Privacy policy

This policy explains how Onepot (“we”, “us”), operator of onepot.org.uk, collects and uses your personal data. We are the data controller for the purposes of the UK GDPR and the Data Protection Act 2018.

Data we collect

• Account data — when you sign up, we store your email address and, via our authentication provider, an account identifier. If you use Google sign-in, we receive your basic Google profile (name, email, avatar).
• Profile data — a username, and any optional display name, bio, avatar, affiliate IDs, and social links you choose to add.
• Content — the bundles, items, reviews, likes, and saves you create.
• Usage data — aggregate bundle view counts. (Affiliate links are not live yet; if we introduce outbound click logging for revenue attribution, we will update this policy and, where required, ask for your consent first.)

How we use your data

• To provide the service — authentication, publishing bundles, and personalising your likes and saves.
• To understand which bundles are popular and improve the platform.
• To meet our legal and regulatory obligations.

Legal bases

We process account, profile, and content data to perform our contract with you (providing the service), and rely on our legitimate interests for keeping the platform secure and measuring aggregate usage. If we later introduce non-essential cookies or affiliate click tracking, we will rely on your consent for those.

Cookies & tracking

We currently use only a small number of essential cookies to keep you signed in — these do not require consent, and we set no advertising or affiliate-tracking cookies today. Affiliate links are on our roadmap; before we load any third-party affiliate network that sets its own cookies, we will show a consent banner and update this policy.

See our Affiliate disclosure for how affiliate links will work.

Sharing & processors

We do not sell your personal data. We share it only with the processors that run the service on our behalf:

• Supabase — database, authentication, and file storage.
• Our hosting provider for serving the site.

When affiliate links go live, any affiliate network we use will be added here as a processor before it is enabled.

Retention

We keep your account and content data for as long as your account is active. If you delete your account, we delete or anonymise your personal data, except where we must keep it to meet a legal obligation.

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, or object to our processing of your data, and to data portability. To exercise any of these, email privacy@onepot.org.uk. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

Contact

Questions about this policy: privacy@onepot.org.uk.

This policy is a template provided for transparency and should be reviewed by a qualified adviser before launch; it does not constitute legal advice.