Legal
Privacy Policy
Last updated: 29 April 2026
1. Who we are
WordTipper ("we", "us", "our") is a local journalism platform based in Somerset, England. We operate the website wordtipper.com.
We are the data controller for the personal data we collect through this website. If you have any questions about how we handle your data, please contact us.
2. Data we collect
Account data
When you create an account we collect your email address, password (hashed), display name, profile bio, avatar, and followed towns.
Content you create
Articles, comments, and private ads you write are stored in our database. Published articles are publicly accessible.
Payment & billing data
Payment is processed by Stripe. We do not store card numbers. We store a Stripe customer ID and subscription status.
Usage data
We record article view counts (anonymous) and ad impressions to power analytics and payout calculations.
Support & reports
Contact form messages and "Report a problem" submissions store your message and email address.
3. How we use your data
- To provide the service — logging you in, saving your articles and settings.
- To calculate and pay earnings — hearts and views are used in monthly payout calculations.
- To serve adverts — matching ad placements to the correct towns.
- To send transactional emails — account confirmation, article notifications, payment receipts (requires SMTP, not yet active).
- To moderate content — flagged comments and reported problems are reviewed by our admin team.
We do not sell your personal data to third parties. We do not use your data for advertising profiling.
4. Legal basis for processing
- Contract — processing your account data is necessary to provide the service.
- Legitimate interests — anonymised analytics and content moderation.
- Consent — non-essential cookies are set only after you accept our cookie banner.
- Legal obligation — certain financial records are retained as required by UK law.
5. Third-party services
- Supabase — database, authentication, and file storage. Hosted in EU West Europe.
- Stripe — payment processing for ad packages and Publisher Pro subscriptions.
- Resend — transactional email delivery (not yet active).
- Google Analytics 4 — anonymised site analytics (not yet active; requires cookie consent).
6. Cookies & local storage
Strictly necessary
We use localStorage and sessionStorage to store your login session and UI preferences. These are essential for the site to work.
Analytics cookies
When you accept our cookie banner, Google Analytics may set cookies (e.g. _ga). You can withdraw consent by clearing your browser cookies.
7. Data retention
- Account data — kept while your account is active. Permanently removed on account deletion.
- Payout records — retained for 7 years as required by UK tax law.
- Support messages — retained for up to 2 years.
8. Your rights
Under UK GDPR you have the right to access, rectify, erase, port, object to, or restrict processing of your data. To exercise these rights, contact us or use account deletion in Account Settings. You may also complain to the ICO.
9. Security
- All data transmitted via HTTPS/TLS encryption.
- Passwords hashed by Supabase Auth (bcrypt).
- Row-level security (RLS) on all database tables.
- No payment card data stored on our servers — handled entirely by Stripe.
10. Changes to this policy
We may update this policy from time to time. When we make significant changes, we will update the "Last updated" date at the top of this page.