This policy explains how Tim Lord handles personal data when you use timlord.co.uk.
Who is responsible
Tim Lord is the data controller and operates as a sole trader in Newquay, Cornwall, United Kingdom. Privacy enquiries and data-rights requests can be sent to hello@timlord.co.uk.
What the site processes
Most public content can be read without providing personal information. The application may process technical request data needed to deliver and secure the site. If you create or use an account, it processes authentication details such as your email address, account profile, session information, role and active access entitlements.
When you deliberately contact Tim or request a service, the information you submit is used to respond to that request. This application does not send form contents, email addresses, usernames, account identifiers or protected member content to Google Analytics.
Playing a music release, or loading a video inside an article, connects your browser to the provider you chose — currently YouTube, Spotify, SoundCloud or Apple Music. Nothing is requested from them until you allow external media or load that one player deliberately. Once you do, that provider receives the request directly and handles it under its own terms and privacy policy, which this site cannot control. No account details, email address or identifier from this site are sent with it.
If you press Like on a piece of content, your browser generates a random value and sends it once so the reaction can be recorded. The site stores only a one-way hash of that value alongside the content and the time. It does not store your IP address, browser details, email address, account or any social-network identifier with a like, and it does not share the reaction with any third party. The random value is kept in your own browser storage and is removed when you clear site data.
The newsletter, and asking for a resource
Nothing is collected for the newsletter unless you type an address into one of its forms and submit it. When you do, that address is normalised, recorded as pending, and sent one email asking you to confirm. Nothing else is sent until you click the link in it, and if you never do, nothing follows. Unsubscribing is a single click in any email.
If you asked for a specific resource, which resource you asked for is recorded alongside the address so the right thing can be sent after you confirm. That is the only reason it is kept.
Being on the mailing list is a completely separate thing from having an account. Joining the list does not create an account, and it gives you no member access. Equally, having an account — including a paid Workshop account — does not put you on the mailing list. The two are never joined up automatically.
Once the newsletter runs on Mailchimp, that address is processed by Mailchimp under its own terms as a data processor, and Mailchimp sends the confirmation. No newsletter address is shared with anyone else, sold, or used to build an advertising audience.
These forms tell you nothing about the address you typed. Whether it is new, already on the list, already confirmed, or simply mistyped, the reply is the same. That is deliberate: it means the form cannot be used to find out whether somebody else is a subscriber.
Work with me enquiries
If you send a message through the form on the Work with me page, the name, email address, what it is about and the message itself are stored so that Tim can read and reply to it, and a copy may be emailed to him. That is the only use made of it. Sending an enquiry does not create an account, add you to the mailing list or grant any access. The page you sent it from is recorded; nothing else about your visit is.
Things you can use on the site
The small tools in Things — the copy checker, the calculators, the games — run entirely in your own browser. What you type into them is never sent to this site or anywhere else, is not stored, and is not seen by anyone. They request no microphone, camera or location access. Each one says so on its own page.
Saved content
If you are signed in and save something, the site records which account saved which item and when. Nothing else. Your saved list is readable only by your own account, and saving something never changes what you are allowed to read.
Why data is processed
- To provide requested pages, authentication and member access.
- To keep the application and accounts secure.
- To respond to enquiries or provide an agreed service.
- With consent, to understand aggregate visits to a limited set of non-sensitive public pages.
- With consent or a one-time action, to load approved external media.
The relevant legal bases are performance of a contract or steps requested before a contract, legitimate interests in operating and securing the site, legal obligations, and consent for optional analytics or external media.
Service providers
The application uses Next.js and production application-hosting infrastructure, Supabase for database and authentication services, and configured S3-compatible object storage for editorial media. These providers process only the information needed to supply their service under their own contractual and security terms.
Google Analytics 4 is optional and does not load until analytics consent is granted. The existing Tim Lord GA4 property is used to measure selected public page views. Advertising storage and advertising personalisation remain denied. Privacy-enhanced YouTube embeds remain blocked until external-media consent or a deliberate one-time load action.
Stripe, PayPal, Meta, LinkedIn, TikTok, Google Ads and other advertising trackers are not part of this application at this stage.
International processing
Some infrastructure or optional providers may process data outside the United Kingdom. Where required, the provider is expected to use a lawful transfer mechanism such as an adequacy regulation or approved contractual safeguards.
Retention and security
Personal data is retained only as long as needed for the purpose it was collected, account operation, security, or legal obligations. The platform uses access controls, server-authoritative entitlements, protected media delivery and row-level database security. No internet service can guarantee absolute security.
Your rights
Depending on the circumstances, UK data-protection law gives you rights to access, correct, erase, restrict or object to processing, request portability, and withdraw consent. Contact hello@timlord.co.uk to exercise a right. You may also complain to the Information Commissioner's Office.
Your choices
Optional analytics and external media are off by default. Use Cookie settings in the footer at any time to change or withdraw saved consent. See the Cookie policy for the exact categories and storage currently used.
Changes
This policy will be updated when the application or its real processing changes. The date above identifies the current version.