Privacy notice

Who we are

thorntonledale.org is an independent visitor guide run by Jon Cosson from Thornton-le-Dale. Jon is the data controller, and "we" in this notice means him as the site's editor. To ask about your data, use the contact page.

What we collect and why

Contact form. Your name, email address, an optional subject and your message, used only to reply to you. Each message is saved in our database and a copy is emailed to the editor.

Share your visit forms (on /share-your-visit and /bangers-and-cash/share-your-visit). Your story, name and email address, up to four photos, and optionally when and what you visited and your home town. We also record your credit choice and the permission boxes you ticked. Your name and email are used only to contact you about your story and are never published. A copy is emailed to the editor, with private photo links that expire after seven days.

Walk planner (on /walks). What you type, how long you have, and whether you have a dog, children, a pushchair or need a wheelchair-checked route. This is sent to an AI model to suggest one of our walks. We do not ask who you are and do not save what you type, so please leave personal details out.

Technical data. Our hosting providers receive your IP address, browser details and the pages you request, to deliver and protect the site. They keep this in their own logs for a limited period under their own policies.

Lawful basis

• Stories and photos: your consent, given by ticking the boxes on the form. You can withdraw it at any time.
• Replying to messages: our legitimate interest in answering people who write to us.
• The walk planner: our legitimate interest in providing the feature you asked to use.
• Spam prevention and site security: our legitimate interest in keeping the site working and safe.

Where your data is stored and who processes it

• Lovable: the platform the site is built and published on, including its "Lovable Cloud" backend.
• Supabase: the database for messages and stories, and the private store for story photos.
• Cloudflare: hosts and delivers the site and its images.
• Resend: sends the notification emails to the editor.
• Google (Gmail): the editor's inbox, where notification emails arrive.
• Lovable AI Gateway: the walk planner's requests go through Lovable's AI gateway to an AI model provider (currently OpenAI), which processes them under its own terms.

The weather panel on /walks comes from Open-Meteo via our server; nothing about you is sent to it.

International transfers

Some of these providers process data in the United States or elsewhere outside the UK. Where they do, we rely on safeguards such as the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework.

How long we keep it

• Contact messages: 12 months after our last reply, then deleted.
• Stories not published: 12 months after submission, then deleted with any photos.
• Published stories and photos: while they appear on the site. Your name and email are kept while the story is live and deleted within 3 months of its removal.
• Notification emails in the editor's inbox: deleted on the same timetable as the matching record.
• Walk planner requests: not stored by us.

Publication, withdrawal and takedown

Nothing is published automatically, and not every story is published. Stories may be edited for length and clarity and are credited as you chose. We do not publish photos in which children can be identified. Location data (such as GPS coordinates) is removed from photos automatically when they are uploaded.

To withdraw consent or have a story or photo taken down, use the contact page and we will remove it within 7 days.

Children

The story forms are for people aged 16 or over, who must confirm their age. If we learn a story came from someone under 16, we will delete it.

Cookies and local storage

Our code sets no cookies. Our hosting provider may set a strictly necessary security cookie to protect the site from abuse. The site keeps your scroll position in your browser's session storage, which clears when you close the tab.

Analytics

The site has no tracking scripts and no Google Analytics. Our hosting platform records basic visit statistics (pages viewed, referring sites, country and device type) so the editor can see which pages are used; these are not used to identify you. A Google Search Console verification tag in the page header collects nothing from visitors.

Your rights

Under UK data protection law you can ask for a copy of your data, have it corrected or deleted, object to or restrict its use, and withdraw consent. Use the contact page and we will respond within one month.

If you are unhappy with how we have handled your data, please tell us. You can also complain to the Information Commissioner's Office at ico.org.uk.

Changes

If we change how we use personal data, we will update this page and the date at the top.