Privacy Policy

How The Wire handles your information.

Version 1.0 · In effect from 28 July 2026 · Change history

The short version

You can use The Wire without an account, and then we hold nothing about you at all. Your topics stay on your device. That mode is genuinely anonymous — see §2.
We never sell or share your data, and there is no advertising in The Wire — so there is no advertiser to share it with.
There are no third-party trackers, no analytics SDKs and no advertising cookies. No other company's code runs on this site.
If you do sign in, we never receive your name or your email address — not even Apple's relay address. We ask Apple for nothing but a meaningless identifier, and we hash even that before storing it.
We hold the topics you chose to follow, which stories you've read, and — only if you ask for local alerts — a home area rounded to about 110 metres. Not your address, and never a track of where you go.
We never measure time-on-site or session count. We deliberately don't want you here longer.
You can delete everything. It's one operation on our side and we do it for real — see Your rights.

This summary is not the policy. Where the two differ, the text below governs.

1. Who we are

The Wire is a personal news briefing available at wire.databased.business and as an iOS app. This policy applies to the website, the installed web app (PWA), the iOS app, and the notifications we send you. We refer to all of these together as the Service.

For the purposes of the UK GDPR and the Data Protection Act 2018, the data controller is Julian Elliott ("we", "us", "our"), operating The Wire from the United Kingdom.

To be completed before public release: the controller's registered legal form (sole trader or limited company, with company number if applicable), a postal address for service, and the ICO registration number. UK controllers processing personal data by automated means must generally register with the Information Commissioner's Office and pay the annual data protection fee.

Contact for anything in this policy — including access, deletion and complaints: privacy@databased.business. We aim to respond within 7 days and are required to respond substantively within one month.

We have not appointed a Data Protection Officer. We are not required to — we do not carry out large-scale systematic monitoring, and the Service has a small user base.

2. Two ways to read, and the honest difference between them

Without an account — genuinely anonymous

If you never sign in, we hold no account, no identifier, no profile and no record of your reading. The topics you follow and the stories you've opened are written to your own browser's storage and never transmitted. Nothing is set as a cookie, because there is no session to keep.

Two things still reach us, as they reach every website you visit, and we would rather name them than claim a purity we don't have: an aggregate count (below), and your IP address, which is in the request itself and appears in our provider's technical logs for 7 days. We never join it to anything, and there is nothing to join it to — but an IP address is personal data, so "nothing whatsoever" would be the wrong words.

This matters legally, not just as reassurance. Data protection law only applies to information about an identifiable person; where there is no identifier and no realistic way to single anyone out, the information is anonymous and falls outside the UK GDPR entirely (Recital 26). That is the correct description of this mode. You can clear everything it stores with ⚙ Topics → Clear all, and there is nothing to ask us for, because we have nothing.

What you give up: urgent alerts (they need somewhere to send to), the same feed on a second device, and Catch-up remembering where you stopped.

The only thing that reaches us is an aggregate count — a daily tally like "editions opened: 14" — which carries no identifier of any kind and cannot be traced back to any person or device. We say so here rather than claiming a purity of "nothing at all".

With an account — pseudonymous and minimal, but still your data

Signing in creates a record, so we will not call it anonymous. It is pseudonymous, which UK GDPR Art. 4(5) treats as personal data — Apple could in principle link the identifier back to you, so the law applies and you keep every right in §9. We would rather state that plainly than overclaim.

What we do instead is hold as little as possible:

We ask Apple for no personal information at all. The sign-in request carries no scope, so Apple's response contains only a meaningless per-app identifier. We never receive your name, and we never receive an email address — not your real one and not Apple's private-relay one. There is nothing to discard, because nothing arrives.
We do not even store Apple's identifier. It is put through a keyed cryptographic hash with a secret held only on our servers, and the result is what we keep. Apple's own value is never written down, never logged, and exists only for the instant it takes to compute the hash. If our database were ever exposed, the identifiers in it could not be linked back to any Apple account by anyone without that secret.

3. What we collect, why, and what allows us to

This applies to accounts. Everything we hold is listed here — if it is not in this table, we do not have it.

Personal data processed by The Wire
What	Why	Lawful basis (UK GDPR Art. 6)
Your account identifier — a keyed hash of the per-app identifier Apple gives us, as described in §2. It is a string of random-looking characters that means nothing to anyone but our own server.	To recognise you across visits and devices so your topics, reading position and alerts follow you. It is also used as a short-lived counter key, so one account cannot run up an unbounded number of AI-backed searches.	Contract — Art. 6(1)(b) for the account. Legitimate interests — Art. 6(1)(f) for the rate-limiting use, balanced against the cost of an unlimited one.
Your name — never collected. Listed so you know it is a deliberate absence rather than an omission.	—	—
Your email address — never collected. We ask Apple for no email, so we receive none. Not your real address, and not Apple's "Hide My Email" relay address either.	— We have no way to email you, and no plans to.	—
What you chose to follow. Your desks and their weights, any searches you saved, the sectors you picked for "Worth knowing", and your reading-level setting.	To assemble your edition. This is the product.	Contract — Art. 6(1)(b).
Your home area — latitude and longitude rounded to three decimal places (roughly 110 m), stored only if you tap "Use my area".	To find planning applications near you, and flood warnings where we can get them. The Environment Agency, the only flood service we carry, covers England only — so a home area in Wales, Scotland or Northern Ireland gets planning alerts but no flood warnings. A Northern Irish area is never sent to the Environment Agency at all. A Welsh or Scottish one is not sent either, unless it is close to the England–Wales or England–Scotland border: our boundary lines are hand-drawn and accurate to only about 4.5 km there, so near them we cannot always tell which country a coordinate is in, and we would rather ask about an area we do not need to than lose a flood warning for someone England does cover. Where we are unsure, the app says so instead of telling you we carry your flood warnings. This is the only thing in this table that we also send outside The Wire, on a schedule, in order to answer it — §5 says to whom, what each request contains, how often, and exactly which areas go.	Consent — Art. 6(1)(a). Optional, off by default, and clearable in one tap.
What you did with a story. A record per story of whether it was delivered, seen, read or dismissed, with a timestamp. The story is identified by its web address, or where there isn't one by its desk and headline — so this record does say which stories you read, in readable form, not as an opaque code. Also a note of any urgent alert we held back from interrupting you, and why.	So you're not shown the same thing twice, so Catch-up knows where you stopped, and so you can inspect what we suppressed.	Contract — Art. 6(1)(b).
Interest signals and the traits derived from them — e.g. "read a story about X". Raw signals expire; traits decay over time unless refreshed.	To rank your edition so the things you care about come first.	Contract — Art. 6(1)(b). See §8 for how the ranking works and how to switch it off.
A coarse availability state — one of focus, meeting, commuting, workout, asleep, open — and a place class of home, work, transit or away, if a companion app you have authorised reports one.	So an urgent alert doesn't arrive in the middle of a meeting or at 3am.	Consent — Art. 6(1)(a), given per app via the consent ledger.
Your push subscription, if you turn alerts on: the notification endpoint URL supplied by your browser, plus the two public keys needed to encrypt a message to it.	To deliver notifications you asked for.	Consent — Art. 6(1)(a). Withdraw by turning alerts off, in the app or in your OS settings.
An audit record of every read of your profile — which app read which trait, and when.	So you can see who looked at what. This exists to protect you, not us.	Legitimate interests — Art. 6(1)(f): transparency and abuse detection. Balanced in your favour by design.
A consent ledger — an append-only record of every permission granted or withdrawn, including account deletion.	To prove, if ever challenged, that we acted on your instruction.	Legal obligation — Art. 6(1)(c), with Art. 7(1) (demonstrating consent) and Art. 5(2) (accountability).
Aggregate counts. Daily totals such as "editions opened: 14". These carry no user identifier — not a hashed one, not a session one. They cannot be traced to you.	To tell whether the product is working. See §4 for what we refuse to count.	Not personal data. Included here for completeness.
Technical request logs generated by our hosting provider: IP address, timestamp, URL, user agent, response status. Standard for any website. Your IP is also used, without being stored by us, as a short-lived counter key so one machine cannot flood the anonymous usage endpoint.	Security, abuse prevention, rate limiting, diagnosing faults.	Legitimate interests — Art. 6(1)(f): keeping the Service up and unabused.

On free-text you type, and what we will and won't claim for it. There are two different things here and they deserve two different promises.

The fixed pick-list is closed. The sectors you can choose from for "your world" are a fixed set — energy, transport, business, markets, tech, science, climate, weather, planning. It contains no health, political, religious, sexuality, ethnicity, trade-union or biometric category, so a choice from that list genuinely cannot express a special category of data under UK GDPR Article 9. That part is structural.

The free-text box beside it is a filter, and a filter is not a guarantee. When you type a sector or save a search, the text is screened: words that look like health or disability, mental health, religion or belief, sexual orientation, gender identity, race or ethnicity, trade-union membership, immigration status, political affiliation, or genetics and biometrics are refused, and a small allow-list keeps legitimate work phrases such as "health and safety" and the name of an NHS health board from being caught. It stops the obvious and the careless. It cannot stop someone determined to type something sensitive, and every such list has an edge it hasn't thought of. Here is where that edge is. The list is written in English and in Welsh, with the commonest terms in Polish and Romanian, and a short set of the plainest words — cancer, pregnancy, depression, mental health, disability, refugee — in Bengali, Urdu, Arabic, Punjabi, Gujarati, Hindi, Chinese, Greek and Cyrillic script. That is a floor and not coverage: in any other language, and for anything subtler than those words in the languages named, the screen will not recognise what it is reading. So please don't type anything here you would rather we didn't keep. If a harmless term is refused, rephrase it.

Four things can put free text into your profile: the "your world" box, a saved search, a desk you follow, and an interest signal written by an app you have authorised. All four are screened by the same list at the moment you add them.

There is also a hard limit on how much of this we keep: at most twelve anchors in "your world". Ask for a thirteenth and we refuse it rather than quietly dropping an old one, so nothing you typed disappears without you being told.

We also re-screen two of them after the fact. When the list is widened, "your world" anchors and saved searches that today's version would refuse are deleted from your profile the next time it is read, and the app names the ones that went. This is deletion, not deactivation. Followed desks and stored signals are screened when they arrive but are not yet swept retroactively; signals age out after 90 days regardless.

4. What we do not collect

These are design commitments, not gaps we intend to fill:

No advertising or marketing profile. There are no ads in The Wire and no ad network is present.
No location history or tracking. A single rounded home area, set by you, replaced when you change it, deleted when you clear it. We never record where you have been.
No raw device data. Focus status, calendar entries, health data and precise location, where a companion app derives them, are reduced on your device to one of six words before anything is sent. The server cannot leak what it never receives.
No time-on-site, no session count, no scroll depth, no engagement score. This is not an oversight. A product designed to leave you calmer must not be optimised against metrics that reward keeping you here.
No cross-site tracking, no fingerprinting, no data brokers, no third-party analytics.
We ask for no special category data (Art. 9) and no criminal offence data (Art. 10). No field, question or category anywhere in The Wire is for your health, beliefs, politics, trade-union membership, ethnicity, sexuality, immigration status, genetics or convictions, and the fixed pick-list in §3 cannot express one. The free-text boxes are the honest exception, and we will not claim otherwise here: they are screened by a word list, that list has an edge, and a filter is not a guarantee — §3 says what it covers and what it misses. This bullet is a commitment about what we ask for and what we refuse to keep; it is not a claim that nothing sensitive can ever reach us.
Nothing about your contacts, photos, microphone, camera or files. We never ask for those permissions.

Publishers never see you. The Wire renders no publisher HTML, loads no publisher image, script, font or tracking pixel, and embeds nothing. Where we show a thumbnail, we fetch it once ourselves and serve it from our own servers. The result is that no request from your device reaches a news website until you choose to tap a link — so no publisher can build a picture of what you scroll past. When you do tap through, you are on their site under their privacy policy, and this one stops applying.

5. Who else sees your data

We do not sell your personal data, and we do not share it for anyone else's marketing. We have never done so and the Service has no mechanism for it. The only organisations that touch your data are these:

Who	Role	What they get
Cloudflare, Inc.	Processor — hosting, storage, database, CDN and security for the whole Service.	Everything we store, plus technical request logs. Bound by Cloudflare's data processing addendum; they act only on our instructions.
Apple Inc.	Independent controller for Sign in with Apple; processor for weather data and for App Store distribution.	Apple already knows you signed in — we tell them nothing new. Apple's own privacy policy governs their side. We never send Apple your reading history.
Your browser or OS push service — Apple, Google or Mozilla, depending on your device.	Processor for notification delivery. Unavoidable: this is how web push works.	An encrypted payload addressed to your subscription endpoint. They can see that a message was sent; alert notifications carry story identifiers rather than full article text where possible.
Public data sources — the Environment Agency (flood warnings) and PlanIt (planning applications).	Recipients of a coordinate, not of your identity.	Only if you set a home area. We send the rounded coordinates with no identifier attached, and users who round to the same area share a single query. Each request contains the rounded coordinate, how wide an area we are asking about — 400 metres for PlanIt, 15 kilometres for the Environment Agency — and a user agent that names The Wire. We attach no cookie, no account identifier and no device identifier, and one query stands for every reader who rounds to that area, however many that is. Which home areas go to the Environment Agency, and which do not. The Environment Agency is the flood authority for England alone, so a coordinate anywhere else comes back empty and there is no reason to send it. We decide from your rounded coordinate, using hand-drawn outlines of the four nations — and along the England–Wales and England–Scotland land borders those outlines are only accurate to about 4.5 kilometres. So the rule is not "English areas only", and we will not write it that way. We send an area our check places in England. We also send an area our check places in Wales or Scotland if it is within about a kilometre of one of those two borders — at that distance our line is not good enough to justify dropping a flood warning for someone England does cover, and one unnecessary request is a smaller harm than a missed one. Because the check itself can be wrong by up to 4.5 km, the areas that go include real places in Welsh and Scottish border country: measured against our own check, Chepstow, Saltney, Holt, Knighton, Sealand, Churchstoke, Gretna, Canonbie, Newcastleton and Coldstream are all sent. Away from those two borders nothing is: Cardiff, Aberystwyth, Wrexham, Edinburgh and Belfast are not sent to the Environment Agency, and Northern Ireland never is. Whenever we send an area we cannot place in England with confidence, the app tells you we are not sure which side of the border you are on, rather than telling you we carry your flood warnings. How often this happens, and what sets it off. These requests are made by a scheduled job on our side, not by you opening the app — they go out whether or not you have used The Wire that day. PlanIt is asked about a home area at most once a day. The Environment Agency is asked about each home area we send it every 30 minutes — 48 times a day. That difference is deliberate, and it is the trade we have made on your behalf: a severe flood warning is a danger-to-life message, and we will not hold one back for up to a day in order to send fewer requests. Planning applications can wait a day, so they do. Repetition is itself something a request reveals — the same point, on a fixed schedule, from a user agent that names us — which is why the rate is written here rather than left for you to assume it is only when you look.

We will also disclose data if we are legally required to — a court order, or a lawful request from a UK authority. We will tell you if that happens unless we are prohibited from doing so.

If the Service is ever sold or transferred, your data may transfer with it. You would be told before that happened, in time to delete your account first.

6. Sending data outside the UK

Our providers are US-headquartered and operate globally, so your data may be processed outside the UK. Where that happens we rely on:

the UK Government's adequacy regulations for the EU and for the UK–US Data Bridge, where they apply; and otherwise
the International Data Transfer Addendum to the EU Standard Contractual Clauses, which forms part of our agreements with Cloudflare and Apple.

Cloudflare's network routes requests to the nearest healthy data centre, which for UK users is normally in the UK or the EU, but this is not guaranteed for every request.

7. How long we keep things

Data	Retention
Your account, follows, reading level and home area	Until you delete your account or clear them individually.
Raw interest signals	90 days, then automatically deleted by a scheduled sweep.
Derived traits	The behavioural desk weights decay continuously and are pruned by a weekly sweep once they fall below significance. Two derived things do not decay: the record of what you read (above), which lasts until you delete your account, and a cached numeric summary of what you have read, which is recomputed rather than expired.
Read and dismissed records	Until account deletion. They are what stops repeats.
Profile-read audit trail	A rolling buffer of recent reads; older entries drop off automatically.
Your session cookie	90 days, or until you sign out — at which point it stops working on our side too, not just in this browser.
Push subscription	Until you turn alerts off, or your push service reports the subscription as expired.
Technical request logs	7 days.
Per-request cost records at our provider	90 days. One entry per feed or search request, holding the route name and how much work it cost us to answer — no identifier, no IP address, no search text. It exists so a runaway bill is visible before it arrives.
Raw usage counters at our provider	90 days. No user identifier attached.
Aggregate daily counts	Indefinitely. They contain no personal data and cannot be un-aggregated.
Encrypted backups	30 days, then automatically expired. A deletion request is applied to live systems immediately; backups age out within 30 days and are never used to repopulate a deleted account.
A sign-out marker	93 days. When you sign out — or when Apple tells us you have revoked or deleted your account — we store your account identifier and the moment it happened, so that any cookie issued before then is refused. It outlives the account on purpose: it is what keeps an outstanding cookie dead. It self-expires just past the maximum session length and holds nothing else.
A deletion marker	48 hours. When your account is erased we store your account identifier and the moment it happened, for two days, so that a backup already being written when you asked cannot finish and land carrying data we have just deleted. Nothing reads it except the backup writer, it holds nothing else, and it self-expires.
Consent ledger	At least 6 years after your account closes — we do not currently delete it on a schedule, so treat six years as the floor, not the ceiling. This is the record proving we honoured your instructions, retained under our accountability obligation. It holds your account identifier and what you asked for — nothing else.

8. Personalisation, ranking and AI

How your edition is ordered

The Wire ranks stories for you. The formula is arithmetic, not a black box:

desk weight × salience × recency × your affinity

desk weight — how strongly you said you follow that topic, or, if it is higher, how strongly an app you connected has reported you read it. Whichever of the two is larger is the one used.
salience — how significant the story is judged to be, independent of you.
recency — newer scores higher.
your affinity — how close a story is to the ones you have opened here, in The Wire.

Tap the ★ on any story to see exactly why it reached you. When a connected app's report is what moved a story up, that line says so and names the app. Every follow is one you chose: The Wire ships with nothing pre-selected.

This is profiling as UK GDPR defines it. It is not a decision producing legal or similarly significant effects, so Article 22 does not apply and there is no automated decision about you to contest. You may still object at any time under Article 21 — see §9.

Seeing it, correcting it, and switching it off

Two of the four factors above are learned rather than chosen by you: the desk weight can be lifted by what apps you have authorised report about you, and your affinity comes from what you have opened here. In the app, under Settings → Personalisation, you can:

See what we hold — the number we keep for each topic, and which apps have reported about you recently.
Turn it off — one switch. With it off, your edition is ordered by the topics you chose, how significant each story is and how new it is, and by nothing learned about you. This is how you exercise your Article 21 objection, and it takes effect on the next edition you load. You can turn it back on whenever you like.
Forget what apps have told us — clears those stored numbers. An app you have authorised can report again afterwards, so if you want it to stop counting altogether, use the switch as well.
See who has read your profile — the record of every app that has, with what it asked for and when.

Switching it off changes the order of your edition and not which stories are in it: how much of each topic you get is your own Some/More/Lots setting, and that is untouched either way.

Interruptions

Only a small number of stories are ever allowed to notify you. Before one does, it must pass a check against your coarse state and your own settings. Anything held back is written down with its reason and shown to you in the app. Silent suppression that you cannot inspect is not something we do.

Where AI is involved — stated plainly

AI researches, summarises and helps rank almost everything in The Wire. We will not claim otherwise, because it would be untrue. What we commit to instead is narrower, and we tell you which parts of it a machine enforces: no invented facts, no invented quotes, no invented sources. Every source link is checked to be live before a story runs, and anything urgent enough to interrupt you must be carried by two independent outlets. The quote rule is a machine check too, since August 2026: a quoted sentence must be found verbatim in the source or the quote is removed. We ask the AI for one sentence copied out of the article, we fetch the article, and we look for it — and where a paywall or a refusal means we cannot read the article, the quotation is removed rather than published unchecked. Before that date this paragraph told you the opposite, because it was true: the comparison was written into the product and the briefing we asked for gave it nothing to compare. What it still does not mean is that a quoted sentence is a true one — it means those are the publisher's words and not ours.

Your personal data is not used to train any AI model — not ours, not anyone else's. The only automated processing of anything you type is turning a saved search, or a place or employer you add to "your world", into a numeric vector so stories can be matched to it. That conversion runs inside our hosting provider's infrastructure and is not retained by them or used for training.

9. Your rights, and how to use them

Under the UK GDPR you have the right to:

Be informed — this document.
Access a copy of your data.
Rectify anything inaccurate.
Erase your data ("the right to be forgotten").
Restrict how we use it while a dispute is resolved.
Portability — receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests, including profiling.
Withdraw consent at any time, as easily as you gave it. Withdrawal doesn't undo what was lawful beforehand.

Exercising these is free. We will not charge you and we will not make you justify yourself.

Things you can do right now, without asking us

Change or remove any topic you follow — the Topics panel in the app.
Clear your home area — the Topics panel, "Clear". It is gone immediately and local alerts stop.
Turn off notifications — in the app, or in your browser or phone settings.
See what The Wire knows about you and what has read it — your profile and its audit trail are visible to you in the app while signed in, under Settings → Personalisation.
Object to the personalised ranking — Settings → Personalisation, one switch, described in §8. Your edition stays ranked; it stops being ranked by anything learned about you.
Correct what apps have told us — "Forget what apps have told us", in the same place, clears the stored per-topic numbers.
Take a copy of all of it — Settings → Your data → "Download my data" hands you every record we hold about you as a file you can keep, open or pass on. No request, no waiting. The only things named but not printed are credentials — your push keys and your Apple grant token — because a stolen session must not be able to walk off with them.
Sign out — clears the cookie on this device and revokes the session on our servers, on every device, within seconds. A copy of your cookie taken from a shared or lost machine stops working.
Clear on-device storage — see the Cookie & Storage Policy.

Deleting everything

Three routes, all real:

In the app — Settings → Your data → "Delete my account". Two deliberate taps, with a confirmation step, and it takes effect immediately. Nothing about it requires leaving The Wire or asking us.
Revoke The Wire in Apple's settings — on iPhone: Settings → your name → Sign-In & Security → Sign in with Apple → The Wire → Stop using Apple ID. Apple notifies us, and we erase your profile, your reading records, your suppression records, your push subscriptions and your account row, and invalidate every session. This runs automatically, within seconds, and is not a manual promise.
Email privacy@databased.business from the address on your account, or tell us your account identifier. Same erasure, done by us, within one month and normally within 7 days.

Your data does not live in one place, and we would rather say so than describe a tidier system than the one we run. Erasure reaches your profile store, your account row, your reading and suppression records, your push subscriptions, the local stories written for your area, the nightly backup copies filed under your account, and every live session — and it asks Apple to end the Sign in with Apple grant as well. It is one action for you and several for us. If any part of it does not complete, we tell you which, rather than reporting success.

What survives is the consent ledger row recording that you asked — that entry is why we can prove we did it.

If you're unhappy

Tell us first — privacy@databased.business. You also have the right to complain directly to the UK's data protection regulator at any time:

Information Commissioner's Office · ico.org.uk/make-a-complaint · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

10. Children

The Wire is not intended for anyone under 16, and we do not knowingly collect data from under-16s. The Service carries unfiltered news about real events, and it links out to news websites we do not control. If you believe a child has created an account, email privacy@databased.business and we will delete it.

11. How we protect it

Everything travels over HTTPS. There is no unencrypted path.
Session cookies are HttpOnly, Secure and cryptographically signed. JavaScript cannot read them, and a tampered cookie is rejected rather than trusted. A token with no expiry is refused outright rather than treated as one that never expires.
Signing out revokes the session on our servers, not just in your browser — a copied cookie stops working within seconds, on every device.
Sign-out can only be triggered by the app itself: it is a POST with a same-origin check, so no other site can sign you out by embedding a link or an image.
Each user's profile is a separate isolated storage object. There is no shared table an error could spill across, and no master key that reads everyone.
Every feed and search request is filtered to your own data before results are assembled, so one reader's local stories cannot appear in another's edition.
We never execute or embed third-party content, which removes the single largest class of attack a news aggregator faces.
Backups are encrypted at rest and expire on a 30-day schedule.

No system is perfectly secure. If a breach occurs that risks your rights and freedoms, we will report it to the ICO within 72 hours and tell you directly where the risk is high.

12. Changes to this policy

If we change anything material — new data collected, a new recipient, a new purpose — we will raise the version number, update the date at the top, and tell you in the app before the change takes effect. Changes that only clarify wording are made quietly and noted here.

Version	Date	What changed
1.0	28 July 2026	First published.
1.0	2 August 2026	Clarification, no new data and no new recipient: §3 and §5 now state that a home area is not only stored but sent, to whom, what each request contains, and how often — the Environment Agency every 30 minutes, PlanIt at most once a day. The sending itself is not new; saying so is. §5 previously said these services "cannot tell … that the request relates to a person at all", which understated what a repeated request reveals; that clause has been replaced by the actual rate.
1.0	3 August 2026	Correction, no new data and no new recipient: §4 said "No special category data (Art. 9)" under a heading reading "design commitments, not gaps we intend to fill". For the fixed pick-list that is true and §3 still says so; for the free-text boxes it was a guarantee we cannot make, and the code that does the screening has instructed against making it since it was written. §4 now states what we ask for and points at §3 for the filter. §3 additionally names the languages the word list is written in, which it did not before.
1.0	12 August 2026	Update, no new data and no new recipient: the quote check described in the row below is now built and running. §8 said it was not a machine check and told you to treat a quotation on a card as unchecked; the briefing we ask the AI for now asks for a verbatim sentence out of the article, and the product fetches the article and looks for it, so both of those statements have stopped being true and have been replaced by what the check does and what it still cannot tell you. The Terms §2 carry the same update.
1.0	3 August 2026	Correction, no new data and no new recipient: §8 said every quoted sentence "must be found verbatim in the source, or the quote is removed", as one of three things we called testable. The rule is real and is what the AI is instructed to do, but the check that would enforce it has never run — the briefing we ask the AI for has no field for a quotation to test — so §8 now says that plainly and tells you to treat a quotation on a card as unchecked. The other two commitments in that sentence, and the live-link and two-source checks, are unchanged. The Terms §2 carry the same correction.

13. Contact

Data protection enquiries, access requests, deletion requests and complaints: privacy@databased.business.