Privacy notice

This notice describes what this website actually does. It was last updated on 6 November 2026.

Who is responsible

The controller for personal data on this site can be reached at contact@whattech.uk. This notice does not publish a personal name. The site is a non-commercial personal project: notes and advice for friends, with the occasional private page. Data protection duties still apply. Whether an ICO data protection fee is payable is a separate question and is not decided here.

What the site is

Public notes can be read by anyone. A private note can be read only by the people an admin has named for that note. Friends can sign in. They cannot post, comment, upload, or message anyone. There is no advertising and no analytics.

What we hold, and why

We keep as little as possible.

• A person row, if an admin adds you: a display name and, if you use Google, your email address. Purpose: to know who may open a private note.
• A sign-in session after you sign in: a random token stored only as a keyed hash, and the time it expires. A friend session lasts 14 days. An admin session lasts 12 hours. We do not store your IP address or your browser name.
• A one-time link, if an admin creates one: a hash of the token, who it is for, when it expires (normally 72 hours), and whether it has been used or revoked. Opening the link does not sign you in until you press the button, so a preview in a chat app does not use it up.
• Google sign-in, if you use it: we send you to Google and receive back your email address and confirmation that Google has verified it. We do not receive your Google password, your contacts, or your name from Google. The display name on this site is the one an admin typed.
• A short-lived security cookie on pages that contain a form, and a short-lived cookie during the Google redirect. See the cookies page.
• Admin sign-in, if a password and authenticator are configured: we check the password against a hash and the authenticator code against a clock. We store the time-step of a code we have already accepted so it cannot be reused. We do not store the password.

Rate limiting counts recent attempts in the server’s memory. Those counts are not written to the database and are forgotten when the window passes or the process restarts.

Notes and images are written by an admin. Images are re-encoded on upload, which removes camera metadata such as location.

Lawful basis

The basis is legitimate interests: keeping private notes limited to the people they were written for, and keeping the admin area limited to the admin. A session is necessary for that access control. The data is small, it is not used for marketing, and you can ask for it to be deleted. We do not rely on consent for cookies, because the only cookies are strictly necessary.

How long we keep it

• Friend sessions expire after 14 days. Admin sessions expire after 12 hours. Expired sessions are deleted.
• Google redirect data expires after 10 minutes.
• One-time links that have been used, revoked, or have expired are deleted after 30 days.
• Person rows are kept until you ask for deletion or an admin removes them.
• Backups of the database and uploaded files are rotated. The site backup script keeps the newest 14 backups. A deleted row can remain inside a backup until that backup ages out. Host-level backups, if the server keeps them, follow the server’s own rotation.

Who else sees it

We do not sell personal data and we do not pass it to advertisers. If you use Google to sign in, Google processes that sign-in under its own terms. The notes themselves are not sent to Google.

The site is hosted on a server in the United Kingdom, in a household. It is not placed behind an analytics service.

Your rights

You can ask for a copy of the information we hold about you, for a correction, for deletion, for restriction, or object to the legitimate interests described above. Write to contact@whattech.uk. We will reply without revealing anyone else’s information. There is no automated decision-making and no profiling.

You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint.

Children

The site is not aimed at children, and we do not knowingly create sign-ins for children. If we are told we have done so, we will delete that sign-in.

Changes

If the site starts collecting something new, this notice will be updated first.