Privacy Policy
1. The short version
We collect the minimum needed to run the site and process payments. We don't track you, we don't run analytics, we don't use advertising cookies, and we don't sell or share your data with anyone for marketing.
2. What we collect and why
- Email address — so you can sign in and so we can send purchase receipts and service notices. (Lawful basis: contract.)
- Payment details — handled entirely by our payment processor. We never see your full card number. (Lawful basis: contract.)
- Basic access logs — which chronicle was viewed and when, for rate limiting and fraud prevention. No browsing history, no IP tracking. (Lawful basis: legitimate interest.)
That's it. No analytics, no tracking pixels, no profiling.
3. Cookies
We use only strictly necessary cookies to keep you signed in. No consent banner needed — they're required for the site to work. There are no optional cookies.
4. Who else touches your data
We use a small number of third-party services to run the site (authentication, payments, hosting, database). They process your data on our behalf and are bound by their own privacy policies and data protection obligations. We don't share your data with anyone else.
5. How long we keep things
- Account data — while your account exists. Deleted within 30 days if you close your account.
- Purchase records — 7 years (HMRC requirement).
- Access logs — deleted after 90 days.
6. Your rights
Under UK GDPR you can ask us to show you what data we hold, correct it, delete it, or export it. You can also object to processing based on legitimate interest. Email us and we'll respond within a month. If you think we've got it wrong, you can complain to the ICO (ico.org.uk).
7. Children
The site isn't aimed at under-13s. If you think a child has given us personal data, let us know and we'll delete it.
8. Changes
If we change this policy, the date at the top changes. For anything major, we'll email registered users.