Privacy Policy

Last updated: {{UPDATED}}

1. Who controls your data

{{ENTITY}}, {{ADDRESS}}, is the data controller for the Service. Contact: {{SUPPORT_EMAIL}}.

2. The short version

There is no account, no sign-up form and no server-side record of who you are or what you have read. Your checklist progress — which items you have ticked — is saved only in your own browser's local storage and is never transmitted to us. We could not answer "what has this visitor done on the site" even if asked to, because we do not have that information.

What follows is the complete, precise version of that statement, including the advertising we run to keep the Service free.

3. What we process, and why

Data	Purpose	Legal basis	Retention
Checklist reading progress (which items are ticked)	Lets you resume where you left off	—	Stored only in your browser; we never receive it, so we cannot retain it
IP address, on the checklist-download endpoint only	Rate limiting, to stop automated abuse of the PDF generator	Legitimate interest (protecting the Service)	Up to 1 hour, then automatically expired
Standard web server logs (request path, status code, timestamp)	Operating and securing the Service	Legitimate interest	Short-lived, per our hosting provider's default retention
Advertising identifiers / cookies (only if you consent)	Showing and measuring ads that fund the free Service	Your consent	Set by Google; see section 5

We never see or process any card, bank or payment details, because none are collected — the Service is free.

4. Processors

These providers process the limited data above on our behalf, strictly to run the Service:

Vercel — hosting and content delivery.
Upstash — stores the checklist catalogue itself (the published content, not personal data about visitors).
Google AdSense — advertising, only after consent where required (section 5).
Cloudflare — domain name system and, if enabled, bot protection.

Some of these providers may process data outside your country, including outside the European Economic Area. Where that happens, it relies on their own compliance mechanisms (such as the EU Standard Contractual Clauses) — see each provider's own privacy policy for specifics.

5. Advertising and cookies

The Service is funded by display advertising served through Google AdSense. Where required by law (including for visitors in the EEA, UK and Switzerland), ads are only personalised after you give consent through the on-page consent banner; declining does not stop you using any part of the Service, including downloads.

Google may set cookies and use device identifiers to select and measure ads. You can withdraw consent at any time by reopening the consent choices (link in the footer once cookies are set), or manage ad personalisation directly at adssettings.google.com. See Google's own how Google uses information from sites that use its services.

6. Your rights

Depending on where you live, you may have the right to:

ask what data we hold about you (in most cases: none beyond a short-lived rate-limit counter);
ask us to correct or delete it;
object to or restrict certain processing;
withdraw advertising consent at any time, without affecting past lawful processing;
lodge a complaint with your local data protection authority.

To exercise any of these, contact {{SUPPORT_EMAIL}}.

The supervisory authority for {{ENTITY}} is {{DPA_AUTHORITY}}.

7. Children

The Service is not directed at children and we do not knowingly collect data from them.

8. Changes to this policy

We may update this policy as the Service changes. Material changes — in particular anything that changes what we collect — will be reflected in the "Last updated" date above.