Privacy

Max is still being built. Right now, the public website collects only what we need to run the waitlist and demo requests, protect those forms from abuse and understand whether people are interested.

What we collect

If you join the waitlist, we collect your email address. You can also choose to give us your first name, postcode, what you're interested in Max for, and a short note about what you'd want Max to help with. We send you a confirmation and send the MAX team a short operational alert with your email address and first name so they can see that someone joined.

If you request a demo, we collect your name and email address. You can also choose to give us a phone number, demo preference, buyer type, organisation, postcode or region, and a short note about what you want to see or solve. Please don’t include health or disability details.

For demo follow-up, authorised MAX admins may also record the strongest reaction, objections, pilot interest, a willingness-to-pay range if discussed, requirements before purchase, the next step and private administrative notes. A request may be linked to existing MAX user, household or device records when useful for follow-up; linking never creates an account or device. These records are used to manage the conversation and assess product readiness.

If you sign in to a MAX account, we collect the email address you use to verify access, a revocable session record and the profile/settings values you choose to save: a preferred name, interaction preferences, spoken confirmations, FIND MAX volume, personality and topics to avoid. These values are stored as structured account data. We do not store the raw onboarding conversation by default.

If you pair a registered MAX, we also store its device identifier and name, the household it belongs to, the pairing-code lifecycle and the capabilities granted to your account. This account path does not track walker location. Voice access is off until you enable it. If you enable it and choose to record a command, MAX sends that short recording to OpenAI for transcription. MAX does not save or log the recording or transcript. A separate audit record links the transcription attempt to your sign-in and the MAX device, and records its outcome, time and a request identifier. It contains no audio, transcript, spoken command or provider usage details. Audit history has no automatic expiry today, so this record may remain as part of that history. Voice can request only FIND or STOP, and MAX checks those device permissions separately.

We may also record basic referral information such as the page that sent you to Max and standard campaign tags in the link. Cloudflare processes technical information needed to serve and protect the site, including Turnstile checks on the forms.

Separately, when voice transcription is requested, MAX stores an operational usage entry with the task, outcome, provider and model, usage-token counts, processing time, estimated cost and timestamp. It may include the MAX device identifier, but contains no recording, transcript or spoken command. The application cleanup policy sets a 90-day window for these usage entries. Production cleanup on that schedule has not been verified, so entries may remain longer. Authorised MAX admins can view aggregate usage. A connected tool with owner-approved diagnostics access can read the last 30 days of aggregate usage for one MAX.

Why we collect it

We use waitlist information to send Max development, testing and availability updates, understand the kinds of people interested in the project, and decide what is worth building next. We use demo-request information to understand the request and follow up manually. Referral information helps us understand how people found Max. Account information is used to authenticate you, apply the settings you explicitly choose to your future MAX experience and record which registered MAX devices you have claimed.

We use technical security information to keep the site working and reduce automated abuse.

Who handles it

The Max website runs on Cloudflare. Form data is stored using Cloudflare D1, and Cloudflare Turnstile helps protect each public form. Resend is used to send waitlist confirmations, operational waitlist and demo notifications, and account sign-in links. Those services process information on our behalf as part of providing the website and email.

We don't sell your information to advertisers, and the launch site does not use advertising pixels or session-replay tracking.

Email and unsubscribing

Joining the waitlist means you're asking us to email you about Max's development, testing and availability. Every update must provide a way to unsubscribe.

If you unsubscribe, we stop sending waitlist updates. We may keep the minimum information needed to record that you unsubscribed so you aren't accidentally added back to an old mailing list. If you deliberately join the waitlist again later, that counts as a new request to receive updates.

How long we keep it

While you're on the waitlist, we keep the information needed to run it. When you unsubscribe, we clear optional name, interest, postcode, note and referral fields, revoke the unsubscribe link and suppress queued waitlist email. We retain your normalised email address and unsubscribe time, along with consent and delivery-status metadata needed to honour and audit that choice. The software supports bounded cleanup of the suppression record and its linked token and delivery records after 24 calendar months, but production cleanup on that schedule has not been verified, so they may remain longer. Provider-managed backups may retain older snapshots for their configured period; those settings and restore behaviour are not verified here. An older snapshot must be checked against later unsubscribe requests before email delivery resumes. Demo requests have no automatic expiry today; authorised admins keep them for follow-up and project evaluation. Session records expire after 30 days or are revoked sooner. In Settings, you can review a deletion preview and request removal of your personal MAX profile and access after recent sign-in and explicit confirmation. This revokes your sessions, device permissions and agent credentials. Shared household memberships and device records remain. You can also submit a verified support request for an operator to prepare an export or remove your personal profile and access after you sign in again. Requests expire after 30 days and can be cancelled from Settings while still pending; completed request records are removed after 90 days. Exports are handled through the existing manual support process and are not emailed by the site. Contact us to ask about access, correction or deletion of other information, including shared household or device records.

Cloudflare Worker request logs are configured to redact query strings, which helps keep sign-in and unsubscribe tokens out of logged request URLs. This applies to new logs and does not remove information from logs already created. Cloudflare controls how long these logs are retained under the account's plan; we have not verified that retention period. If the Max project ends, lead data should be deleted once it is no longer needed to close out the project or meet any legal obligations.

Cookies, analytics and tracking

MAX's application does not send page views, video plays or successful form submissions to a separate analytics service. We don't use advertising pixels or session-replay tracking. Cloudflare still processes technical request and network information to serve and protect the site. Account-level operational metrics and their retention settings have not been verified.

If we ever add materially different analytics or advertising technology, this page needs to change before that tracking goes live.

What about Max the device?

The device is a separate privacy problem, and we're designing it deliberately. The current public marketing website does not collect walker location or listen to a microphone in someone's home. The signed-in account app records only after you enable voice access and choose to start a voice request.

As device features are built, our default direction is: no continuous cloud audio while Max is idle; local wake-word detection where practical; audio sent for processing only after an intentional interaction; location shared only with authorised people; and important memories stored as visible Max data rather than hidden inside an AI provider. Raw audio should not be kept by default.

Those sections of this privacy page must be updated to describe the real implementation before those features are released to users.

Your choices

You can unsubscribe from Max email at any time. If you want to ask what information we hold, correct it or ask for it to be deleted, contact us atmax@loftwah.com.

Changes to this page

If Max starts collecting materially different information, this page should change before or at the same time as the product does. We won't quietly treat a waitlist signup as permission for unrelated data collection.

Last updated: 2026/09/25