Privacy Policy

Hedgehog is committed to protecting your privacy. This policy explains what personal data we collect, how we use it, who helps us run the site, and your rights under UK GDPR and the Data Protection Act 2018.

1. Who we are

Hedgehog is a UK-based online directory of home education clubs and groups. It is run by an individual based in England, who is the “controller” responsible for your personal data. Contact us at [email protected]. If you need the name of the person responsible, for example to make a data protection request, email us and we'll give it to you.

2. What data we collect

• If you sign up as a family: your first and last name, email address and full postcode. From your postcode we work out a map location (the centre point of your postcode), and we keep a record of which listings we've already emailed you about.
• If you submit or claim a listing: your group's details (name, type, description, ages, schedule, venue address and postcode, website, and any public email or phone you give us), which appear on the public listing. We also collect your own contact name, email, phone, your role and any notes you add. These are private: only the Hedgehog team sees them, and they never appear on your listing.
• If you use “Message the organiser”: your name, email address and message.
• If you contact us through the contact form: your name, email address, subject and message.
• If you suggest an edit or request a removal: what you tell us, plus your email address if you choose to give it.
• If you chip in to support Hedgehog through the tip-jar platform we link to: the name and email address you give the platform, the amount, the date and any message you leave. If you pay with PayPal, we also see the name and email address on your PayPal account. We never see your full card or bank account number.
• Analytics: which pages are viewed and general information about the device and browser used (see section 6).
• Technical data: like any website, the services that run Hedgehog (see section 5) receive your IP address and browser details when you load a page or send a form.

Postcodes you type into the search on the map page are used to show you nearby groups. They aren't saved to our database (see section 6 for what your browser keeps).

3. How we use your data

• To show you groups near a postcode you search for
• To email families when new groups are added within 25 miles of their postcode
• To review, publish and update group listings, and to email an organiser when their listing goes live
• To pass your message on to a group's organiser so they can reply to you directly
• To reply to your messages, suggested edits and removal requests
• To protect the site and its forms from spam and abuse
• To understand how the site is used, so we can improve it
• To keep records of support payments, as tax rules require, and to read any message you leave with one

We don't send marketing emails or newsletters. The only emails we send are the weekly email to families who sign up, an email to an organiser when their listing goes live, messages you send through “Message the organiser”, and replies when you contact us.

Why we ask families for a full postcode

We use your postcode for one thing: telling you about groups within 25 miles of you. To measure 25 miles properly we need a precise starting point. An area code on its own (like OX29) can cover a wide area, so we ask for your full postcode. We turn it into a map location once, using postcodes.io (see section 5), and keep it with your signup. We don't show your postcode on the site or share it with group organisers.

The weekly email

Families who sign up get an email about new groups nearby, but only when there's something new. We check every day for groups that were added since you signed up, are within 25 miles of your postcode, and that we haven't already told you about. We email you at most once a week, and only when there's something new. Every email has an unsubscribe link, and mail apps that support it also show a one-click unsubscribe button.

Messages to organisers

When you use “Message the organiser”, we save your message and email it to the organiser's private address with your email as the reply-to, so they can reply to you directly. This means the organiser will see your name and email address. If we don't have an organiser address on file, your message comes to the Hedgehog inbox and we pass it on.

4. Legal basis for processing

• Consent: for the weekly email to families, and for Google Analytics cookies. Withdraw any time using the unsubscribe link in the email, or by changing your cookie choice (see section 6).
• Contract (steps you ask us to take): for reviewing and publishing a listing you submit or claim, and keeping it up to date.
• Legitimate interests: for publishing listing information that was submitted for public display, or that is already publicly available; passing your message on to an organiser when you ask us to; replying to contact-form messages, suggested edits and removal requests; protecting the site and its forms from spam and abuse (Cloudflare Turnstile); and counting visits without cookies (Vercel Web Analytics, and Google Analytics' cookieless signals before you choose) so we can see how the site is used and improve it. We only use what we need for each purpose, and you can object at any time by emailing us.
• Legal obligation: for keeping records of support payments for tax. Any message you leave with a payment is handled under legitimate interests, so we can read it and reply if you ask.

5. Who we share data with

We do not sell your data. We use these services to run Hedgehog:

• Supabase (Supabase Pte. Ltd., Singapore): our database, where everything you send us through the site is stored. The database is held on Amazon Web Services servers in Ireland.
• Vercel (Vercel Inc., USA): hosts and runs the website. The parts of the site that handle the forms you send run in Vercel's Dublin (Ireland) region; Vercel may also keep logs in the US. It also provides Vercel Web Analytics, which counts page views without cookies. We remove any postcode from the page address before it's sent.
• Google Analytics (Google Ireland Limited, with Google LLC in the USA): helps us understand how the site is used. It only sets cookies if you accept them (see section 6). If a page address contains a postcode you searched for, we cut it to the first part (for example, OX29 4AB becomes OX29) before Google sees it.
• Resend (Plus Five Five, Inc., USA): sends our emails, from its Ireland region. It stores email content and delivery records in the US. These are notifications to the Hedgehog team when someone uses a form on the site (they include the details entered), emails telling organisers their listing is live, “Message the organiser” messages, and the weekly email to families.
• Cloudflare (Cloudflare, Inc., USA): protects the site from attacks and helps it load quickly. Every visit passes through Cloudflare. It also runs Turnstile, the check on our forms that you're a person and not a bot. When we verify that check, we send Cloudflare your IP address. Cloudflare Access protects the admin area, which only the Hedgehog team uses.
• postcodes.io (run by IDDQD Limited, trading as Ideal Postcodes, UK): a UK postcode lookup that turns a postcode into a map location. It receives a family's postcode after signup, when our weekly email job first looks it up (from our servers, to find groups within 25 miles; a lookup that fails is retried after 30 days), a group's venue postcode (from your browser if you use “Find postcode on map” when adding a listing, and from our servers when we approve it), and postcodes you search for on the map page (straight from your browser). It receives only the postcode, never your name or email.
• Google Fonts and OpenStreetMap: our fonts load from Google Fonts and our map images from OpenStreetMap, so these services receive your IP address when you view a page.
• Group organisers: when you message an organiser, they receive your name, email address and message.
• Our tip-jar platform (Ko-fi or Buy Me a Coffee, whichever our support page links to): if you chip in, you pay on the platform's site, not ours. The platform and its payment provider (Stripe or PayPal) handle your payment under their own privacy policies, and pass us the details listed in section 2.

Emails to [email protected], including our notifications when someone uses a form on the site, are received in an Apple iCloud Mail inbox (Apple Distribution International Ltd, Ireland). Apple says it generally stores this data with Apple Inc. in the US.

Data sent outside the UK

Some of these services are based, or handle data, outside the UK. Where that happens, your data is protected in one of these ways:

• Ireland and the rest of the EEA are recognised by UK law as giving adequate protection to personal data.
• Vercel, Resend, Cloudflare and Google are certified under the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) for data sent to the US.
• Supabase is based in Singapore, and its support staff and some of its suppliers in the US and Singapore can access the data. These transfers are covered by the EU Standard Contractual Clauses with the UK's International Data Transfer Addendum, which are part of Supabase's data processing terms. Resend, Cloudflare and Google use the same clauses as a back-up to the UK-US data bridge, and Apple relies on Standard Contractual Clauses.

6. Cookies and analytics

On your first visit, a banner asks whether you accept analytics cookies.

• Google Analytics runs on every visit using Google's consent mode. Until you click Accept, it sets no cookies, but it still sends Google basic signals without cookies (for example, that a page was viewed), which Google uses to estimate visitor numbers. If you accept, it also sets analytics cookies so it can recognise repeat visits. Accepting only allows analytics: we don't show ads or use advertising cookies. Google says it doesn't store the IP addresses of UK visitors.
• Vercel Web Analytics counts page views without cookies, so it runs whether or not you accept.
• Your choice is saved in your browser's local storage so we don't ask again. To change it, clear this site's data in your browser and the banner will appear again.
• Security: Cloudflare doesn't set cookies on our pages for visitors. The Turnstile check on our forms runs in its own Cloudflare frame and may briefly store a token there to confirm you passed. The admin area, used only by the Hedgehog team, sets a sign-in cookie.
• Your last map search and map position are kept in your browser's session storage for that tab only, so the map shows the same results when you go back to it.

7. How long we keep your data

• Family signups: while you're signed up. If you unsubscribe we stop emailing you straight away, and we delete your signup within 12 months. Email us to have it deleted sooner.
• Listings and organiser contact details: while the listing is on Hedgehog, and for up to 12 months after it's removed.
• Listing submissions, including ones we don't publish: up to 12 months.
• Messages to organisers, contact-form messages, suggested edits and removal requests: up to 12 months.
• Support payment records (name, email address, amount and date): up to 7 years, because tax rules require us to keep financial records. Any message you leave with a payment: up to 12 months.
• Analytics: Vercel Web Analytics doesn't keep visitor sessions for more than 24 hours. Google Analytics keeps data for the period set in our account.

You can ask us to delete your data at any time (see section 8).

8. Your rights

Under UK GDPR you have the right to access, correct, delete, or restrict processing of your data. Email [email protected] and we will respond within 30 days.

You can stop the weekly email at any time using the unsubscribe link in any email. If you run a group, you can ask us to change or remove your listing using “Suggest an edit” or “Request removal” on the listing, or by email.

9. Complaints

You can complain to the UK's data protection regulator, the Information Commission (previously the Information Commissioner's Office, ICO), at ico.org.uk.