Remove all email capture; no calendar commitments; state the privacy posture

[fosterstack-admin]

Remove all email capture; no calendar commitments; state the privacy posture

Owner correction, Sep 7: FosterStack never collects email or PII from the
website. For an open product, marketing is launch — there is no access gate
and no email gate to trying it.

REMOVED

• functions/api/waitlist.js, deleted outright. It validated an address and
  wrote {email, timestamp, country} into a Cloudflare KV namespace.
• The signup form on index.html, and a SECOND form on /bcn-removed/ that was
  posting to the same endpoint.
• The inline JavaScript driving both, and the now-dead form CSS.
• Every launch date: "Private beta this October, free. Public launch in
  November", "Pricing at launch", "v1 targeted before the EOL", and the
  invited-beta line in llms.txt.

There are now zero

elements and zero elements on the site.

REPLACED

• Primary CTA is "Try it now": the docker run one-liner, then buttons to the
  quickstart, the migration guide and the source. No gate of any kind.
• "Stay in touch" is GitHub star and Watch -> Releases, framed as what it is:
  a subscription the reader controls and can revoke without asking us.
• The roadmap keeps its direction and loses its dates, and now points at
  GitHub issues as the thing that moves it — which is also true, unlike a
  form reply address that no longer exists.
• An honest maturity label in its place: v0.1, early, nobody running it in
  production but us, bugs and questions to GitHub issues.

PRIVACY POSTURE, worded to survive an audit
A "What we do not collect" section states three things separately, because
they have different bases:

• The product does not phone home. VERIFIED, not asserted — see below.
• This website collects no email, sets no cookies, runs no analytics, and
  loads nothing third-party. True today and now structurally enforced.
• The only personal data the company holds is the minimum to bill a paying
  customer (Stripe) plus voluntary support correspondence, per ToS §2.

It explicitly declines to claim "we never collect any personal data",
and says why: billing requires an email address, and a privacy claim that is
convenient but false is worse than none.

VERIFICATION behind the no-phone-home claim
Source audit: no http.Get/http.Client/net.Dial/DefaultClient anywhere in
non-test code, and no telemetry, analytics or error-reporting dependency in
the build. Runtime: under 300 requests the process held exactly one listener
and sixteen ACCEPTED inbound connections, with zero outbound; over a 60s idle
soak the only socket was the listener; and it opened no UDP socket at all, so
it never resolved a hostname. Method and its limits are recorded in the ops
notes.

ENFORCEMENT so this cannot quietly come back

• CSP form-action tightened from 'self' to 'none': a form added by accident
  now fails in the browser instead of shipping. connect-src stays 'self'.
• README gains two copy constraints — no email capture ever, and no calendar
  commitments — alongside the existing trademark and no-fabricated-numbers
  rules.
• robots.txt keeps Disallow: /api/ as a standing guard even though no /api/
  route exists now, with the reason rewritten to say so.

[cloudflare-workers-and-pages]

Deploying www with    Cloudflare Pages

Latest commit:	84ae8a0
Status:	✅  Deploy successful!
Preview URL:	https://d3ef5722.www-4rw.pages.dev
Branch Preview URL:	https://privacy-no-email-capture.www-4rw.pages.dev

View logs