Privacy Policy
Effective date: November 4, 2026
Slot & Shaft is run by Lawrence Tang. This policy covers what the website does today. When we add new features, we will update this policy before they go live.
What we collect
Pre-cut kit waitlist
If you join the waitlist on a project page, we store:
- your email address;
- the design settings in the page address when you signed up (for example the width, depth and height you chose), so we know which kit you were interested in;
- when you signed up, when we last sent you a confirmation email, and when you confirmed.
We email you once to confirm your address. Only confirmed addresses count toward the waitlist. The confirmation link carries a one-time token; we store only a hash of that token, not the token itself.
To stop abuse, we limit how many signups can come from one IP address per hour. For that we store a hash of your IP address, never the address itself. These rate-limit records are deleted automatically after about two days.
Spam check (Cloudflare Turnstile)
The waitlist form uses Cloudflare Turnstile to tell people from bots. Turnstile runs in your browser, and when you submit the form we send its result and your IP address to Cloudflare to verify it. Cloudflare’s handling is described in the Cloudflare Privacy Policy.
Clicks on seller links
When you click a link to Amazon or MISUMI on our site, or use an “Add to Amazon cart” button, we log the click: the time, the type of click, the seller, the part, the link address and the page you were on. This log does not include your IP address, email or any account identifier.
To stop flooding and double counting, we also keep a short-lived counter keyed by a hash of your IP address. These counters are deleted automatically after about two days.
The click log itself is retained until you ask us to delete it, or until the waitlist is no longer needed.
What we don’t collect
We don’t use analytics or advertising cookies, and we don’t run analytics, tracking pixels or ad tags on the site. There are no user accounts and no sign-in.
Retention
Waitlist entries and the click log are retained until you ask us to delete them, or until the waitlist is no longer needed. Hashed IP counters are deleted after about two days, as described above.
Service providers
The site runs on Cloudflare. Cloudflare hosts the site (Workers), stores the waitlist and click log (D1 database), sends the confirmation email (Email Sending), forwards mail sent to our address (Email Routing) and runs the spam check (Turnstile). We don’t use any other provider to process your data.
Links to Amazon and MISUMI
Our parts lists link to Amazon and MISUMI. Once you leave our site, their cookies and privacy policies apply, not ours.
As an Amazon Associate I earn from qualifying purchases. See our affiliate disclosure.
Your choices and California privacy rights
We do not sell or share personal information, so we don’t offer a “Do Not Sell or Share” link.
You can ask to see the personal information we hold about you, or ask us to delete it. Email hello@slotandshaft.com from the address you signed up with. We may need to confirm the request comes from you.
Contact
Lawrence Tang, Slot & Shaft hello@slotandshaft.com