This policy explains, in plain terms, how DabbleLabs UK handles personal data across the website at dabblelabs.uk and the accounts and paid plans that some DabbleLabs products offer. It is the umbrella policy for DabbleLabs as a whole. Anything specific to a particular app – the data it stores on your device, the features it has, the exact providers it relies on – is covered by that product's own privacy notice, which sits alongside this one. Where a product has its own notice, read the two together: this one covers account-level data common to DabbleLabs, and the product's own notice covers the rest.
The short version: we do not sell your data and we show no ads. The website runs its own simple, privacy-first analytics on our own server – no third-party trackers, no advertising networks, no cookies, and nothing that follows you around the web. We collect the minimum we need to give you an account and take a payment, and you can ask us to hand it over or delete it at any time.
DabbleLabs UK is an independent, one-person software maker in the United Kingdom, run as a sole trader by Jody Florian. For the personal data described here, DabbleLabs UK is the "data controller". "DabbleLabs", "we", "us", and "our" all mean the same thing throughout.
This umbrella policy covers two things: visiting the DabbleLabs website, and the account and billing data that applies whenever a DabbleLabs product lets you sign in or pay. It does not repeat the product-specific detail – for example exactly what one app stores, or which specialised providers it uses to run a particular feature. Each product that handles more than the basics has its own privacy notice for that, linked from the product itself.
You can browse dabblelabs.uk without an account. The website uses no third-party analytics, no advertising networks, and no tracking or profiling cookies. As is normal for any website, our hosting and security layer keeps short-lived technical logs of requests (such as IP addresses and error records) to keep the site running and protect it against attacks; these are used only for operating and securing the service and are not used to build a profile of you.
To understand which pages are useful and how people find us, we run our own simple analytics, built and hosted by us on our own server. It is entirely first-party: no Google Analytics, no third-party scripts, no data shared with anyone, and nothing that can track you across other websites. Here is exactly what it records for a page view:
What we deliberately do not store: no cookies, no advertising or tracking identifiers, no device fingerprints, no user-agent (browser) strings, and no IP addresses. Your IP address does briefly reach our server – it has to, or no website could send you a page – but we never write it down. Instead, to be able to see a single visit's journey through a few pages in one sitting (without knowing who you are), we take your IP address and browser details, mix in a secret that our server changes every day, and run the result through a one-way scramble (a "hash"). Only that scrambled value is stored; the IP address and browser details themselves are thrown away immediately and never saved.
Because that daily secret is random and we delete the previous day's secret once the day is over, the scrambled values from one day can never be linked to another day – not even by us. So there is no way to follow a person over time, and no profile is ever built. We keep these analytics records for at most 90 days, after which they are automatically deleted. All of it stays on our own UK server and is never sent anywhere else.
The public website sets no cookies of its own for visitors, and our analytics (described above) use none either. The only cookies we use are strictly necessary ones: where a product requires you to sign in, we use an essential session cookie or token to keep you logged in and to keep your account secure. We do not use cookies for advertising or cross-site tracking, so there is no "tracking consent" banner to click through. Individual products may describe their own essential cookies in their own privacy notices.
When a DabbleLabs product offers accounts and you create one, we collect only what we need to provide it:
The content you create inside a product (for example your notes or your settings) is handled as described in that product's own privacy notice, because it differs from one product to the next.
Payments and subscriptions are processed by established payment providers – principally Stripe. When you pay, your card details are entered directly with the payment provider and are held by them under their own terms and privacy policy; DabbleLabs never sees or stores your full card number or bank details. The provider simply tells us that a payment succeeded, renewed, or was cancelled, along with a reference, which is what we keep. Some products may use another reputable provider (for example PayPal) for the same purpose; either way, the card details stay with the provider, never with us.
Account and billing data for DabbleLabs is stored on servers located in the United Kingdom. Our main server is a virtual private server provided by OVH in their UK region (Erith, Bexley). We take daily encrypted backups of this data, stored off-site with Backblaze B2 in their EU Central region (Amsterdam, Netherlands). All traffic between your device and our servers is encrypted in transit using HTTPS/TLS.
Some products take additional off-site backups or use specialist providers to deliver particular features, and a small number of those may store data outside the UK (for example elsewhere in the European Union, or with a provider you have chosen to connect yourself). Where that applies, it is described in that product's own privacy notice, along with the safeguards involved. Under UK data-protection law, transfers to the EU are permitted without extra safeguards.
We keep account data for as long as you have an account with the relevant product. When you delete your account, we delete the personal data associated with it, subject to a short recoverable window (so an accidental deletion can be undone) and to encrypted backups ageing out on their normal schedule. We keep basic billing and transaction records for as long as the law requires us to (tax and accounting rules), even after an account is closed. The exact deletion timelines for a given product, including how long backups can linger, are set out in that product's own privacy notice.
We do not sell your personal data and we do not share it for advertising. We share the minimum necessary with the service providers that help us run DabbleLabs – for example the payment provider that processes your payment, and the hosting and security providers that keep our servers and site running. Each acts on our instructions for that purpose only. We may also disclose data if the law genuinely requires it. Any additional providers used by a specific product are named in that product's own privacy notice.
If you are in the United Kingdom or the European Union, you have rights over your personal data under the UK GDPR / GDPR, including the right to:
To exercise any of these, just email [email protected] and we will help. Exercising your rights is free, and we will not treat you any differently for asking.
If you are unhappy with how we have handled your data, we would genuinely like the chance to put it right – please contact us first. You also have the right to complain to the UK's data-protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk or on 0303 123 1113.
DabbleLabs products are not directed at children under 13, and we do not knowingly collect personal data from them. If you believe a child has given us personal data, contact us and we will delete it.
If we update this policy, the new version will be published here and the "Last updated" date above will change. If a change is significant and affects data we already hold about you, we will make a reasonable effort to let you know.
DabbleLabs is built and run by one person, so please be patient if a reply takes a little while. For any question about this policy, your data, or your rights, contact: [email protected]
Trading address:
10 Sheen Road, Orpington, Kent, BR5 2JB