Privacy Notice
Last updated 20 September 2026
The short version. We don't sell your data, share it with advertisers, or use it to profile you. Everything the app is actually for — your budget, grades, deadlines, timetable, plans, notes and background picture — is stored in your own browser and never reaches us.
The only things we hold are the email address and first name you sign in with, and a record of when you last signed in. That's it.
Who we are
CitiIT Limited trades as dPaul Software and operates www.life-student.uk. We are the data controller for the information described here.
- Registered in England and Wales, company number 15811174
- Registered office: C/O SG Accounting, 1 Cedar Office Park, Cobham Road, Wimborne, BH21 7SB, United Kingdom
- VAT number 473 5892 49
- Contact: david@dpaul.studio
Life - Student Edition is in beta. It's free, and there's nothing to buy inside it.
What we actually hold about you
There is no database of your work. What we hold is the bare minimum needed to let you sign in and be recognised on your next device:
- Your email address. This is how sign-in codes reach you, and how the app knows it's you on a new phone or laptop.
- Your first name, if you've given one. It's only used to greet you, and you can change or clear it under Your account in Settings.
- Sign-in records. When your account was created and when it was last used. The sign-in service also keeps a short technical log of sign-in attempts, which includes the internet address the request came from. That log is generated automatically as a security measure.
Legal basis: performing the agreement between us. Without an email address there's no way to sign you in, and without sign-in there's no app.
What we do not hold
We cannot see your money, your grades, your deadlines, your timetable, your plans, your notes, your music list, your location or your background picture. Not because we've promised not to look — because none of it is ever sent to us. It lives in your browser's storage on your device.
We have never sold personal data and we do not share it with advertisers, data brokers, or anyone else for their own purposes.
Things stored on your device
The app keeps everything you enter in your browser's local storage, under names beginning dpaul_student_. That includes your entries, your settings and theme, your background picture, your cookie choices, and the token that keeps you signed in on that device.
None of it is transmitted anywhere. Clearing your browser's data for this site removes all of it, as does Delete all my data in Settings. Backup files you save are yours — they're written straight to your device and never pass through us.
Who receives data when you use a feature
Some features have to ask somebody else a question. When they do, that service sees a normal web request, which always includes your internet address. Only the feature you're using makes its request, and only while you're using it.
| Feature | Who it asks | What is sent |
|---|---|---|
| Signing in | Supabase | Your email address and first name |
| Weather | Open-Meteo | Your saved location |
| Postcode search | postcodes.io | The postcode you typed |
| Map | OpenStreetMap | The area of the map being shown |
| Nearby stops and shops | OpenStreetMap's public query service | Your location rounded to roughly 100 metres, never your exact position |
| Trains | Our train service, which asks National Rail | Station codes only. It doesn't record who asked |
| News | Our news service, which reads public news sites | Your news area, such as Berkshire. Never your exact location |
| Music | YouTube | Only after you agree — see below |
| Page code | Cloudflare's cdnjs and jsDelivr | Nothing beyond the request for the file itself |
These organisations have their own privacy policies, which govern what they do with that request. We have no control over them and we receive nothing back about you personally.
Analytics
We use Google Analytics 4 to count visits and see which parts of the app get used. It is not loaded at all until you press yes on the banner. Choose no and the script is never fetched, no analytics cookies are set, and any that already existed are deleted.
Nothing you enter in the app is ever sent to analytics. IP addresses are anonymised before storage, and we don't use it for advertising, remarketing or profiling.
| Cookie | Purpose | Expires |
|---|---|---|
| _ga | Tells one browser from another so repeat visits aren't double-counted | 2 years |
| _ga_<ID> | Keeps the session state for the property | 2 years |
Google Ireland Limited acts as our processor for this. Data may be transferred to the United States under Google's standard contractual clauses and the UK addendum.
Legal basis: your consent, which you can withdraw at any time using Cookie settings in the footer.
Background music and YouTube
The music player is YouTube's, and YouTube sets its own cookies as soon as it loads. So it stays switched off until you press play and agree — before that, nothing is requested from YouTube at all.
When you do agree, the player uses YouTube's privacy-enhanced domain, youtube-nocookie.com, which holds back rather less. It's still YouTube, and what they do with the request is covered by Google's privacy policy, not this one. You can withdraw that agreement under Privacy and cookies in Settings, which stops the player loading again.
Sharing a music list makes a link with the YouTube addresses and titles built into the link itself. Nothing is stored by us, and anyone you send it to can pass it on.
Legal basis: your consent.
Hosting
The app is hosted on GitHub Pages, operated by GitHub, Inc. GitHub logs the internet address of every visitor to a Pages site for security purposes, whether or not the visitor has a GitHub account. This happens at the hosting layer and is outside our control — we have no access to those logs and cannot see them. GitHub sets its own retention period, described in the GitHub Privacy Statement.
Sign-in is handled by Supabase, which acts as our processor. Both GitHub and Supabase are based in the United States, so this involves transfers outside the UK, made under standard contractual clauses with the UK addendum.
Legal basis: our legitimate interest in keeping the app available and defending it against abuse.
How long things are kept
- Your account: until you close it. Ask us and it's deleted.
- Sign-in security logs: a short rolling period set by the sign-in service, then overwritten.
- Analytics: retained by Google for 14 months, then deleted automatically.
- Your cookie choice: until you clear it, or 12 months, whichever comes first.
- Hosting logs: held by GitHub for the period in its own privacy statement. We hold no copy.
- Everything you enter in the app: stays on your device until you delete it. We have no copy to keep.
Your rights
Under UK GDPR you can ask to see the personal data we hold about you, to have it corrected or erased, to restrict or object to how it's used, to receive it in a portable form, and to withdraw consent at any time.
In practice we hold very little: an email address, a first name and a last-signed-in date. Everything else is already in your hands, and Back up in Settings gives you a portable copy of the lot in one file.
To close your account or make any other request, email david@dpaul.studio from the address you sign in with. We'll respond within one month.
If you're unhappy with how we've handled it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Age
This version of the app is for people aged 18 and over, and we don't knowingly hold data about anyone younger. If you believe someone under 18 has an account, email us and it will be removed.
Wellbeing links
The app links out to organisations such as the NHS and Samaritans. Following one of those links takes you to their website, where their own privacy policy applies. We are never told that you followed it, and no record of it is kept anywhere in the app.
Changes
If this notice changes materially we'll update the date at the top. Where the change affects cookies, the banner will ask you again rather than assuming your old answer still applies.