Privacy Policy

This is placeholder copy, not legal advice. It describes what this application does by default, which is probably not everything your deployment does. Check every section against what you actually collect, and have somebody qualified review it before you rely on it. Requirements differ by jurisdiction — UK GDPR, EU GDPR and CCPA all differ.

Two gaps to close before you rely on this. "How long we keep it" names no retention periods, because the application enforces none — most jurisdictions expect specific periods, so set yours once you know them. And deleting an account removes the account and nothing else: contact-form messages are stored unlinked to it and survive, so removing one is a manual job until you build something that does it.

We collect as little as we can, use it only to run this service, and never sell it.

What we collect

• Account details. Your name and email address when you register, and a password we store only as a hash we cannot reverse.
• Messages you send us. Anything you put in the contact form, including your name and email address so we can reply.
• Images you upload. Files you add to your account, such as a profile picture.
• Technical logs. Our servers record IP addresses, browser type and the pages requested, which we use to keep the site working and to investigate abuse.

Why we collect it

To give you an account and let you sign in, to answer the messages you send us, to keep the service secure and available, and to meet our legal obligations. Where the law requires a lawful basis, ours is the performance of our agreement with you and our legitimate interest in running a secure service.

How long we keep it

Account details for as long as your account exists. Deleting your account removes them straight away.

Messages you send through the contact form are stored separately and are not deleted with your account. We keep them, and our technical logs, until they are no longer needed for the purposes above. Ask us if you want a message removed.

Who we share it with

Only the suppliers who help us run the service — hosting, email delivery and error monitoring — and only what they need. We do not sell your data or share it for advertising. We may disclose information if the law requires it.

Cookies

We set a session cookie to keep you signed in and a cookie that protects forms against cross-site request forgery. Both are necessary for the site to work and neither is used for tracking or advertising.

Your rights

You may ask us for a copy of your data, correct it, delete it, or object to how we use it. You can change your details or delete your account yourself from your account settings. To ask for anything else, use the contact form. If you think we have handled your data badly, you may complain to your data protection regulator.

Changes to this policy

If we change how we handle your data we will update this page and change the date below.

Contact us

Questions about this policy can go through the contact form.