DRAFT for review. This page has not been finalised. Items in highlighted brackets still need filling in.
Privacy Policy
UK Residency Tracker (trackresidency.com) is a small personal tool for tracking time spent outside the UK and estimating key dates for settlement (ILR) and British citizenship. This notice explains what personal data it holds, why, and your rights under the UK GDPR and the Data Protection Act 2018.
Who is responsible
The controller is [full name], who runs the service as an individual. Contact: [contact email]. Postal address: [postal address].
What we collect
- Account details: your email address and a securely hashed password (we never store your password itself). If you use Google sign-in, we store the account identifier Google gives us and the email it confirms.
- What you enter: trips (dates and destinations), countries you’ve visited, your arrival date, visa route and the other settings you choose.
- Security records: short-lived codes and links for verifying your email or resetting your password, and counters that limit repeated attempts. These expire automatically.
- Your browser: a sign-in cookie, and a copy of your data saved in your browser so the app works offline. We don’t use advertising or analytics cookies.
Why we use it, and the lawful basis
- To provide the tracker you signed up for: creating your account, saving your data and calculating dates. Basis: contract (Article 6(1)(b)).
- To keep accounts secure: email verification, password resets, checking new passwords against known data breaches, and limiting repeated attempts. Basis: legitimate interests (Article 6(1)(f)) in protecting your account and the service.
- To send emails you need: verification codes, password reset links and notices about changes to your account. We don’t send marketing.
Travel history can show a lot about your life, so we only use it to show you your own figures. We don’t sell it, share it for advertising or use it to profile you.
Who processes it for us
- Vercel hosts the website and stores account data (data storage is located in London, UK).
- Resend sends account emails (your email address and the message).
- Google, only if you choose to sign in with it.
- Have I Been Pwned (Pwned Passwords): when you choose a password, only the first 5 characters of its SHA-1 hash are sent, never the password itself or your email.
- Map tiles come from OpenFreeMap, some code libraries from jsDelivr, and a fallback font from Google Fonts. These services receive your IP address when your browser loads them.
Some of these providers may process data outside the UK. Where they do, they rely on safeguards recognised under UK law, such as the UK International Data Transfer Addendum or adequacy regulations. [confirm each provider’s transfer mechanism]
How long we keep it
We keep your account and data until you delete your account. Deleting it (Pathway → Account → Delete account) removes your account, trips and settings from our storage straight away. Verification codes expire after 15 minutes and reset links after 30 minutes. Backups or logs held by our providers may take up to [number] days to clear.
Your rights
You can ask to access, correct, delete or export your data, and you can object to or ask us to restrict how we use it. Much of this you can do yourself: edit your details in the app, export your trips as a CSV, or delete your account. For anything else, email [contact email]. We’ll reply within one month.
If you’re unhappy with how your data is handled, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to sort it out with you first.
Security
Passwords are hashed with scrypt, sign-in cookies are signed and only sent over HTTPS, and stored data is private to your account. No system is perfectly secure. If we become aware of a breach that affects you, we’ll tell you and, where required, the ICO.
Children
The service is not intended for anyone under 18.
Changes
If we change this notice in a way that matters, we’ll update the date above and, for significant changes, tell you by email.