Privacy Policy

Handwriting Guide is a small site run by one person. I collect as little as I can, and nothing is ever sold. This page explains exactly what is collected, why, and what you can do about it.

Who is responsible: Saddaf Semper, Malmö, Sweden. You can reach me through the contact form. I am the "controller" of your personal data under the EU General Data Protection Regulation (GDPR).

The short version

• You can use the generator and download every worksheet without an account and without giving me any personal information.
• If you create an account, I store your email address, an optional name, a securely hashed password and the worksheets you save.
• I count downloads and clicks myself, as anonymous totals. The IP address used to prevent abuse is scrambled and deleted the next day.
• Google Analytics runs only if you click Accept in the cookie banner.
• I never sell your data or share it for advertising.
• You can delete your account, and everything saved in it, at any time from Account settings.

What I collect and why

If you just use the site

• Usage counts. When you download a sheet, open a shared link or click something in the "thank you" panel, the site counts it. Only the total per day is kept (for example "12 downloads of the cursive alphabet sheet"), never who did it. To stop one visitor inflating the numbers, your IP address is turned into a scrambled code that changes every day. The code is deleted the next day and can't be turned back into your address. Why: to see which worksheets are useful and what to make next (legitimate interest).
• Google Analytics, only if you accept it. If you click Accept in the cookie banner, the site loads Google Analytics, which uses cookies to measure visits (pages viewed, how you arrived, rough location, device type). Google processes this data, including in the United States. If you reject or ignore the banner, Google Analytics isn't loaded at all and nothing is sent to Google for analytics. Why: you agreed to it (consent). You can change your mind at any time under "Cookie settings" at the bottom of every page.
• Server logs. Like every website, my host (Oderland, Sweden) records technical requests in log files, including your IP address and browser type. These are used to keep the site running and secure, and are kept for 30 days.

If you create an account

• Your email address, an optional display name and your password. The password is stored only as a secure hash, never as plain text, so not even I can read it.
• The worksheets you save, with the names you give them.
• When the account was created, when you last logged in, and whether you've confirmed your email.
• Short-lived security data: failed login attempts (email address and IP address, deleted within a day) and one-time links for confirming your email or resetting your password (valid for 48 hours and 60 minutes respectively).

Why: to provide the account and keep it secure (contract and legitimate interest).

I send you emails only when they are needed for your account: a link to confirm your address, and a password reset link when you ask for one. There is no newsletter.

If you use the contact form

Your name (optional), email address, topic and message are sent to my mailbox, together with your IP address, so I can reply and spot abuse. For the same reason, the IP address is also counted for up to a day to limit how many messages can be sent. I keep messages only as long as I need them to deal with your question, and delete them within [12 months]. Why: to answer you (legitimate interest).

If you ask to hear about a printed workbook

After a download, the site may ask whether you'd buy a printed workbook. The answers are counted anonymously. If you choose to leave your email address to be told when a workbook comes out, I store it together with the workbook topic and your answers. I will use it only to tell you about that workbook, and delete it once I have (or if I decide not to make one). Why: you asked me to (consent). You can withdraw at any time through the contact form.

Cookies and browser storage

• Session cookie (hwgsess). Set only when you log in or use a form (login, sign-up, contact). It keeps you logged in and protects forms against forgery, and is deleted when you close your browser. This cookie is strictly necessary, so it doesn't need consent.
• Preferences in your browser. Your light or dark theme choice, and whether you've dismissed the "thank you" panel, are saved in your own browser's local storage. They are never sent to me.
• Google Analytics cookies (ga and ga_…). Set only after you click Accept in the cookie banner, and kept for up to 2 years. Your choice itself is saved in your browser's local storage, and you'll be asked again after a year. You can change it at any time under "Cookie settings" at the bottom of every page. If you withdraw consent, the Google Analytics cookies are deleted.

There are no advertising or tracking cookies of my own.

Other services the site relies on

Some parts of the site load files from other companies. When that happens, your browser connects to them directly, so they receive your IP address:

• Google Fonts (Google): the site's typefaces, and the fonts you pick in the generator.
• jsDelivr, unpkg and cdnjs: code libraries the generator uses to read fonts and build PDFs.
• Google Analytics (Google): only if you accept it, see above.
• Oderland: runs the server and stores the database. Account emails go out through the host's mail server.

These links take you to other sites only when you click them, and their own privacy policies then apply:

• Pinterest: the "Save" button on a worksheet.
• Ko-fi: if you choose to leave a tip.
• Amazon: the recommended supplies. As an Amazon Associate I earn from qualifying purchases. Amazon may set its own cookies once you're on its site so that it knows the visit came from here.

How long data is kept

• Account and saved worksheets: until you delete your account, then removed immediately.
• Failed login attempts: up to one day.
• Email confirmation and password reset links: until used or expired, then deleted.
• Scrambled IP codes for usage counts: deleted the next day. The anonymous totals are kept.
• Workbook "notify me" emails: until I've sent the notice or dropped the idea, or until you ask me to delete it.
• Contact messages: up to 12 months.
• Server logs: 30 days, set by my host.
• Google Analytics data (if you accepted): 1 months at Google, the retention period set in my Google Analytics account.

Your rights

Under the GDPR you can ask me to:

• see the personal data I hold about you, and get a copy of it;
• correct it (you can change your name and email yourself in Account settings);
• delete it (you can delete your account yourself in Account settings; for anything else, contact me);
• restrict or object to how I use it;
• withdraw consent where I rely on it, for example for the workbook notice.

Write to me through the contact form and I'll reply within 3 days. If you think I've handled your data wrongly, you can also complain to your data protection authority. In Sweden, that is Integritetsskyddsmyndigheten (IMY).

Children

The worksheets are made for children to practise with, but the site is meant to be used by the adults around them: parents, teachers and tutors. Accounts are for adults. Please don't let a child create one, and never enter a child's personal details in the contact form or the workbook question.

Changes

If I change what the site collects, I'll update this page and the date at the top.