== PRIVACY NOTICE & BUSINESS DETAILS ==
> THE SHORT VERSION
- No cookies, no ad trackers. While you browse, everything comes from odd-signal.net. Only when you press send on a form or a scan does one outside check run: a Cloudflare test that you're human. Nothing is sold, and nobody is added to a mailing list.
- If you use a form, the site itself emails your details to Ivan, through Cloudflare, our host. No form-delivery company is involved.
- A cookie-free visit counter notes which windows get opened. It can't recognise you from one day to the next, and you can switch it off.
- The camera toy (Dither-Lab) works entirely on your device. Nothing it sees is uploaded.
- You can see, correct or delete what we hold about you. Unhappy with how we handled it? Complain to us, or to the ICO.
> WHO WE ARE
Odd Signal is the trading name of Ivan Brown, a sole trader. Ivan is the data controller for the personal data described here.
- Based in Southend-on-Sea, UK. Postal address on request.
- Email: hello@odd-signal.net
- ICO registration: pending. The number goes here once it is issued.
- Not VAT-registered. The prices shown on this site are the full price.
> WHAT WE COLLECT, WHY, AND FOR HOW LONG
- Contact form
- What: your name, email address, the service you picked, and your message.
- Why: to reply, and to quote for or do the work if you want us to.
- Lawful basis: steps you ask for before a contract (UK GDPR Art 6(1)(b)). For general messages, our legitimate interest in answering them (Art 6(1)(f)).
- Kept: enquiries that don't become work are deleted after 12 months. For clients, correspondence is kept for 6 years after the work ends, for tax records and possible legal claims.
- Free check-up form
- What: your website address and email address.
- Why: to record your check-up and send it to you.
- Lawful basis and how long: the same as the contact form.
- Email to hello@odd-signal.net
- What: whatever you send. Cloudflare Email Routing forwards it to Ivan's mailbox.
- Lawful basis and how long: the same as the contact form.
- Signal Autopsy (the six-check website scanner)
- What: the web address you type, plus a hash of your IP address that changes every day. The hash only exists to limit each visitor to 5 scans a day.
- What goes elsewhere: our server, on Cloudflare, fetches that site's public pages, and its domain name is looked up at rdap.org and the domain registry. Your IP address is never passed on.
- Lawful basis: legitimate interests: running the tool you asked for, and preventing abuse (Art 6(1)(f)).
- Kept: scan results are cached for 24 hours. The daily hash lasts until the end of the day (UTC). Both are deleted at the first counted visit to the site after that.
- Visit counter
- What: which windows and apps get opened and for how long, whether a form was sent (never what was in it), and phone or desktop layout. Events are linked by an ID made from a one-way hash of the date, your IP address and your browser type. The ID changes every day. Your raw IP address and browser details are never stored, and nothing is stored on your device.
- Why: to see which parts of the site people actually use.
- Lawful basis: legitimate interests (Art 6(1)(f)). No consent is needed under the "statistical purposes" exception in the Privacy and Electronic Communications Regulations, because you're told about it here and can object for free.
- Kept: 12 months, then deleted.
- Switch it off: the counter already stays off if your browser sends Do Not Track or Global Privacy Control. Or use the switch below, which only affects this browser:
- The human check (when you press send)
- What: when you press send on a form or run a scan, your browser loads Cloudflare Turnstile, which checks you're a person and not a spam bot. Usually you see nothing; sometimes it asks for one click. It reads signals from your browser and device (not what you typed) and your IP address. Our server only receives a yes/no answer from Cloudflare.
- Lawful basis: legitimate interests in keeping spam and abuse out of the forms and scanner (Art 6(1)(f)).
- Who: Cloudflare, as our processor, and also as a controller for improving its bot detection, under its Turnstile privacy addendum.
- Keeping the site up and secure
- What: your IP address and request details, handled by Cloudflare (our host) to deliver pages, block attacks and rate-limit abuse. If a page fails to load, your browser may send Cloudflare a short network error report.
- Lawful basis: legitimate interests in a working, secure site (Art 6(1)(f)).
- Kept: by Cloudflare for short periods, under its data processing terms.
- The toys
- Dither-Lab's camera, BootMaker and the share cards all run in your browser. Nothing is uploaded unless you choose to download or share the result yourself. Toys shown inside the site come from our own subdomains (*.odd-signal.net), also hosted on Cloudflare.
> WHO RECEIVES IT
- Cloudflare, Inc.: hosting, database, form delivery, email routing, security and the human check on forms. It processes data in the UK and abroad, including the USA. Cloudflare is certified to the UK Extension of the EU-US Data Privacy Framework (the "UK-US data bridge") and bound by its data processing agreement.
- Ivan's email provider: stores the resulting emails.
Nobody else, unless the law requires it.
> COOKIES AND YOUR DEVICE
This site sets no cookies and stores nothing on your device, with one exception you control. If you press "Stop counting me", your browser remembers that choice (a localStorage entry called oddsignal:no-count). The embedded toys may remember small settings on their own subdomains: Dither-Lab remembers simple or advanced mode, and clouds and murmur keep a one-off retry flag for the session. None of this needs consent, so there is no cookie banner.
> YOUR RIGHTS
You can ask to see, correct or delete your data. You can also ask us to restrict it, or to hand it over in a portable format, and you can object to any use based on legitimate interests, including the visit counter. Email hello@odd-signal.net with the subject "Data request". It's free. We reply within one month and may ask you to confirm who you are first.
You don't have to give us any personal data. We only need an email address if you want a reply. There is no automated decision-making or profiling.
> COMPLAINTS
Tell us first: email hello@odd-signal.net with the subject "Data complaint". We acknowledge every complaint within 30 days, look into it, keep you updated, and tell you the outcome.
You can also complain to the UK regulator, the Information Commissioner's Office (ICO), which becomes the Information Commission on 30 September 2026: ico.org.uk/make-a-complaint · 0303 123 1113.
> SECURITY
- HTTPS everywhere, with HSTS.
- A strict content security policy: pages run code only from odd-signal.net, plus Cloudflare's human check once you press send.
- No ads or trackers. Fonts are self-hosted.
- Visitor IDs are one-way hashes that change daily, and raw IP addresses are never stored.
> COUNCILS AND INSTITUTIONS
When we handle personal data on your behalf (for example, a website's form submissions or CMS accounts), we act as your processor under written Article 28 terms. Our data protection policy, processing terms, security statement and sub-processor list are available on request from hello@odd-signal.net.
> CHANGES
When this notice changes, the version and date at the top change too.