Privacy Policy

01 Data Philosophy

The CrimeTrends Project is built on a principle of data minimization. We collect only what is necessary to deliver our service. Most of the platform is publicly accessible without an account. Where an account is required — currently to access postcode-level neighbourhood intelligence — we use a lightweight authentication system and do not build advertising profiles or sell your data to third parties.

02 User Accounts & Authentication

A free account is required to view postcode-level crime data. We use Supabase as our authentication provider. You can sign in via:

Magic link: We send a one-time login link to your email address. Supabase stores your email and a record of when you last signed in.
Google OAuth: Google shares your email address and display name with Supabase. We do not receive your Google password.

When you are signed in, a short-lived session token (sb-access-token) is stored as a cookie in your browser. This cookie expires after 1 hour and is used solely to verify your session on each page request. It is not used for tracking or advertising.

What Supabase stores on our behalf

Email address, authentication provider (email or Google), and last sign-in timestamp. Supabase is our data processor and handles this data under their own security and privacy standards. See supabase.com/privacy.

03 Information We Process

Watchlist & Alert Emails

If you sign up to receive monthly crime alerts for an area, we store your email address alongside the area name and type in our database. This information is used only to send you the alerts you requested. You can request deletion at any time by emailing us.

Report Waitlist

If you join the waitlist for a downloadable PDF report, we store your email address and the area you requested. This is used only to notify you when the report is available.

Contact Correspondence

If you contact us directly (via email or our contact form), we receive the information you provide — typically name, email address, and message content. This is used solely to respond to your inquiry and is never shared with third-party marketing entities.

Analytical Log Data

Like most web platforms, our servers process standard request logs: IP addresses, browser types, referring pages, and timestamps. This data is used for platform security, performance optimization, and understanding aggregate regional traffic patterns. It is not linked to individual user accounts.

04 Cookies & Third-Party Analytics

We use cookies for authentication and platform analytics.

Session Cookie

sb-access-token — stores your Supabase JWT. Expires after 1 hour. Required for postcode access. Not used for advertising.

Google Analytics

We use anonymized Google Analytics to understand how visitors interact with the platform. No personally identifiable information is stored.

Advertising

Third-party vendors, including Google, may use cookies to serve ads based on prior visits. You can opt out via your Google account settings.

05 Future SaaS Plans

CrimeTrends is developing paid subscription tiers. When these launch, we will collect additional information to process payments and manage subscriptions — such as billing name, billing address, and payment method details. Payment processing will be handled by a PCI-compliant third-party provider (such as Stripe); we will not store full card details ourselves. This policy will be updated before any paid tier goes live, and existing users will be notified of any material changes.

06 Your Rights (GDPR / UK DPA)

Under UK and EU data protection law, you have the following rights regarding any personal data we hold about you:

Right to Access: Request a copy of any data we hold about you.
Right to Erasure: Request deletion of your account, watchlist entries, and any contact history we hold.
Right to Rectification: Request correction of inaccurate personal data.
Right to Object: Object to our processing of your data for analytical purposes.
Right to Withdraw Consent: You can unsubscribe from watchlist alerts or delete your account at any time.

To exercise any of these rights, contact us at the address below. We will respond within 30 days in line with our obligations under the UK GDPR and Data Protection Act 2018.

07 Data Security & Retention

All traffic is encrypted via SSL/TLS. Authentication is managed by Supabase with industry-standard security practices. Watchlist and waitlist email addresses are retained until you request deletion. Server log data is retained for up to 90 days for security and diagnostic purposes, after which it is purged.

Privacy Inquiries

For any questions regarding our data practices, to request account deletion, or to exercise your rights under UK GDPR, please contact us directly.

mail [email protected]