Last updated 19 October 2026
In short
We use your email address only to let you into Nomma, with a code or an invite, and we never share or sell it. If you never get in, we delete it, and if you ask, we delete it right away.
This notice covers joining Nomma on nomma.io (the waitlist, or the code that lets you in), the one form on this site that asks you for anything. The Nomma app has its own privacy notice.
Nomma (Mikke Leskinen, business ID 3376510-6) decides how your data is used, which makes us the controller under the GDPR. For anything in this notice, write to privacy@nomma.io.
When you join the waitlist we store three things:
When we send your invite, we note the date too.
When Nomma is open to everyone, the same form makes your Nomma account straight away instead, and emails you a six-digit code to get in with, so there's no password to choose. If too many people join at once, your address waits on the list, as above.
So that nobody can use the form to flood someone's inbox, we note when each code is sent, with your address scrambled so it can't be read back from the note, and delete the note after two days. Our legal basis for that is our legitimate interest in keeping the form safe (Article 6(1)(f) GDPR).
That's all. We don't ask for your name, and the site sets no tracking or advertising cookies. Like any website, our hosting provider briefly handles technical data such as your IP address to deliver pages and keep them secure.
If you pick a language with the switch at the top of the page, the site remembers it in a cookie on your device (nomma-locale), so it opens in that language next time. The cookie holds only the language.
We also count visits, so we know which posts and ads bring people here. Each visit, and each signup, is counted with only the day, the site, app or campaign link that led here, your country and whether you used a phone or a computer. The count isn't linked to your email address, and it uses no cookies and stores nothing on your device.
To let you into Nomma, and nothing else: to email you a code to get in, or an invite when there's room. No newsletter, no marketing, and we never sell or share your address.
Your consent (Article 6(1)(a) GDPR), which you give by submitting the form. You can withdraw it at any time, and we'll remove your address.
The list lives in our database at Supabase, and the site runs on Vercel. Your code or invite is emailed through Brevo, an email service in France. All three process data for us under data processing agreements, and only we can read the list. If any of them processes data outside the EU/EEA, it's covered by the European Commission's standard contractual clauses.
Brevo counts whether its emails are opened and their links clicked, so the link in your invite passes through Brevo's servers on its way to nomma.io. We've set this counting to anonymous, so it isn't tied to your address, and we don't use it.
Until you get in with your code or your invite, or until you ask us to remove your address, whichever comes first. Once you're in, your address belongs to your Nomma account, which the app's privacy notice covers, and it leaves the list.
If you never type your code, we delete the account it made, with your address, after 7 days. If you don't accept an invite within 90 days, we delete your address and the invite. If we close the waitlist, we delete the whole list.
You can ask us to:
Email privacy@nomma.io from the address you signed up with and we'll reply within a month. You can also complain to your local data protection authority.
If this notice changes, the date at the top changes with it. If a change affects what we do with your email address, we'll ask you again before doing it.