Last updated: 29 October 2026
UK Art Spotlight (“we”, “us”) runs the UK Art Spotlight app and the website at book.ukartspotlight.org. This policy explains what personal data we collect through the app and the site’s member area, why, and your rights over it. The data controller is UK Art Spotlight, operated by Daniel Newton, a sole trader based at Unit 5 Aire Street, Leeds LS1 4HT, contactable at hello@ukartspotlight.org.
Who the app is for
The app is for people aged 16 or over. We don’t knowingly collect data from anyone under 16; if you believe a child under 16 has created an account, contact us and we will delete it. Some events bookable in the app (such as life drawing) may carry their own higher age requirement, shown on the event.
What we collect
Account and profile. Your name, email address and login credentials, held in our website’s member system (Wix). The same account works on the app and on book.ukartspotlight.org.
Your posts. The sketchbook pages, images, videos, captions, tags and privacy settings you add. Posts are private by default. You control visibility per image, per tag, or globally; public posts appear in the app’s community feeds and on your public portfolio page on our website.
Pods and streaks. Which accountability pod you belong to, invites you send or receive, your posting streak, and your activity record (used for the pod inactivity rules, e.g. removal after five missed days).
Comments and reactions. What you write and react to on other members’ posts.
Reports, blocks and moderation. When you report a post, comment or member we record who reported it, what was reported, the reason and any note, and the outcome. When you block someone we keep your block list so the app can hide you from each other (the other person isn’t told). When an admin hides content, marks it as a figure study or bans an account, we record the action, the reason, which admin took it and any appeal you make. Comments, captions, text posts and display names are checked automatically against a short blocklist of slurs and hard profanity before they post; nothing is stored from that check beyond the text you go on to post.
Reminders and notifications. Your chosen reminder time, notification preferences, and the device push token needed to deliver notifications (via Expo’s push service).
Bookings and purchases. When you book a club session or event, or buy a membership on our website, Wix processes the booking and payment. We see your booking and order history; we never see full card details.
Device data and analytics. Basic device information and crash reports so we can fix problems.
Problem reports. If you use Report issue in the app, we receive what you write, the screen you were on and the area you marked, your device and browser type, the app version and any recent errors the app hit. The report carries your account number, never your name or email address. Names, captions and comments shown on the screen are hidden from it, and no screenshot is taken.
Usage analytics. Our server records what happens in the app, such as signing up, posting a page (photo or video, its privacy setting, whether it counted as your Daily Page, your streak day), streaks, Freezes, pods and Rallies, likes, comments, reports and blocks, and when you open a link to our website. Each record carries your account number, never your name, email, sketches, captions, comments or tag names. It is sent from our server to PostHog (EU hosting), so no analytics cookie or tracker is put in your browser for it. You can turn it off at any time in Profile & settings → Usage analytics; from then on nothing more about you is recorded.
Session recordings (only if you say yes). We may ask once whether we can record how you use the app for the next 30 days, to see where it’s confusing. Nothing is recorded unless you say yes. A recording shows the screens and taps, with your sketches, photos, videos, captions, comments, names and anything you type hidden. It also includes errors the app hits. Recording stops by itself after 30 days, and you can stop it sooner in Profile & settings → Session recordings. While it’s on, PostHog’s script and its storage are in your browser; before you say yes they aren’t.
We do not use advertising trackers, we do not track you across other companies’ apps or websites, and we never sell your data.
Why we process it (lawful bases)
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Running your account, posts, pods, streaks, feeds, bookings | Performance of a contract (our terms with you) |
| Sending push notifications you’ve enabled | Performance of a contract; you can switch them off in Settings or your device at any time |
| Usage analytics, crash reporting and problem reports you send | Legitimate interests (improving and securing the app); you can turn usage analytics off in Profile & settings, or object — see your rights |
| Session recordings | Consent (asked once; lasts 30 days; you can withdraw it in Profile & settings at any time) |
| Moderation and safety: handling reports, blocks, admin Hide/Ban actions and appeals, and the automatic text blocklist | Legitimate interests (protecting our members and meeting our duties under the Online Safety Act 2023); see our app terms & community guidelines for how this works |
| Reporting illegal content to the authorities where the law requires it (for example child sexual abuse material to the National Crime Agency) | Legal obligation |
| Keeping payment and booking records | Legal obligation (UK tax and accounting law) |
Who sees your content
- Private posts: only you (and, where needed for moderation, an admin).
- Pod feed posts: the other members of your pod (3 to 6 people).
- Course feed posts: members of that course.
- Public posts: anyone in the main feed and on your public portfolio page at book.ukartspotlight.org.
Admins don’t browse pod feeds or private sketchbooks. When something is reported, the admins handling it see that item, its comment thread and (for a pod post) who is in the pod. They can hide posts or comments that break our rules, mark unmarked figure studies, and ban accounts; the author is told the reason and can appeal. The person who reported something is told the outcome, but never who they are to the person reported. Reports and admin actions are handled by our own team, not by an outside moderation service.
Who we share data with
We use a small number of processors to run the service: Wix (website, member accounts and sign-in, bookings and payments), Hetzner Online GmbH (Germany: hosts the Daily Pages app server at app.ukartspotlight.org and its database of profiles, pages, captions, pods, streaks and comments), Cloudflare, Inc. (Cloudflare R2 storage under its EU jurisdiction, so the data is stored in the EU: your photos and videos, and our encrypted backups of the database and media), Expo (app builds, push notification delivery, crash reporting) and PostHog Inc. (product analytics and session recordings, stored in its EU region in Frankfurt). Each processes data on our instructions. Some processors store data outside the UK; where they do, transfers are protected by UK-approved safeguards (the UK Addendum / International Data Transfer Agreement to standard contractual clauses). We do not sell personal data or share it with advertisers.
How long we keep it
- Account, posts, pods, streaks, settings: for as long as your account exists. Being removed from a pod (for example under the inactivity rule) does not delete anything; your posts and streak history stay with your account.
- Reports, blocks and moderation records: your block list for as long as your account exists; report and admin-action records (including appeals) for 12 months after they’re closed, so we can handle appeals and complaints and show Ofcom how we deal with reports.
- Booking and payment records: up to 6 years after the transaction (UK tax law).
- Usage analytics: for as long as your account is active, and deleted when you delete your account. Session recordings: 30 days, and deleted with your account if you delete it sooner.
- Backups: to make sure no one loses their sketchbook, we keep backup copies of the database and of photos and videos for up to about 30 days, in locked storage that can’t be changed or deleted early (it protects your pages against accidents and attacks). Backups are only used to restore the service, never for anything else.
- After you delete a post or your account: it’s removed from the live service straight away (see below), and its last backup copies expire within about 30 days.
Deleting your account
You can delete your account in the app at Profile & settings → Delete my account (both app stores require this, and we honour it). Deletion is permanent and removes: your member account, every post and its images/videos, your comments and reactions on other members’ posts, your streak and pod history, your tags, settings, reminder time and push token, and your usage analytics and any session recordings (deleted from PostHog too). Your public portfolio page disappears from the website at the same time.
Copies in our backups expire within about 30 days of deletion; until then they’re kept locked and only used if we have to restore the service after a failure. What we keep: booking and payment records we are legally required to retain (kept for up to 6 years, no longer linked to an app profile), moderation records for the period above (so a report, appeal or complaint in progress can still be dealt with), and anything we must keep to deal with an active legal claim or safety issue. Deletion completes within 30 days of your request.
Your rights
Under UK GDPR you can ask us for a copy of your data (in the web app, Profile & settings → Download my sketchbook gives you a zip of all your pages, photos, videos and captions straight away), ask us to correct or delete it, object to processing based on legitimate interests (including analytics), ask us to restrict processing, and ask for your data in a portable format. Contact hello@ukartspotlight.org and we’ll respond within one month. You can also complain to the Information Commissioner’s Office at ico.org.uk — though we’d appreciate the chance to sort it out first.
Changes to this policy
If we make significant changes (for example adding a new processor or changing what we collect), we’ll tell you in the app before they take effect and update the date at the top.
Contact
If you have any questions about this policy or how we use your data, please contact us at hello@ukartspotlight.org.
UK Art Spotlight (Daniel Newton, sole trader)
hello@ukartspotlight.org
Unit 5 Aire Street, Leeds LS1 4HT
Also see our App Terms of Use and our website Privacy Policy.
