What this site does with your information.

This site belongs to Works For All Ltd. If anything here matters to you, write to us at hi@worksforall.org and a person will read it.

There is no analytics tool on this site. No Google Analytics, no advertising pixel, no heat map, no third-party script watching what you read. Nobody is counting your visit, so nobody can sell it on.

The typefaces, the pictures and the still images on the videos are served from this site’s own address rather than from Google Fonts, an image network or YouTube, so opening a page does not tell another company that you were here. The one way that could change is if somebody editing the site ever pastes in a picture that lives on another company’s server; the editor warns them when they do, and everything on the site today is our own.

If you are reading the site, it sets no cookies at all.

The cookie this site sets is for the few people who edit it. Signing in leaves one in the editor’s browser, and it lasts fourteen days from the last time it was used rather than fourteen days from signing in: an editor who comes back each week stays signed in, and one who stops visiting is signed out a fortnight later. There is no public sign-up, so if you have not been given an editor’s account, that cookie will never reach you.

For editors only: signing in also records the internet address the sign-in came from and what the browser says it is, kept with the session and thrown away when the session ends. That is the sign-in software’s own doing, and it applies to the handful of people who edit this site, not to anybody reading it.

The contact form asks four things: your name, your email address, a subject and a message. Nothing else is collected. Replying to the email we get replies to you, because the address you gave is the one set to reply to.

What happens next depends on what the spam checks make of it, and we would rather say so plainly than give you a promise that only holds most of the time. Nearly always, your message is saved in this site’s own database and emailed to us, so it is not lost if an inbox is. If the checks judge it to have come from a machine it is still saved, where an editor can read it, but it is not emailed. If a great many messages arrive from one place in an hour we stop taking them, and then it is neither saved nor emailed — but you are told so on the screen, not thanked. And if the email fails for a reason of our own, your message is still saved and you are told to write to us directly. The one thing that never happens is that you are told a message arrived when it did not.

Saved beside your message is what the spam checks made of it: whether they let it through, marked it or turned it away, why if there was a reason, the score they gave it, the hashed address described below, and the time it arrived. That is the whole of what a message leaves behind.

We use what you send to answer you, and for nothing else. There is no mailing list and nothing is sent to you automatically.

A form that anybody can post to gets abused, so each message is checked before it reaches us: a hidden field robots fill in and people do not, a check on how quickly the form was completed, a limit on how often the same address or the same place can write, and a look at the wording. Only clear evidence of a machine keeps a message out of our inbox, and even then it is kept where an editor can read it. Being unsure about you never does: any doubt short of that only marks a message for a person to look at, because it must not cost you an answer.

For the per-place limit we store a one-way hash of the internet address the message came from. A hash is a scrambled fingerprint made with a secret ingredient: it lets us see that ten messages came from the same place without ever holding the address itself, and it cannot be turned back into one. It is used for that limit and for nothing else, and nothing about your browser is kept alongside it.

We deliberately do not use Google reCAPTCHA. It would put a tracker on pages meant for parents and for people working in perinatal services, which is too high a price for a bit less spam.

A course you take here remembers which lessons you have finished so you can pick up where you left off. That is a list of lesson names kept in your own browser’s storage and it is never sent to us: we cannot see how far anybody has got. It follows the device rather than you, so the same course on your phone will not know what you did on your laptop, and clearing your browser data clears it.

Some lessons have a video. Nothing at all is asked of YouTube until you press play — not the player, and not the still picture you see beforehand, which is a copy kept on this site and served from this site’s own address. A page with a video on it therefore tells YouTube nothing by being open, and sets no YouTube cookies.

When you do press play, the player loads from youtube-nocookie.com, YouTube’s privacy-enhanced address. From that moment you are watching a video on YouTube and Google’s own terms apply to it.

The site is hosted on Vercel, its database is hosted by Neon, and email leaves through Resend from the address mail.worksforall.org. They handle this information only so that the site can run and so that a message can reach us.

We keep an enquiry while we are dealing with it, and for as long as it is useful to have a record of the conversation. We have not set a fixed period, and we would rather say so than invent one here. What matters more is the next paragraph: you can ask us to delete yours whenever you like.

Email hi@worksforall.org and tell us roughly when you wrote and which address you used, so we can find the right message. You can ask for a copy of what we hold, ask us to correct it, or ask us to delete it. It costs nothing and we will not make it difficult.

If you think we have handled your information badly, you are entitled to complain to the Information Commissioner’s Office, the UK regulator for this.

By reading the code that runs this site, so it describes what the site actually does rather than what a template says it might. It has not been reviewed by anyone with a legal or data protection background, and it should be checked by someone qualified before it is relied on.

If what the site does changes, this page changes with it. The date at the top is the date this notice last changed.