Privacy Policy

Effective October 2, 2026

Warpway is AI code review that is still in development. This site runs a waitlist for early access. This policy explains what the site collects, why, and how to change your choices or have your data deleted.

Who we are

Warpway is built by CMG Labs, LLC, 3790 El Camino Real, Unit #593, Palo Alto, CA 94306, USA (“we”, “us”). We are the controller of the personal data described here. For anything privacy related, email marcus@cmglabs.ai.

What we collect

When you join the waitlist

Your work email address.
Optional answers after signing up: your role, team size, where your code reviews happen, how long a pull request waits for its first review, AI reviewers you use, what would make you try Warpway, and your GitHub organization. Every question can be skipped.
Invite links: each signup gets a personal invite code. If you join through someone’s link, we record that they invited you.
Whether you confirmed your email, and when.

About how you reached the site

Attribution data: UTM parameters in the link you followed, the Reddit click ID if you came from a Reddit ad, the referring page, and the page you landed on.
Your country and region, derived from your IP address by our hosting provider.
Your browser’s user agent string (browser and device type).
A keyed hash of your IP address (HMAC-SHA256 with a secret key), used to limit repeated signups and spot abuse. We do not store your raw IP address in our database.
How long the page was open before you submitted, and your cookie choice at that moment. These help us filter out automated signups.

Page-view counts without cookies

Our own analytics records simple events: a page view, first use of the email field, the example review demo starting, or an FAQ answer opening. Each event stores the page, the ad variant and UTM parameters if any, the referring domain, your country, a device type, and a visitor hash computed from the date, your IP address and your user agent with a secret key. The hash changes every day, so we can count daily unique visitors without cookies and without following you from one day to the next.

If your choices allow it, the Reddit Pixel and Microsoft Clarity also run on this site. See “Who helps us run the site” below.

How we use it

To run the waitlist: store your signup, confirm your email, and email you about early access, including your invitation and the occasional question about what you need.
To decide who gets access first: we group signups from the same company by work email domain (not personal providers like Gmail, or throwaway inboxes), and count people who join through your invite link. People who invite others, people who join through an invite, and teammates move up the list. A GitHub organization you tell us about helps us see which teams are interested, but doesn’t change your place. You only ever see counts, never who joined, and we never show your details to the person who invited you or to your teammates.
To decide whom to invite first, using your optional answers.
To measure which ads and messages lead to signups, so we know whether Warpway is worth building.
To see how the page is used and fix what is confusing (Clarity, when allowed).
To prevent abuse: rate-limit signups and filter bots and fake signups.
To answer you when you write to us, and to meet legal obligations.

We do not sell your email address, and we do not use your data to train AI models.

Legal bases (UK and EU)

If you are in the United Kingdom, the European Union or the European Economic Area, we rely on these legal bases under the GDPR and UK GDPR:

Consent for the Reddit Pixel, the Reddit Conversions API and Microsoft Clarity. In these regions they do not run until you choose “Accept”. You can withdraw consent at any time with “Privacy choices” in the footer.
Consent for emails about early access, which you give by submitting the form. You can withdraw it at any time.
Legitimate interests for running the waitlist, planning invitations from your optional answers, cookieless page-view counts, and preventing abuse. We keep this data limited to what the waitlist needs, and you can object at any time.

Who helps us run the site

We share data only with the providers below, for the purposes listed. We do not sell personal data for money.

Provider	What it does for us	Data involved	Location
Vercel, Inc.	Hosting and serverless functions	All data sent to the site, including IP address and request logs	United States
Neon	Database	Waitlist entries and page-view events described above	United States
Postmark (ActiveCampaign, LLC)	Transactional email, if we use it to send the confirmation email	Email address and email content	United States
Reddit, Inc.	Ad measurement through the Reddit Pixel and the Reddit Conversions API. Only when allowed by your choices.	Page visit and signup events, a conversion ID, a hashed (SHA-256) copy of your email address, IP address, user agent, Reddit click ID, and Reddit cookie identifiers	United States
Microsoft Corporation (Clarity)	Session replay and heatmaps. Only when allowed by your choices. What you type into form fields is masked.	Clicks, scrolling, mouse and touch movement, page content, device and browser data, IP address	United States

Reddit and Microsoft also use the data they receive under their own privacy policies. We may disclose data if the law requires it, or as part of a merger or sale of our business, in which case this policy keeps applying to it.

Cookies and similar technologies

Reddit Pixel cookies (such as _rdt_uuid), set only when allowed, to connect a visit and a signup to a Reddit ad.
Microsoft Clarity cookies (such as _clck and _clsk, plus cookies on clarity.ms), set only when allowed, to group page views into a session.
Local storage in your browser: ww_consent remembers your cookie choice, ww_internal marks our own team’s browsers so our visits are left out of the numbers, and ww_ref keeps the invite code from a link you followed for up to 30 days, or until you sign up.
Session storage, cleared when you close the tab: ww_attr remembers how you arrived (UTM parameters, Reddit click ID, ad variant) while you move between pages, and a short-lived signup state lets you finish the optional questions if the page reloads.

Our own page-view counts use no cookies.

Your choices

In the UK and Europe (we tell from your device’s time zone), you see a short banner. Nothing from Reddit or Microsoft loads until you choose “Accept”.
Everywhere, “Privacy choices” in the footer lets you accept or decline at any time. If you decline, we reload the page without the Reddit Pixel and Clarity, we don’t load them on later visits, and we don’t send your signup to the Reddit Conversions API. Cookies they set before you declined stay until you clear them.
Global Privacy Control. If your browser sends a GPC signal, we treat it as an opt-out of sale and sharing: the Reddit Pixel and Clarity stay off and we do not send your signup to Reddit, unless you turn them on yourself in “Privacy choices”.
Clearing your browser’s storage resets your choice.

California residents

This section applies to California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

Categories we collect: identifiers (email address; IP address, which we pass to Reddit when allowed but store only as a keyed hash; Reddit click ID and cookie IDs; a conversion ID); internet activity (pages viewed, referrer, attribution data, user agent, and session replay when allowed); coarse geolocation (country and region); and professional information you choose to give or that your work email shows (role, team size, GitHub organization, company email domain). We collect them from you and your browser for the purposes above. We do not collect sensitive personal information.
Sale and sharing. We do not sell personal information for money. When the Reddit Pixel or Conversions API is allowed, giving Reddit data to measure our ads may count as “sharing” for cross-context behavioral advertising. To opt out, choose “Decline” in “Privacy choices” in the footer, or turn on Global Privacy Control. We do not knowingly sell or share the data of anyone under 16.
Your rights: to know what we collect and how we use and disclose it, and to access, correct or delete it, and opt out of sale and sharing. You or an authorized agent can email marcus@cmglabs.ai. We verify requests through the email address on the waitlist.
No discrimination. We will not treat you differently for using these rights.

UK and EU rights

You have the right to access, correct or delete your data, to restrict or object to how we use it, to get a portable copy, and to withdraw consent at any time. Email marcus@cmglabs.ai to use any of these rights. You can also complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU and EEA, the data protection authority where you live or work.

International transfers

We and our providers process data in the United States. For transfers from the UK, EU or EEA, we rely on the safeguards our providers offer, such as the European Commission’s standard contractual clauses and the UK addendum, or the EU-U.S. Data Privacy Framework where a provider is certified.

How long we keep it

Waitlist entries (email, optional answers, attribution data): until early access launches and for up to 24 months after our last contact with you. If you ask us to delete them sooner, we will.
Page-view events: up to 24 months.
Your cookie choice: in your browser until you change it or clear your storage.

We complete deletion requests within 30 days. Data held by Reddit and Microsoft follows their own retention policies.

Security

The site is served over HTTPS, the database is reached only from our server code, and we store a keyed hash instead of your IP address and only a hash of each confirmation link. Access is limited to the people building Warpway. No system is perfectly secure, and we will notify you and the authorities of a breach when the law requires it.

Children

This site is for professionals and is not directed to children under 16. We do not knowingly collect their data. If you believe a child has signed up, email us and we will delete the entry.

Changes to this policy

If we change this policy, we will post the new version here and update the effective date. If a change materially affects how we use data we already hold, we will email the people on the waitlist before it takes effect.

Contact

CMG Labs, LLC, 3790 El Camino Real, Unit #593, Palo Alto, CA 94306, USA. Email marcus@cmglabs.ai.