated November 8, 2026
The short version
osact.com is a static site. It has no accounts and it sets no cookies of its own; its one form is the product waitlist — on the home page and on each product page — described below, with the one confirmation it sends. We don't build profiles of visitors and we don't sell data — there is essentially nothing to sell.
What is processed
Our sites are served by Cloudflare, which processes technical request data (such as IP addresses and user-agent strings) to deliver pages and protect them from abuse. That processing is standard for any site behind a CDN and is governed by Cloudflare's own privacy documentation.
If you email us — for example at [email protected] — we receive what you send and use it to reply. We don't add you to lists you didn't ask for.
The spine (the visit's receipt, bottom-left) can remember your visit in your browser's own storage — which pages you opened and what the chat did, never what you typed — so the site can pick up where you left off next time; nothing is sent, no cookie is set, and a "forget this device" line in the spine erases it. The chat ("Ask the field", bottom-right) replies to what you type. Answers are generated by a hosted AI model through the Anthropic API; your messages are processed to answer you; the words are not recorded by the chat — no content logs, no persistence.
Waitlists
OSACT opens a few people at a time, product by product. When you press "join the waitlist" — on the home page or on a product's page — or enter an invitation code, we store, in this site's own database: your email address, the products you chose, a note if you write one, whether you are listed or invited, the invitation code you used, and when you joined. To limit repeated attempts (five an hour from one connection, thirty an hour from one network), we also keep one-way hashes of your connection and of its network, made with a secret key, in a separate record of attempts — never beside your email address. They are used for nothing else, and they are deleted once they are a day old. We never store your IP address itself. Nothing is stored until you press.
We use it for one thing: to write to you when a place opens on a product you chose, or, if you hold an invitation, to let you in. It is not a marketing list, it is never sold or shared, and no outside form service ever sees it. We keep it for 12 months, or until you ask us to delete it: 12 months after you last joined a product's waitlist, that entry is deleted when later requests to the waitlist arrive (the deletion runs then, a bounded number at a time), and it is removed sooner by the removal link in your confirmation, or if you write to [email protected] from that address.
Waitlist mail
When you join a waitlist we send one confirmation to the address you typed — from OSACT <[email protected]>, with replies going to [email protected]. It says which waitlists you are on (or, with a valid invitation, that you are in) and carries one link: a removal link. It has no images and no tracking, and it is sent only when a join adds the address to a list it was not already on — at most once a day, and three times in 30 days, to one mailbox (addresses that differ only by a +tag, or by dots in a Gmail address, count as one mailbox). An address with a name, a group or several recipients in it is refused. So is an address whose domain is not plain ASCII letters, digits and hyphens — no internationalised (non-Latin) domain, no IP address, no trailing dot; if that is yours, write to [email protected]. The removal link works once, for 365 days: opening it shows a page with one button, and pressing that button deletes every waitlist entry of that address. After that nothing is ever sent to that mailbox again: if the address is entered on a waitlist again, the entry is kept but no mail follows — we keep a one-way hash of the mailbox, made with a secret key, for that purpose alone. The link's secret sits after the # in the link, which a browser never sends to any server. Otherwise we keep only a one-way hash of the link's secret, the address, and when we last wrote to it — for 365 days, or until you use the link — and one-way hashes of the mailbox for 30 days, to hold the limits.
Once a day we also send ourselves, at [email protected], a summary of the day's new entries — each address, the products it chose, whether it is listed or invited, and the start of its note. Both mails pass through Cloudflare's email service. Nothing else is ever sent to a waitlist address until a place opens.
Sibling projects
Links on osact.com open OSACT Applied (osact.ai), which runs its own platform and has its own privacy terms where it collects more than this site does.
Changes
When the platform gains features that touch personal data, this page will change first, with the date above updated. Material changes will be visible here before they take effect.
Terms
The legal terms of use live at osact.com/terms — the two documents together are the whole of what governs your use of this site.
Contact
Privacy questions: [email protected] · Not Rest Inc., 3200 Park Center Dr, 14th Floor, Costa Mesa, CA 92626.
Text messages
If you text our business number, we collect your phone number and the messages you send, and we use them to answer you. Mobile information is never shared with third parties or affiliates for marketing or promotional purposes. We keep a record of opt-outs. Answers are generated by a hosted AI model through the Anthropic API; your messages are processed to answer you and transcripts are kept for support. Text STOP at any time to end messages, START to resume, HELP for help.