Privacy policy

This is a small publication running on ordinary shared hosting with a PHP application and a MySQL database behind it. Everything it stores about you, you gave it: a comment, a newsletter sign-up, a message through the contact form, or an account you created.

There is no Google Analytics on this site. There is no advertising network, no remarketing pixel, no social media tracking script and no third-party analytics of any kind. Nothing you do here is measured for a company that is not us.

Home Designing Idea is the controller of the personal data described here. The site is hosted on shared hosting, and the hosting provider processes data on our behalf as part of running the servers, including the standard web server logs their platform keeps. The database sits on that same hosting.

When you leave a comment we store your name, your email address, the comment itself, the date, and optionally a website address if you supply one. These are written to a comments table in our database.

Your email address is never displayed publicly. It is used for exactly two things: producing the hash that fetches your avatar from Gravatar, and notifying you if someone replies to you. Your name, your comment and any website link you give are public, since that is the point of a comment.

Your IP address and browser user-agent string are stored against the comment. This is for spam control and abuse handling, which is our legitimate interest in keeping the threads readable. They are not used to profile you, they are not shown to other readers, and they are not shared.

Comments are moderated before they appear. Comments marked as spam are deleted periodically. Approved comments stay published with the article unless you ask for yours to be removed.

Comment avatars are loaded from gravatar.com. We send a one-way hash of your email address as part of the image address, never the address itself, and Gravatar returns either your avatar or a generic one. Because the image is fetched by your browser, Gravatar receives your IP address and user-agent, as any remote image would. Their privacy notice governs what they do with that.

If you would rather not appear there, use an email address that has no Gravatar account attached and a generic image is served instead.

Subscribing stores your email address, the page you subscribed from, and the date, in a subscribers table. There is no third-party mailing platform between you and us, so your address is not copied into another company's system.

We do not use tracking pixels to record whether you opened an email. Every email carries an unsubscribe link, and unsubscribing takes effect immediately. Ask and the record will be deleted outright rather than just marked as unsubscribed.

Messages sent through the contact form store your name, email address, subject, the message body, the reason you selected, the date and your IP address, in an enquiries table. The IP address is kept for abuse control on a public form.

We use the address to answer you and for nothing else. Contact messages are not added to the newsletter list and are not passed to anyone outside the publication.

Most readers never sign in and never need an account. For those who do, we store the name, email address and password on the account, with the password held only as a hash rather than as the password itself.

Signing in sets a session cookie named hdi_session. If you tick remember me, a second cookie named hdi_remember is set for 30 days so you are not signed out every visit. Both are strictly necessary for the sign-in feature and neither is set for signed-out visitors. The cookie policy has the detail.

No analytics package is installed. No advertising is sold or served. No affiliate links are used. No data is sold, rented or shared for marketing, and no profiles are built for advertising. There is no automated decision-making of any kind.

Because no non-essential cookies are set, there is no cookie banner. A consent prompt with nothing to consent to would be theatre.

Published comments are kept as long as the article they belong to is published, because a thread with the replies removed makes no sense. Comments held as spam are deleted periodically. Newsletter records are kept until you unsubscribe or ask for deletion. Contact messages are kept while the matter is open and for a reasonable period afterwards so that a follow-up has context, then deleted. Account records are kept until the account is closed.

Server logs kept by the hosting platform are retained on their schedule rather than ours.

You can ask for a copy of what we hold about you, ask for it to be corrected, or ask for it to be deleted. You can ask us to stop using it for a particular purpose, and you can withdraw consent to the newsletter at any time.

Use the contact form to make a request. Because we deliberately hold very little, most requests are quick to answer. Where the law requires us to verify that the request is genuinely yours, we may ask something that confirms control of the email address on the record.

The site is served over HTTPS. Passwords are stored as hashes. Form submissions are validated on the server and rate limited, and comment forms carry a hidden honeypot field plus a token check to slow automated abuse. Administrative pages sit behind authentication.

No small publication can promise perfect security. What we can do is hold as little as possible, which is the reason this page is so short.

If what the site does changes, this page changes first. Anything that materially affects readers, such as introducing analytics or advertising, would be described here plainly before it went live rather than absorbed into a general clause.