Privacy notice

1. Who we are

The Good Retreat is operated personally by Sonny Phillips, based in the United Kingdom, who is the data controller for the personal data described here. The service is not yet registered as a sole trader business with HMRC; this notice will be updated when it is. You can contact us at admin@thegoodretreat.app. This notice is written to meet our obligations under the UK GDPR and the Data Protection Act 2018.

2. What we collect

• Account data: your email address, an encrypted password (or the fact you signed in with Google), your display name, and your confirmation that you are 13 or over.
• Content you post: deeds, comments, projects, project messages, votes, and any optional profile details such as a short bio or the rough area you live in.
• Public profile: if you choose a username, your profile page, deed history, category breakdown and any award badges become viewable by anyone with the link. You can clear your username at any time in Settings to take it down.
• Award history: if one of your deeds is honoured at the annual ceremony we record the year, your rank, the deed and a badge label so the recognition and certificate can be shown.
• Reports: if you report content, we keep your report, the reason and the item reported.
• Notifications and appeals: status updates about your own posts, and any appeal you send us, including your message and the moderator's decision and note.
• Contact messages: the contact form opens your own email app, so we only hold what you choose to email us at admin@thegoodretreat.app, kept for as long as needed to answer you.
• Supporter list: if you ask to be told when supporter membership opens, we store the email address and optional note you give us, use them only for that announcement, and delete them on request or once membership has launched.
• Advertising: advert spaces only load if you accept advertising cookies. If you do not, no advertising code, identifier or profile is created. Consent can be withdrawn at any time on the cookie policy page.
• Technical data: basic security and server logs, including IP address, needed to keep the service running and safe.

We do not ask for special category data (such as health or religious beliefs). Please do not include it, or other people's identifiable details, in the deeds you write.

3. Why we use it, and our lawful basis

• To provide the service — creating your account, publishing your deeds, counting votes. Lawful basis: performance of a contract with you.
• To keep the community safe — moderation, handling reports, preventing vote manipulation and abuse. Lawful basis: legitimate interests in running a safe platform.
• To run awards and ceremonies — publishing winners and leaderboard positions. Lawful basis: legitimate interests, and consent where we publish anything beyond your chosen display name.
• Optional analytics or marketing emails — only with your consent, which you can withdraw at any time.
• Legal compliance — responding to lawful requests and meeting our online safety duties. Lawful basis: legal obligation.

4. What is public

Deeds you mark as public, your display name, comments, projects, project messages and award wins are visible to anyone on the internet, including search engines. Vote counts are public; who voted for what is not shown publicly. You can keep a deed private, or hide your profile entirely, in your account settings.

5. Children

The Good Retreat is not for children under 13. We ask everyone to confirm their age at sign-up. If you believe a child under 13 has an account, email us and we will remove it. We design with the Information Commissioner's Age Appropriate Design Code in mind: profiles default to the minimum information needed, no behavioural advertising is used, and no location beyond a self-chosen town is ever collected.

6. Who we share it with

We use trusted service providers to host the site, store the database and send account emails. They process data on our instructions under written contracts. We do not sell your data. Some providers may process data outside the UK; where that happens we rely on UK adequacy regulations or the International Data Transfer Addendum to the EU standard contractual clauses.

7. How long we keep it

Account and content data is kept while your account is open. If you delete your account, your profile and content are deleted immediately; backups roll off within 30 days. Moderation and report records are kept for up to 12 months so we can deal with repeat problems. Security logs are kept for up to 90 days.

8. Your rights

You have the right to access, correct, delete, restrict or object to our use of your data, and the right to data portability. You can download everything we hold and delete your account yourself from your account settings, or email us and we will respond within one month. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

9. Cookies

See our cookie policy for what we set and how to change your choice.

10. Changes

If we make a material change to this notice we will tell you in the app or by email before it takes effect.