Privacy
ThroatVoices collects only the data needed to send you the blend you asked for and to notify you when it ships. We don’t run third-party analytics, advertising pixels, or marketing trackers — and we never sell or share your information.
What we collect
ThroatVoices collects the data you give us when you sign up for a waitlist, request a coach trial shipment, or buy a pre-order. We do not collect anything else — no browsing history, no third-party trackers, no advertising profiles.
Pre-launch waitlist (preorder_waitlist). Captured by the form on the Vocal Guard page (/vocal-guard) and the homepage Reserve-a-spot form. Fields: email, referral_source, created_at. Used only to notify you when the first batch of ThroatVoices is ready to ship.
Blend waitlist (waitlist). Captured by the email modal on /shop when you select a specific blend. Fields: email, blend, created_at. Used to send a notification when your selected blend is back in stock.
Vocal coach trial shipments (coach_requests). Captured by the intake form at /coaches when a vocal coach requests a complimentary starter pack. Fields: name, email, primary_platform, follower_count, voice_specialty, shipping_address, created_at. Used to qualify the request and ship the trial pack.
Paid pre-orders (orders). Captured on Stripe checkout success when you return to /api/payment/success from one of the four blend payment links. Fields: email, blend, amount, stripe_payment_link_id, status, created_at. Stripe itself processes the card payment — your card number, expiry, and CVV never touch our database.
Lawful basis for every field above is consent at form submission — you provide it voluntarily, you can withdraw it by requesting deletion, and we keep the data only as long as we need it for the purpose you gave it for.
Cookies & analytics
ThroatVoices does not use third-party analytics, ad pixels, or marketing cookies. We do not load Google Analytics, Meta Pixel, TikTok Pixel, Hotjar, or anything similar.
The only thing the site sets is a single anonymous visitor id in your browser’s localStorage. On your first visit, a uuid called polsia_vid is written under localStorage. On every subsequent page view, a 1×1 pixel request fires to https://polsia.com/api/beacon/pixel with that id and the site slug. This is a basic visitor counter — it tells us how many unique sessions the site has, and nothing else.
The polling snippet is also rendered inline in home.ejs and shop.ejs so the beacon fires on those views even when the shared layout partial is bypassed. The id is stored only in your localStorage, never in a cookie, and never shared with another domain.
You can clear the polsia_vid entry at any time from your browser’s developer tools; doing so simply starts a new uncounted session on your next visit.
How we use it
Every piece of data we collect has one job: getting a ThroatVoices pouch into the hands of the person who asked for one, or letting them know it’s on the way.
Transactional email. We send order confirmations and waitlist notifications via the Polsia email proxy (services/email.js → sendEmail). The email addresses captured on each form (waitlist, coach_requests, orders, preorder_waitlist) are registered as contacts via registerContact(email, source) so we can reach you when there’s a launch or shipment update.
Fulfillment. Coach shipping addresses and paid pre-order emails are passed to the facility and the shipping provider so the product can reach you.
We do not sell, rent, or share any of this data with marketing partners, data brokers, or social platforms. We do not profile you. We do not run retargeting campaigns.
Third parties
Three external services touch your data in our runtime — each one is listed below along with what it does and what it sees.
Stripe. Handles every payment. Your card details go directly from your browser to Stripe; they never reach our server. We only ever see transaction metadata (amount, payment-link id, status) and the email you entered at checkout.
Polsia. Hosts the application on Render and operates both the analytics beacon at polsia.com/api/beacon/pixel and the email proxy at https://polsia.com/api/proxy/email/contacts and /send. Polsia acts as our data processor under their own privacy terms.
Cloudflare R2. Hosts static brand assets (images, fonts bundled in our own CSS, etc.) at pub-629428d185ca4960a0a73c850d32294b.r2.dev. R2 logs standard request metadata (IP, user agent, referer) in line with Cloudflare’s own privacy policy.
Google Fonts. The site loads the Playfair Display and DM Sans typefaces from fonts.googleapis.com / fonts.gstatic.com on every page. Google may log standard request metadata for font requests; we rely on the published stylesheet, not a third-party CDN analytics call.
Data retention
Waitlist signups (preorder_waitlist, waitlist) are kept until the launch is shipped to every subscriber on the list or until you ask to be removed — whichever comes first. We delete the row from the table within seven days of a verified removal request.
Coach trial-shipment requests (coach_requests) are kept until the trial pack is delivered and the engagement is closed out, plus an additional 12 months for audit and re-engagement. After that the row is deleted.
Paid pre-orders (orders) are kept for the period required by tax and accounting law in the jurisdictions we ship to. We do not delete these rows on request because we have to retain a transaction record, but we can anonymize your email on the row if you ask.
We do not keep backups of deleted rows beyond what our hosting platform’s automatic database snapshots already store; those snapshots are rotated per Polsia’s platform retention policy and are not used to restore removed data.
Contact form entries
When you submit an email to any of the forms above (waitlist, coach application, pre-order checkout), the address is registered with the Polsia email proxy via services/email.js → registerContact(email, source). This is what lets us send you the confirmation or launch email — and it’s the only thing the proxy does with it.
We don’t currently run a separate standalone contact form on a /contact page. If/when we add one, the same registerContact flow will be the capture point and this section will be updated to list it.
Your rights
You can ask us at any time to do any of the following with the data we hold about you:
Access — confirm what we have on file and receive a copy.
Correction — fix a typo in your email or update a shipping address.
Deletion — remove your row from a waitlist or coach request. For paid orders we’ll anonymize the email where the law requires us to keep the row.
Stop email — unsubscribe from the launch notification list without having your row deleted.
Send any of these requests to privacy@throatvoices.polsia.app. We respond within 30 days. If you’d rather use the address listed in services/email.js as the support sender, that one works too — it routes back to the same inbox.
Changes to this policy
If we change what we collect or how we use it, we’ll update this page and bump the last-updated date below. Material changes (anything that broadens what we collect or shares data with a new third party) are also announced in the launch email we send to active subscribers.
This policy was last updated on 2026-08-01.