Privacy
Last updated 15 October 2026
The short version
- No tracking cookies, no advertising, no analytics.
- Nothing loads from Google, Facebook or any other third party.
- Your records are only used to run STC for you. They are never sold or shared.
- You can export everything, or have your account deleted, whenever you like.
Who is responsible
STC is run by Jake Flanagan, who is the data controller for the hosted service at app.sole-traders.uk and db.sole-traders.uk. For anything about your data, email privacy@sole-traders.uk.
Cookies and browser storage
The website and app set no cookies and store nothing in your browser when you first visit. The only things kept on your device are the ones below. Each is there because a feature you used needs it, which is why there is no cookie banner: UK law only asks for consent to storage that isn't needed for the service you asked for.
| What | Where | Why | How long |
|---|---|---|---|
| Light or dark mode | Website and app, browser local storage | Remembers the theme you picked. Only saved when you press the toggle. | Until you change it or clear your browser data |
| Login | App, browser local storage (encrypted) | Keeps you signed in between visits. | Until you log out |
| Server address | App, browser local storage | Which STC server the app talks to, if you changed it. | Until you change it or clear your browser data |
| Open database | App, browser session storage | Which of your databases this tab is showing. | Until you close the tab |
| Copy of your records | App, browser file storage | Lets the app open quickly and save changes before they reach the server. | Until you clear this site's data in your browser. Logging out does not remove it, so clear it on a shared computer. |
Cloudflare, which delivers the site, can set a short-lived security cookie if it suspects automated traffic. It is used only to tell people from bots.
What the app stores on the server
Your account: a username, your password (stored only as a one-way hash, never readable), and an email address if you choose to add one for password resets.
Your records: the items, sales, expenses and settings you enter. These can include your buyers' platform usernames and tracking numbers. Each database is backed up once a day, encrypted, keeping up to 30 backups.
Server logs
Like any web server, ours logs each request: the time, the page asked for, your IP address and rough country, and your browser type. That is used to keep the service secure and to find faults. The logs are replaced as they fill up, which takes a few weeks.
Why it's used
Your account and records are used to provide the service you signed up for (the "contract" basis under UK GDPR). Server logs are kept because there is a legitimate interest in keeping the service secure and working.
Who else handles it
Three companies help run the hosted service. None of them may use your data for their own purposes.
- Cloudflare delivers the website and app and passes traffic to the server, so your requests go through it. Some of that may happen outside the UK, covered by Cloudflare's data protection terms.
- OVHcloud provides the server your records are stored on.
- Resend sends password reset emails, so it sees your email address if you request one.
How long it's kept
Your account and records are kept until you delete them or ask for your account to be deleted. Backups of a database go when the database does. Server logs last a few weeks, as above.
Your rights
You can ask for a copy of your data, have it corrected or deleted, or object to how it's used. You can also export everything yourself from the app at any time. Email privacy@sole-traders.uk and you'll get an answer within a month.
If you're unhappy with how your data has been handled, you can complain to the Information Commissioner's Office at ico.org.uk.
If you self-host
If you point the app at your own server, your records go straight from your browser to that server and never reach ours. You are then the one responsible for that data. Cloudflare still serves the app itself to your browser.