Privacy.

Who we are and how to reach us

We are openday, the operator of this service. If you have any question about your data, want to exercise one of the rights below, or want to make a complaint, email us at ali_k10@hotmail.com.

What we store when you have an account

Sign-in is handled by Clerk, a third-party provider acting as our processor. Clerk manages your login and sets strictly-necessary authentication cookies so you stay signed in. We never see or store your password.

Once you have an account, we store the following in our database so your planner works and stays saved between visits:

• Child-plan details you enter during onboarding: an optional nickname or planner label, the school entry year or stage, the starting term, your postcode sector and council code. If you leave the label blank, we generate “Child 1”, “Child 2” and so on.
• The schools you save or shortlist.
• Your planner content for each school: notes, details about documents you’re tracking, open days, and timeline dates.
• Visit ratings you record after seeing a school.
• Application details you enter, including any offer outcomes.
• Which dashboard tasks you’ve marked as done.

This data is held in a PostgreSQL database hosted by Neon, which acts as our processor. Encrypted off-site backups are kept so we can recover from failures.

Children's data

The account holder is the parent or carer. We do not require a child’s real name or date of birth. An optional nickname or planner label is used only to tell multiple plans apart. Entry year, postcode sector and council code personalise deadlines and local information. A full postcode entered during setup or an area update is used to resolve those coarse values and nearby results, then discarded. We don’t use child-plan details for anything else.

If you're not signed in (guests)

You can browse and build a shortlist without an account. A guest shortlist lives only in your browser’s session storage — it stays on your device and is cleared when you close the tab. It is never sent to or kept on our servers.

Analytics

We use our own first-party analytics to understand demand and improve the product. We do not use cookies for analytics and we do not use any third-party trackers or advertising networks.

We record usage events such as viewing a school profile, running a search, adding a school to a shortlist, viewing a local-authority page, and clicking through to a school website or council portal. Signed-in and signed-out visitors use the same analytics record. Each event stores at most:

• the school identifier (URN);
• the postcode sectoronly — for example “HA1 4” — never your full postcode;
• the child’s entry-year group;
• the local authority code;
• and whether the event came from production, an internal administrator, or a test/preview environment.

Analytics events do not contain your account id, child id, email address, full postcode, IP address, or a persistent browser or advertising identifier. Internal area-demand reports use only these events and public school/local-authority locations; they do not inspect children’s profiles or saved-school relationships.

We may share analytics with schools, but only as aggregated statistics about overall demand. We never show a school an individual’s browsing.

Security and rate limiting

To protect the service from abuse, we briefly record the IP addresses of incoming requests in a temporary table. These entries are deleted within roughly two minutes of the rate-limiting window passing.

Our lawful bases

Under UK GDPR we must have a lawful basis for using your data. We rely on:

• Performance of a contract — to provide the planner you signed up for (your account, saved schools, notes, deadlines, applications and the rest of your planner content).
• Legitimate interests— for our first-party analytics and for keeping the service secure, including rate limiting. We’ve designed these to be minimal and privacy-preserving.
• Consent — where it applies, and which you can withdraw at any time.

How long we keep your data

We keep your account data for as long as your account exists. If you delete your account, we permanently and immediately remove all of it from our database — children’s details, your shortlist, your planner content, visit ratings, applications, and dashboard task state. There is no grace period.

Analytics events are not linked to your account or a persistent visitor identifier. They therefore remain as aggregate demand counts when an account is deleted, but cannot be retrieved as an account browsing history.

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data erased;
• restrict how we use your data;
• object to our use of your data;
• ask for your data in a portable form.

To make a subject access request, or to exercise any other right, email us at ali_k10@hotmail.com. We handle these manually and will respond within one month.

Complaints

We hope to resolve any concern directly, but you also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office, at ico.org.uk.