Privacy Policy

Last updated: 21 August 2026

1. Who controls your data

Hughes Digital Studio Limited of 167-169 Great Portland Street, 5th Floor, London, England, W1W 5PF is the "data controller" for the personal data described in this policy. You can contact us about privacy matters at hello@hughesdigitalstudio.co.uk.

2. What we collect

Account details: your email address and a securely hashed password (we never store your password in plain text, and we cannot see it).
Movement data: the date and time of each kick/movement you log, and whether it was logged live or added afterwards. This is health-related information about your pregnancy.
Billing information: your card details are entered directly into forms hosted by our payment processor, Stripe. We never receive or store your full card number — we only receive a reference token from Stripe and confirmation of whether a payment succeeded.
Security logs: we briefly record the IP address of failed sign-in attempts (for up to 15 minutes) to prevent automated password-guessing. We don't otherwise track your IP address, location, or device.
Basic traffic statistics: when any page is loaded, we log the page path, the referring website's domain (not the full URL), and a coarse country derived at our hosting provider's network edge — never a device fingerprint, and never your IP address itself. This is not tied to any cookie or persistent identifier, so we can't link separate visits to the same person, only see aggregate usage like "how many people visited the homepage this week."
Cookies: we set one strictly-necessary cookie (jfk_session) to keep you signed in. It contains no personal data beyond your email address and an expiry date, and can't be read by any script (including ours) other than our own server. During checkout, Stripe may set its own cookies for fraud prevention — see Stripe's privacy policy. We don't use analytics, advertising, or tracking cookies, so we don't show a cookie banner — these cookies are all "strictly necessary" and exempt from consent requirements under UK PECR rules.

3. Special category (health) data, and your explicit consent

Records of your pregnancy movements are likely to count as "special category data" (health data) under UK GDPR, which has extra legal protection. We only process this data because you have given your explicit, separate consent to it at sign-up (a dedicated checkbox, distinct from accepting these Terms). You can withdraw this consent at any time by deleting your account from the Account tab, which permanently erases this data.

4. Why we process your data, and our legal basis

Providing the Service (creating your account, logging movements, showing your dashboard) — necessary to perform our contract with you (UK GDPR Art. 6(1)(b)), and, for movement data specifically, your explicit consent (Art. 9(2)(a)).
Taking payment for the one-off £2.99 fee after your trial — necessary to perform our contract with you (Art. 6(1)(b)).
Preventing abuse (e.g. rate-limiting repeated failed logins) — our legitimate interest in keeping the Service secure (Art. 6(1)(f)).
Understanding how the Service is used, via the basic, non-identifying traffic statistics described above — our legitimate interest in improving the Service (Art. 6(1)(f)).

5. Who we share it with

We use a small number of trusted service providers ("processors") to run the Service:

Stripe, Inc. — processes payments and stores card details on our behalf. See Stripe's privacy policy.
Netlify, Inc. — hosts the app, runs its backend functions, and stores account and movement data. See Netlify's privacy policy.

We do not sell your data, and we do not share it with anyone else, except where required by law (for example, a valid court order).

6. International transfers

Stripe and Netlify may process or store data outside the UK/EEA (for example, in the United States). Where that happens, they do so under appropriate safeguards, such as the UK International Data Transfer Addendum or Standard Contractual Clauses.

7. How long we keep your data

We keep your account and movement data for as long as your account is active. If you cancel your trial or delete your account from the Account tab, we permanently and immediately delete your account record, all logged movements, and your saved card reference with Stripe. Failed sign-in attempt records are automatically cleared after 15 minutes.

8. Your rights

Under UK GDPR, you have the right to:

Access the personal data we hold about you;
Correct inaccurate data;
Erase your data ("right to be forgotten") — self-serve this any time via Account → "Cancel trial & delete my data";
Restrict or object to our processing of your data;
Receive a copy of your data in a portable format;
Withdraw consent to processing of your movement data at any time (by deleting your account).

To exercise any of these rights, email hello@hughesdigitalstudio.co.uk. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), though we'd appreciate the chance to help first.

9. How we protect your data

Passwords are hashed (never stored in plain text) using industry-standard techniques. All traffic to the Service is encrypted with HTTPS. Sign-in sessions use a signed, tamper-proof, HTTP-only cookie that can't be read or altered by JavaScript. Repeated failed sign-in attempts from the same source are temporarily blocked.

10. Children

The Service is intended for adults (18+) and is not directed at children. We do not knowingly collect data from children.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we'll take reasonable steps to let existing users know (such as an in-app notice) before they take effect.

12. Contact

Questions about this policy, or want to exercise your rights? Email hello@hughesdigitalstudio.co.uk.