Privacy policy

This is the privacy policy for joshs.blog, a personal publication run by Josh Tulip. I keep data collection to the minimum needed to run the site and reply to you. This policy explains what I collect, why, and what your rights are under the UK GDPR and Data Protection Act 2018.

Who I am

Josh Tulip, sole operator of joshs.blog, based in the United Kingdom. I'm the data controller for anything collected via the site. You can reach me through the contact form.

What I collect and why

Newsletter subscribers

If you subscribe, I store your email address and the source page you signed up from. I use double opt-in, so you'll receive a confirmation email before you're added. Legal basis: your consent.

Contact form

When you send a message from the About page, your name, email and message are forwarded to my inbox (joshuatulip@outlook.com) and retained there for as long as needed to reply. Legal basis: legitimate interest in responding to enquiries.

Analytics cookie

If you accept analytics in the cookie banner, I set a first-party cookie called jb_vid. It's a random id that helps me see returning readers and which posts land. No third-party trackers, no ad networks. Legal basis: your consent. See the cookie policy for the full list.

Server logs

My hosting provider records standard request logs (IP address, user agent, path, timestamp) for security and debugging. These are retained for a short period and are not linked to any identity. Legal basis: legitimate interest in keeping the site secure.

Who processes your data

I use a small number of providers to run the site:

• Lovable Cloud - hosting, database and authentication.
• Email delivery provider - sending confirmation and contact emails on my behalf.
• Microsoft Outlook - my inbox, where contact messages arrive.

All providers act as processors under my instructions.

How long I keep things

• Subscriber records: until you unsubscribe or ask me to delete them.
• Contact messages: kept in my inbox as long as needed for the conversation, then archived or deleted.
• Analytics cookie: up to two years, or until you clear it.
• Server logs: rolling window, typically under 30 days.

Your rights

Under UK GDPR you can ask me to:

• See what data I hold about you.
• Correct anything that's wrong.
• Delete your data (right to erasure).
• Restrict or object to how I use it.
• Withdraw consent at any time (this doesn't affect anything already done).

To exercise any of these, send a note via the contact form. You also have the right to complain to the Information Commissioner's Office.

Unsubscribing

Every email includes a one-click unsubscribe link. You can also mail me directly and I'll remove you the same day.

Changes

If this policy changes, I'll update the date at the top. Material changes will be mentioned in the newsletter.