Privacy Policy

Last updated: 28 July 2026.

The Web Creators Toolbox (“TWCT”, “we”, “us”) is a community for web designers, developers and creators. We run free online events and a members’ community. This policy explains what personal data we collect, why we collect it, and what rights you have over it.

TWCT is an unincorporated community rather than a registered company. For the purposes of UK GDPR we act as the data controller for the information described below. You can contact us at info@thewebcreatorstoolbox.com or through our contact page.

What we collect and why

Registering for an event

When you register for an event we record your name, your email address and which event you registered for. If you register as a guest rather than a signed-in member, we email you a confirmation link so we can verify the address belongs to you. We store only a hashed form of that confirmation link, never the link itself, and it expires after a limited time and can be used once.

We use this information to manage attendance and to send you details about the event you registered for. Our lawful basis is legitimate interests: you asked to attend and we need to be able to admit you and contact you about it.

Member accounts and the community

If you have an account we hold your username, display name, email address and a securely hashed version of your password. We never store your password in a readable form. Within the members’ area at /meetup/ we hold the posts, replies and space memberships you create. The community is available to signed-in members only and is not visible to search engines or to logged-out visitors.

Speaking proposals and project submissions

If you apply to speak, we hold your proposal, any biographical details you supply and any access requirements you choose to tell us about. Access requirements are used only to support your participation and are visible only to the people reviewing applications.

If you submit a project to the showcase, it stays private until you and a moderator agree to publish it. Nothing you submit becomes public automatically.

Creator profiles

Creator profiles are private by default. Individual fields become public only when you explicitly opt that field in. If you never opt in, your profile remains visible only to you and to site administrators. Our lawful basis for publishing any profile field is your consent, and you can withdraw it at any time by turning the field off again.

Security and anti-spam

To protect the site from attacks and automated abuse, our security software records IP addresses associated with failed logins, lockouts and blocked requests. Our own anti-spam controls on public forms store a keyed hash of the requesting address rather than the address itself, so the raw value is not retained. Our lawful basis is legitimate interests in keeping the site and its members safe.

Email records

We keep a limited log of messages the site has sent, so that we can diagnose delivery problems. These records include the recipient address, subject and delivery status.

What we do not do

We do not use advertising cookies, behavioural tracking or profiling. We do not run third-party analytics. We do not sell or rent your personal data to anyone. We do not publish member email addresses, registration lists or private submissions on the public site or in our public calendar feed.

Cookies

If you are not signed in, this website sets no cookies at all. Signing in sets a small number of strictly necessary cookies that keep you logged in and remember your display preferences. Because we set no tracking or advertising cookies, we do not show a cookie consent banner. Our cookie policy explains this in more detail.

Who we share data with

We use a small number of service providers who process data on our behalf under contract:

• one.com hosts this website and its database, within the European Union.
• Postmark, a service of ActiveCampaign, delivers our email. Because Postmark operates from the United States, sending you an email involves an international transfer of your address and the message content. This transfer relies on the provider’s standard contractual clauses and UK international data transfer safeguards.

We may also disclose information where we are legally required to do so.

How long we keep it

Account and profile data is kept while your account is open. Event registrations are kept so that we can maintain a record of attendance and understand how our events are used. Unconfirmed guest registrations and their expired confirmation tokens are removed automatically. Security and email logs are kept for a limited period and then rotated. If you ask us to delete your account, we remove your personal data except where we must keep something for legal or security reasons.

Your rights

Under UK GDPR you have the right to be told how your data is used, to get a copy of it, to have inaccurate data corrected, to have data erased, to restrict or object to how we use it, and to have it transferred to another provider. Where we rely on your consent, you can withdraw it at any time.

To exercise any of these rights, email info@thewebcreatorstoolbox.com. We will respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.

Changes to this policy

If we change how we use personal data, we will update this page and change the date at the top. Significant changes affecting members will also be announced in the community.