Privacy Policy
Phatmedia Last updated: July 2026
1. Who we are
Phatmedia is operated personally by Dave Nicholson. For the purposes of UK data protection law, Dave Nicholson is the data controller for personal data collected through this service.
Contact: [email protected]
2. What data we collect and why
2.1 Account data
When you register for an account, we collect your email address and nickname. This data is necessary to create and maintain your account and to provide the service you have signed up for.
Lawful basis: Contractual necessity. Processing is required to perform the contract between you and Phatmedia when you create an account.
2.2 Server and network log data
Our web server automatically records IP addresses as part of standard server logs. These logs are used solely for security monitoring and technical debugging. They are not linked to user accounts or used for any profiling or tracking purpose.
Traffic to this site is also routed through Cloudflare, which operates as a reverse proxy in front of our servers. As part of delivering and protecting the site, Cloudflare records connection metadata including IP addresses, request headers, and the pages requested. This is used for content delivery, caching, denial of service protection, and bot mitigation.
Lawful basis: Legitimate interests. Retaining server and network logs for a limited period is necessary to maintain the security, availability, and stability of the service.
Retention: Our own server logs are retained for a maximum of 30 days, after which they are automatically deleted. Cloudflare retains its edge logs and security analytics under its own retention policy, which we do not control. See section 4.
2.3 Cookies and local storage
This site uses the following strictly necessary cookies and local storage items:
| Name / Key | Purpose | Type |
|---|---|---|
| Authentication token (JWT) | Maintains your logged-in session | Strictly necessary cookie |
| Theme preference | Stores your chosen light or dark display mode | Strictly necessary cookie |
| __cf_bm | Cloudflare bot detection. Distinguishes human visitors from automated traffic. Expires after 30 minutes of inactivity. | Strictly necessary cookie, set by Cloudflare |
| cf_clearance | Records that a visitor has passed a Cloudflare security challenge, so that the challenge is not repeated during the session. | Strictly necessary cookie, set by Cloudflare |
These are used solely to operate core site functionality and security as you have configured it. They do not track behaviour across other websites, build advertising profiles, or serve any advertising purpose. No consent is required for strictly necessary cookies under UK PECR.
We do not use any analytics, advertising, or third-party tracking cookies.
3. Who we share your data with
We do not sell your personal data or share it with third parties for marketing purposes.
Your account data is processed by Amazon Web Services (AWS), which provides authentication infrastructure (AWS Cognito) and related cloud services. AWS acts as a data processor on our behalf under a Data Processing Addendum.
Traffic to this site is routed through Cloudflare, Inc., which provides DNS, content delivery, and security services. Because Cloudflare operates as a reverse proxy, it processes all requests to the site, including IP addresses, request headers, and connection metadata, and sets the strictly necessary cookies listed in section 2.3. Cloudflare acts as a data processor on our behalf under its Data Processing Addendum.
Both AWS and Cloudflare may process data in regions outside the United Kingdom. Cloudflare in particular routes requests through whichever of its global data centres is closest to the visitor. Where data is transferred internationally, this is done under Standard Contractual Clauses together with the UK International Data Transfer Addendum, providing an appropriate safeguard for your data.
No other third parties receive your personal data.
4. How long we keep your data
| Data type | Retention period |
|---|---|
| Email address and nickname | Retained for the duration of your account. Deleted upon account closure. |
| Our server log data (IP addresses) | Maximum 30 days, then automatically deleted. |
| Cloudflare edge logs and security analytics | Retained by Cloudflare under its own retention schedule as our processor. We do not control this period. |
| Authentication tokens | Session-based. Expire according to session configuration. |
| Cloudflare security cookies | __cf_bm expires after 30 minutes of inactivity. cf_clearance is a session cookie lasting up to 24 hours. |
5. Your rights
Under UK GDPR, you have the following rights regarding your personal data:
- Right of access - you can request a copy of the personal data we hold about you.
- Right to rectification - you can ask us to correct inaccurate data.
- Right to erasure - you can ask us to delete your personal data, subject to any legal obligations.
- Right to data portability - you can request your data in a structured, commonly used format.
- Right to object - you can object to processing based on legitimate interests.
- Right to restrict processing - you can ask us to limit how we use your data in certain circumstances.
To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month.
6. Complaints
If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO).
ICO website: https://ico.org.uk
ICO helpline: 0303 123 1113
We would appreciate the opportunity to address any concerns directly before you contact the ICO, so please reach out to us first if possible.
7. Changes to this policy
We may update this policy from time to time. Where changes are material, we will notify you by updating the date at the top of this page. Continued use of the service following any update constitutes acceptance of the revised policy.
Data controller: Dave Nicholson, trading as Phatmedia. Contact: [email protected]