Privacy Policy

Last updated 2026-08-22 · what has changed. This policy explains what personal data we hold about you, why, and the rights you have over it.

1. Who is responsible for your data

The data controller for Quidworth is HK Apps Limited, a company registered in England and Wales (company number 15830591). For anything in this policy, contact legal@quidworth.com. ICO registration: ZB797518.

2. What we store

Account data - your name, email address, a securely hashed password (never stored in plain text; we cannot see it), and an optional profile image.
The financial information you enter - your household's income, savings and investment accounts, pensions, properties, mortgages, debts, everyday expenses, and the scenarios and assumptions you set up. We treat this as sensitive in practice and protect it accordingly, even where the law does not class it as special-category data.
Session and technical data - session tokens, and the IP address and browser user-agent attached to a session, used to keep you signed in and to protect your account.
Correspondence - messages you send through our contact or feedback forms, kept while we handle your query.
Newsletter sign-ups - if you choose to subscribe, the name and email address you give us, the date and time you subscribed and confirmed, the page you subscribed from, and the exact wording you agreed to. Subscribing takes two steps: you enter your address, then confirm it from a link we email you - nothing is sent to you until you click that link, so an address entered by someone else never joins the list. You do not need an account to subscribe, and subscribing is entirely separate from having one.

We also measure how the site is used - page views, referring sites, country, and browser type - using Umami, an open-source analytics tool that we host ourselves on the same EEA servers as the rest of Quidworth. It is cookieless, stores no personal identifiers, and no analytics company receives it - the tool is ours, running on our own server. The figures we see are aggregate counts, not profiles of you.

On our free calculators we also record, in the same way, the rough ranges people enter, so we can see what the tools are actually used for. Three things about this matter, and we hold to all three: we record a range and never the number, so “£32,000” is recorded as “£30k-£40k”; we record only a short, fixed list of fields per calculator, so anything you type as free text - the names you give your debts, for instance - is never sent anywhere; and none of it is linked to your account, your session, or you. It tells us that people planning retirement tend to target a certain income. It cannot tell us, or anyone else, what you targeted.

We store nothing else. Quidworth does not connect to your bank, does not use third-party or advertising trackers, and does not buy or receive data about you from anyone else. The small number of cookies we set are listed in our Cookie Policy.

3. Why we process it, and the legal basis

Providing the service - storing your plan, computing projections, showing them to your household
Data used: Account data; the financial information you enter
Legal basis: Performance of a contract (UK GDPR Art. 6(1)(b))
Signing you in and keeping your account secure; preventing abuse of the service
Data used: Email, hashed password, session and technical data
Legal basis: Performance of a contract; legitimate interests (Art. 6(1)(b), (f))
Verifying your email address and resetting your password
Data used: Email address
Legal basis: Performance of a contract (Art. 6(1)(b))
Sending you our newsletter, if you have asked for it
Data used: Your name and email address, and your consent record
Legal basis: Consent (UK GDPR Art. 6(1)(a)); PECR reg. 22 - withdraw it any time
Recording your acceptance of our terms, and which version of this policy you were given
Data used: Document versions and timestamp
Legal basis: Legal obligation and legitimate interests (Art. 6(1)(c), (f))
Understanding aggregate site usage so we can improve Quidworth (self-hosted, cookieless analytics)
Data used: Anonymous, aggregated page views, referrers, country and browser type - never linked to your account
Legal basis: Legitimate interests (Art. 6(1)(f))
Understanding which ranges of figures people put into our free calculators, so we can set sensible defaults and build the right tools
Data used: Anonymous ranges only, never the figures themselves - for example “£30k-£40k”, not “£32,000”. Never linked to your account, and free-text you type is never sent
Legal basis: Legitimate interests (Art. 6(1)(f))

4. What we do not do

We do not sell your data. We do not share it for marketing or advertising. We do not profile you, make automated decisions about you, or use your financial information for anything other than showing your own household its own plan. The plan you build in your account is used for your plan and nothing else: it is never mined for statistics, and the anonymous calculator ranges described in section 2 come from the free calculators only, are never linked to an account, and are never derived from your saved plan. If we ever wanted to use your data for a new purpose, we would explain it to you first and proceed only with your explicit, specific, opt-in consent - doing nothing would mean nothing changes.

5. Where your data lives and how it's protected

Your data is stored on secure servers in Germany, within the European Economic Area, operated by our hosting provider, and is encrypted in transit. Passwords are never stored in a readable form. Your household's data is visible only to members of your own household - never to other users. We review our security measures regularly and restrict access to systems holding personal data.

No system is immune. If a breach of personal data happens and it is likely to put your rights or freedoms at high risk, we will tell you without undue delay, in plain language: what happened, what data was involved, what we are doing about it, and what we suggest you do. Where the law requires it we will also report the breach to the Information Commissioner's Office within 72 hours of becoming aware of it. We would rather tell you early and be wrong about the severity than tell you late.

6. Who else processes it

Three service providers process data on our behalf, under contract, only as needed to run the service. None of them may use your data for its own purposes.

Hetzner Online GmbH (Germany) - the servers on which Quidworth and its backups run.
Cloudflare, Inc. - sits in front of the site, directing traffic to our servers and protecting them from attack. It handles your IP address and the technical details of each request, and it terminates the secure connection, so it is capable of seeing traffic in transit. It stores nothing of your plan.
Brevo (Sendinblue SAS) (France) - sends your verification, password-reset and, if you have subscribed, newsletter emails. It receives your email address and the contents of those messages.

Separately, if you choose to sign in with Google rather than with a password, that sign-in happens with Google and Google will know you have an account with us. Google is not our processor in that exchange - it acts on its own account, under its own privacy policy. Using a password instead avoids this entirely.

7. International transfers

Everything you enter is stored in Germany, in the European Economic Area, and stays there. UK law permits transfers of personal data to the EEA under the UK's adequacy regulations, which recognise that your data has equivalent protection there. Our email provider is in France, also within the EEA.

One provider is not: Cloudflare, Inc. is a United States company, and although requests from the UK are normally handled by its London data centre, using a US-domiciled provider counts as a restricted transfer under UK GDPR. That transfer is covered by Cloudflare's data processing agreement, which incorporates the UK International Data Transfer Addendum - the safeguard UK law requires. If you sign in with Google, that exchange is governed by Google's own policy and may involve transfers outside the UK and EEA.

Apart from those, we do not transfer your data outside the UK and the EEA. If that changed we would put appropriate UK GDPR safeguards in place and update this policy first.

8. How long we keep it

For as long as your account exists. When you delete your account, your data is permanently deleted: for a household owner this removes the entire household and all its data; for a household member it removes your own account, your person, and the records you own. Where server backups exist, they are kept only for disaster recovery and old copies are deleted as backups rotate.

When you delete your account, you're offered an optional exit survey (why you're leaving, and an optional message). If you complete it, we keep your answer along with your original sign-up date, to understand why people leave - this is not linked back to you once your account is gone. If you also explicitly tick the box to let us follow up and leave an email address, we keep that email until we've been in touch or you ask us to delete it. If you skip the survey, or don't tick that box, nothing further is kept - your deletion is complete.

If you subscribe to our newsletter, we keep your name, email address and consent record until you unsubscribe, and for a short period afterwards so that we can prove we honoured your request and make sure we don't email you again by mistake. Every newsletter email carries a one-click unsubscribe link. Because a subscription is separate from an account, unsubscribing does not delete your account, and deleting your account does not by itself unsubscribe you - use the link in any email, or ask us and we'll do it.

9. Your rights

Under UK GDPR you have the right to:

Access your data - self-serve: “Download my data” in Settings gives you a complete copy as JSON.
Rectify anything inaccurate - every record you enter can be edited in the app.
Erasure- self-serve: “Delete my account” in Settings, effective immediately.
Portability - the JSON export is machine-readable and yours to take anywhere.
Restriction and objection - contact us and we will restrict or stop the processing in question unless the law requires otherwise.
Withdraw consent - where any processing relies on consent (none does today), you could withdraw it at any time.
Not be subject to automated decision-making - we make no automated decisions with legal or similarly significant effects.

For anything not self-serve, contact us and we will respond within one month.

10. Complaints

If you are unhappy with how we have handled your data, tell us and we will look into it properly. You may also raise the matter with the Information Commissioner's Office, the UK's data protection regulator.

11. Children

The service is for adults (18+). We do not knowingly hold data about children as account holders. Household records you create about family members (for example a child's savings account) are part of your household's data and under your control.

12. Changes to this policy

We keep this policy under review and update it to reflect changes to Quidworth, to how we process personal data, and to law and regulatory guidance. The version on this page is always the one in force, and the “last updated” date tells you when it last changed. Every change is recorded in our change log, dated, with a plain-English description of what changed. We do not make silent edits.

This policy is a privacy notice, not a contract. UK GDPR requires us to tell you how we handle your personal data; it does not require your agreement to the notice itself, and we do not ask for it. Where we rely on your consent for a particular purpose - at present, only our newsletter - we ask for that consent separately and specifically, and you may withdraw it at any time without affecting anything else. Updating this policy does not, by itself, change the lawful basis for anything we already do, so we will not interrupt you to re-accept it.

Material changes. A change is material if it alters how we handle personal data you have already given us - a new purpose, a new category of recipient, a longer retention period, or any transfer of your data outside the UK and EEA. We will tell you before a material change takes effect, by a notice in the app and by email to the address on your account, giving you at least 30 days where that is practicable. Where the change relies on your consent, we will ask for it separately and specifically, and taking no action will mean nothing changes for you. You can object to processing, or delete your account, at any time - see sections 8 and 9.

13. Contact

Privacy questions and rights requests: legal@quidworth.com.