Privacy policy

Who we are

ScooterParks (“we”, “us”) is the data controller for the information described here. Contact: privacy@scooterparks.co.uk.

What we collect

When you create an account

• Your email address, a username you choose, your date of birth, and a password (stored as a one-way hash — we can't see it).
• If you're under 13, the email address you give for a parent or guardian so we can ask for their approval.

When you use the site signed in

• Reviews, ratings, and photos you choose to submit.
• The list of parks you save (kept in your browser's local storage, not on our servers, unless you sign in on multiple devices in future).
• A session cookie (scooterparks_session) to keep you signed in. It's HTTP-only and SameSite=Lax. Strictly necessary — the site needs it to recognise you.

Automatically

• Standard web-server logs (IP address, browser type, pages visited, timestamps). Kept for up to 30 days for security and debugging.

We do not use behavioural advertising trackers, third-party analytics, or social media pixels. There's no cookie banner because we don't set tracking cookies — just the one session cookie above.

Why we collect it

• To run the service — show you parks, let you sign in, post reviews, save favourites. (Lawful basis: contract.)
• To verify you are who you say you are and prevent abuse. (Lawful basis: legitimate interest.)
• To protect under-13 users by getting parental consent before they post reviews or upload photos. (Lawful basis: parental consent under UK GDPR / Age Appropriate Design Code.)

Users under 13

We take child privacy seriously. If you're under 13, you can still browse the site, read reviews and save parks without a parent's involvement.

You can't post reviews or upload photos until a parent or guardian approves your account. We do this by emailing the address you gave during signup with a one-time approval link. Until that link is clicked, reviewing and photo uploads are switched off. Every review and photo, from anyone, is also checked by a person before it appears on the site.

Parents and guardians: you can request to delete your child's account at any time by emailing privacy@scooterparks.co.uk. We don't create accounts for parents — only the approval link.

Photo moderation

Every photo uploaded to ScooterParks is reviewed by a moderator before it goes live. We strip EXIF metadata (including GPS coordinates) and resize images to 2048px max before storing them. Photos that show identifiable people without consent, or that break our terms, are rejected.

Who we share data with

We share data only with the third parties that help us run the service:

• Our hosting and backup providers — run the servers the site, your account details and uploaded photos are stored on, and keep encrypted backups of them. Your data is stored in the UK or the European Economic Area.
• OpenStreetMap / Nominatim — when you type a town in the map search, we forward the text to OSM's geocoder so we can show you the nearest parks. No identifying information is sent.
• Email delivery — an email delivery provider sends our account emails (sign-up confirmations, parental consent requests, password resets) on our behalf. Your email address is used only to send these. Messages you send to our hello@ or privacy@ addresses are received by our email host.

We do not sell your data, share it with advertisers, or use it for marketing.

How long we keep it

• Account data — until you delete your account.
• Reviews and approved photos — kept indefinitely (they're useful to other users), but anonymised to “Deleted user” if you close your account.
• Rejected photos — deleted after 30 days.
• Parental consent tokens — 7 days. Password reset tokens — 1 hour. After that they expire and can't be used.
• Server logs — up to 30 days.

Deleting your account

You can delete your account from your profile page. When you do:

• Your email and username are scrubbed from our database.
• Your password hash is wiped.
• Your reviews and approved photos stay on the site, attributed to “Deleted user”. This is the standard approach for review sites — the content is useful to others.
• If you want your reviews removed too, email us and we'll do it.

Your rights

Under UK GDPR you have the right to:

• Know what data we hold about you (right of access).
• Correct anything that's wrong (right of rectification).
• Have your data deleted (right to erasure).
• Restrict or object to how we use it.
• Receive a copy in a portable format.
• Complain to the ICO (ico.org.uk).

Email privacy@scooterparks.co.uk for any of these. We'll respond within 30 days.

Security

The site runs over HTTPS. Passwords are hashed with bcrypt. The session cookie is HTTP-only and SameSite=Lax. We're a small operation — if we ever have a data incident that affects you, we'll tell you within 72 hours, as required by law.

Changes to this policy

We'll update the “Last updated” date at the top when this changes. Material changes will be highlighted on the site.