Privacy Policy

Wogglebox is a kit and equipment management platform designed for Scout groups and volunteer organisations. The platform is operated by Joss Gamble ("we", "us", "our").

We are committed to protecting your privacy and handling your data responsibly. This policy explains what information we collect, how we use it, and your rights regarding your data.

We collect the following types of information:

Account information: Your name and email address, provided when you create an account or sign in via Google or Microsoft. We do not collect passwords for users who sign in via OAuth providers.

Group and inventory data: Information you enter about your group, including group name, meeting location, equipment inventory, bookings, uniform allocations, repair records and inspection records.

Usage data: Basic information about how you interact with the platform, including which pages you visit and features you use. This is collected through standard server logs and hosting provider analytics.

Contact form submissions: If you contact us through the platform, we store your name, email, and message.

Newsletter preferences: If you choose to subscribe, we store your email address, optional name, the source of the signup, the wording you consented to and timestamps recording subscription, synchronisation and unsubscription changes.

Community poll responses: If you take part in a Wogglebox newsletter or community poll, we store the poll identifier, your selected option, campaign attribution and response timestamps. To maintain one current vote per browser, we also store a one-way hash of a random browser token. Poll responses are not stored with your name, email address or IP address.

We do not collect sensitive personal data such as health data. Wogglebox manages equipment, not personal records about young people.

We use your data to:

Provide the service: Manage your account, display your group's inventory, process bookings, and deliver the core platform features.

Send operational emails: Deliver invitations, booking reminders, repair alerts, public request notifications and other service messages. These are not marketing emails.

Send optional newsletters: When you have actively subscribed, send occasional Wogglebox product updates, feature news and practical kit-management content. You can unsubscribe at any time using the link in each newsletter or through Account and preferences.

Understand community priorities: Aggregate optional poll responses to help judge which Wogglebox features and improvements would be most useful. Poll results are treated as one input into product decisions rather than an identity-verified ballot.

Improve the platform: Understand how features are used so we can make the platform better. We do not sell or share your data with advertisers.

Respond to enquiries: Reply to messages submitted through the contact form.

We use the following third-party services to operate the platform. Each processes data on our behalf and under their own privacy policies:

Supabase — database hosting and authentication. Your account data, group data, newsletter preferences and privacy-light poll responses are stored in a Supabase-hosted PostgreSQL database. Supabase Privacy Policy

Vercel— application hosting. Our platform runs on Vercel's infrastructure. Vercel Privacy Policy

Google OAuth — if you choose to sign in with Google, Google shares your name and email address with us. We do not receive your Google password. Google Privacy Policy

Microsoft OAuth — if you choose to sign in with Microsoft, Microsoft shares your name and email address with us. We do not receive your Microsoft password. Microsoft Privacy Statement

Resend — operational email delivery and optional newsletter Broadcasts. Email addresses are shared with Resend when needed to deliver service emails or when a person has subscribed to the Wogglebox newsletter. Resend also processes delivery, bounce, complaint and unsubscribe events so we can keep email preferences accurate. Resend Privacy Policy

Wogglebox uses a minimal set of cookies and browser storage, primarily for platform functionality.

Authentication cookies: Set by Supabase to keep you signed in. These are essential for the platform to work and cannot be disabled while using an authenticated account.

Community poll cookie: When you confirm a poll vote, Wogglebox stores a random token in an HTTP-only cookie named wogglebox_poll_voter. It lets the poll keep one current choice per browser and allows you to change that choice later. The cookie does not contain your answer, name or email address. Only a one-way hash of the token is stored in the database. The cookie may remain for up to two years unless you clear it sooner.

Local storage: We may store interface preferences in your browser. This data does not become part of your group inventory records.

Newsletter and public links may include campaign parameters so we can understand which update brought someone to a Wogglebox page or poll. We do not sell this information or use it for advertising.

We retain your account data and group data for as long as your account is active. If you or your group admin requests account deletion, we will remove your personal data within 30 days, subject to any information we must retain for security, legal or audit purposes.

Contact form submissions are retained for up to 12 months after the enquiry has been resolved.

Newsletter consent and withdrawal records are retained while the newsletter is active and for a reasonable period afterwards so we can honour unsubscribe requests and demonstrate consent. An unsubscribed address is retained in suppression form where needed to prevent accidental future marketing.

Community poll responses may be retained while they remain useful for product planning and for a reasonable period afterwards. They are not linked to account identities. Test responses may be kept separately or removed once a poll has been checked.

Server logs containing basic usage data are deleted according to our hosting providers' standard retention periods.

We take reasonable measures to protect your data, including HTTPS encryption in transit, role-based application permissions and Supabase Row Level Security policies that restrict group-scoped records.

Provider secrets are held server-side. Newsletter subscriber lists are not publicly accessible, and Resend webhook requests are signature-verified before they can update delivery or consent status.

Community poll tables are not directly accessible to public or authenticated browser clients. Public votes pass through a validated server route, and platform administrators see aggregate results rather than browser-token hashes.

No system is perfectly secure, but we are committed to following practices appropriate to the nature and scale of the data we handle.

Under UK GDPR and the Data Protection Act 2018, you may have rights to access, correct, delete, restrict or export personal data, and to object to certain uses of it.

You can withdraw newsletter consent at any time using the unsubscribe link in a newsletter or the newsletter control in Account and preferences. This does not affect essential service messages required to operate your Wogglebox account or group workflows.

Community poll votes are deliberately not linked to your identity, so we may not be able to identify a particular anonymous vote as yours. Voting again from the same browser updates its current choice.

To exercise your rights, please contact us through the contact form.

Wogglebox is designed for adult volunteers who manage equipment for their organisations. The platform does not knowingly offer accounts or newsletter subscriptions to children under 18.

Group users should avoid entering unnecessary information about young people into free-text equipment, booking or request fields.

We may update this privacy policy from time to time. If we make significant changes, we will notify active users through the platform. The "last updated" date at the top indicates when this policy was most recently revised.

Questions about this policy or our handling of personal data can be sent through the contact form.