Privacy

This notice explains how Kerry's Cosy Corner uses personal information when you use this website, join the club, fill in the welcome form or post in Show & tell. It is written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Kerry's Cosy Corner is run by Kerry, who makes and sells handmade crochet. Kerry is the "controller" of your information: she decides how it is used and is responsible for looking after it. A small number of trusted helpers may help run the club (see "Who can see your information").

Contact Kerry about anything in this notice, or to use any of your rights, at hello@kerryscosycorner.com or through the contact page.

What we collect

• Your account: your first and last name, email address and password. The password is stored only in a scrambled (hashed) form that nobody, including us, can read. We record when you joined, confirmed your email and filled in the welcome form.
• Your email choice: whether you asked to hear about new patterns and fairs, and when.
• Welcome form answers (every question is optional): how you'd describe your crochet, what you like to make, how you heard about the club, and anything you'd like Kerry to share.
• Show & tell posts: the photos you post, your caption, which pattern you used if you say, and whether the post was approved. Location and camera details are removed from photos when they are uploaded.
• Login sessions: for each device you log in on, its internet (IP) address and browser type, and when the session started and ends.
• Messages: anything you send through the contact form, and account deletion requests.
• If you help run the club (an Owner, Administrator, Editor or Moderator): your role, your two-step verification set-up, and a record of the admin actions you take.

We count how many times each pattern is downloaded or viewed, but not who downloaded it. We do not collect payment details.

Why we use it, and our lawful basis

Where we rely on legitimate interests, we have balanced them against your interests and rights, and you can object (see "Your rights").

Who can see your information

• Kerry, and any Administrators she appoints, can see account details, welcome form answers, Show & tell posts and messages. They must use two-step verification, and their actions are recorded.
• Editors and Moderators help with patterns, events and checking Show & tell posts. They see your first name and the first letter of your surname on posts, but not your email or other details.
• Other members see your approved Show & tell posts with your first name and the first letter of your surname. They never see your email address or welcome form answers.
• The public sees nothing about you. Show & tell is for logged-in members only.

Services that process information for us

We do not sell your information or give it to advertisers. These services process it on our behalf:

• Cloudflare runs the website, stores the database and uploaded files (patterns and Show & tell photos), sends the site's emails from no-reply@kerryscosycorner.com, forwards emails sent to hello@kerryscosycorner.com to Kerry's inbox, and checks that forms are filled in by people rather than robots (Cloudflare Turnstile, which looks at information about your browser and device).
• YouTube or Vimeo: Kerry's videos are hosted there and play inside the page when you open one. The video service then receives your IP address and browser details under its own privacy policy. YouTube videos use its reduced-cookie ("no-cookie") player.
• Google Maps: if you click a map link on an event, Google receives the venue address you are looking up.

The site's fonts and images are served from the site itself. There are no analytics, advertising or tracking services.

International transfers

The database and uploaded files are stored in Cloudflare's Western Europe region. Cloudflare is a US company and may process some information in other countries, for example to deliver email or protect the site. Where information leaves the UK, it is protected by the safeguards UK law requires.

How long we keep it

• Your account, profile, welcome form answers and Show & tell posts: while your account is open. When an account is deleted, all of these, including your photos, are deleted with it. You can delete any of your own posts yourself at any time.
• Show & tell posts that are not approved: deleted, with the photo, 30 days after the decision.
• Accounts whose email address is never confirmed: deleted automatically after 30 days.
• Login sessions (IP address and browser): deleted the day after the session ends. Sessions end when you log out or after 14 days without use.
• Security counters used to slow down repeated attempts: deleted after one day.
• Contact messages and deletion requests: up to 24 months, or until the account they relate to is deleted, whichever is sooner.
• Records of admin actions: 12 months. They hold account identifiers, not names or answers.
• Download counts: 24 months. These are not linked to anyone.
• Backups: Cloudflare keeps an automatic recovery history of the database, so deleted information can remain there for up to 30 days before it is gone for good.

How we protect it

Information is sent over encrypted (HTTPS) connections. Passwords are stored only in hashed form. Everyone who helps run the club must use two-step verification, each role can reach only what it needs, and admin actions are recorded. Uploaded files are stored under random names and only shown to the people allowed to see them.

Your rights

Under UK data protection law you have the right to:

• access your information: we can give you a readable copy, and a machine-readable copy if you want to move it elsewhere;
• have it corrected if it is wrong or incomplete;
• have it deleted;
• restrict how we use it, or object to uses based on legitimate interests;
• withdraw consent to emails at any time.

Many of these you can do yourself from your account page: change your name and email choice, update your welcome form answers, delete your Show & tell posts, or ask for your account to be deleted. For anything else, contact hello@kerryscosycorner.com. There is no charge, and we will reply within one month.

If you are unhappy with how we have handled your information, please tell us so we can put it right. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Age

The club is for adults. Please don't join if you are under 18, and please don't post photos showing children's faces.

Cookies

We use one cookie to keep you logged in, which is strictly necessary for the site to work and is removed when you log out or your session ends. Cloudflare Turnstile, which protects our forms, may set its own strictly necessary cookie. We do not use advertising, analytics or tracking cookies, so we do not ask you to accept any.

Changes to this notice

If we change how we use your information, we will update this notice and the date below. If a change is significant, we will tell members by email.

Last updated: 28 October 2026.