Privacy

What we know about you

Not much, on purpose.

• No name, no email address, no account.
• Three cookies, all of them needed to make the site work: one remembers you passed the area check and keeps your handle the same, one is the standard session cookie, one is a security token that stops other sites submitting things as you. No advertising cookies and nothing stored in your browser beyond those.
• Your postcode isn't stored. It's checked once against the area and then forgotten.
• Your IP address is kept for 30 days and then deleted.
• Whatever you put in a post, including any photo.
• No analytics, no tracking, no advertising, nothing shared with anyone for marketing. The storage here is necessary to provide the site, which is why you weren't asked to accept cookies.

Your posts are anonymous to everyone reading them. They are not anonymous in the technical data-protection sense: a handle, a device cookie and an IP address for 30 days are enough to single out one device. That matters if something ever has to go to the police. Better to say so than let you assume otherwise.

Why we hold it

To keep the feed usable: stopping one person flooding it, stopping the same device voting twice, keeping your handle consistent and dealing with anyone who misuses it. The lawful basis is legitimate interests. The alternative to a device cookie would be making everyone register an account, which would mean collecting a great deal more.

The automatic check

Before a person reads it, every post goes through an automatic check for abuse, scams and anything naming an individual. That works by sending your post text, and any photo, to Anthropic, who run the service doing the checking. They look at it and send back a verdict.

Anthropic act on our instructions. They don't use anything you post to train their systems, and they delete it within 30 days. The checking happens in the United States, using the transfer terms the Information Commissioner issues for sending data outside the UK.

A post that fails the check has still been through it. The check has to read a post to judge it, so anything you submit reaches them even where we then refuse to publish it.

There's one exception to those 30 days. If their own systems flag something as breaking their rules, they can keep it for up to two years. That's their decision rather than ours, and it can outlast anything deleted at our end.

Your handle, your location and your IP address are not sent. Bear in mind that whatever you write or photograph does go with it, so the usual advice applies: don't put anything in a post you wouldn't want leaving the site.

How long things are kept

• A post that expires or fades is deleted.
• A post that was removed or reported is kept for up to a year, so a decision can be explained if it's questioned.
• The record of a moderation decision is kept for a year. Where possible the post's content is deleted before that record is.
• Your IP address: 30 days.
• The cookie on your device: a year, unless you clear it.
• Email you send us: a year.
• Backups exist for a short period after deletion.

Your rights over that

You have data protection rights over what's held about you: access, correction, deletion, restriction and objection. Which of them apply depends on why the information is being held, so not all of them apply to everything. Email hello@gabbin.co.uk and you'll get help working out which.

We may need enough detail to find the right records and to be reasonably sure we're giving them to the right person. Since there's no account, that usually means the device you posted from.

If you're not happy with how that's handled you can complain to the Information Commissioner's Office at ico.org.uk.

Age

Gabbin isn't aimed at children, but it isn't an adults-only site either. Lost cats, road closures and what's on at the pub aren't adult material, so there's no age gate and nothing here asks how old you are. It's built on the assumption that under-18s may well read it: no profiles, no direct messages, no comments, no advertising, no tracking, and every post is read by a person before it goes up.

Who's responsible

Gabbin is run by J Honeyford in Cheltenham, and I'm the data controller for the information described above. It's a personal project, not a company. Email hello@gabbin.co.uk and you'll get a person, not a form.

Post reaches me at Nash Workshops, Chapel Lane, Cheltenham GL50 2AR.