Privacy

Who is responsible for your data

This site is run by Kalkman, trading as Kalkman Code, a sole trader based in Suffolk, United Kingdom. For the purposes of UK data protection law I am the data controller for any personal information you give me through this website or in the course of doing work for you.

You can reach me at hello@kalkmancode.co.uk.

What I collect, and when

If you fill in the enquiry form, I collect what you type into it: your name, your email address, what you are asking about, and optionally your phone number and any notes you add.

If you email, message or ring me instead, I hold whatever you chose to tell me in that message, and a note of what we agreed.

If I build something for you, I keep what the job needs: the specification, the correspondence, what was delivered and what you were invoiced.

I do not use advertising or tracking cookies, and there are no third-party trackers embedded in these pages beyond Cloudflare Web Analytics, which sets no cookies and does not track you across sites. Fonts are served from this domain rather than fetched from anyone else. See the cookie notice for what it records.

Work I build for you

Software I build may hold your data or your customers’ data. What it collects and how long it keeps it is decided in the specification, and once the work is handed over you are the controller of everything in it.

HorseDex keeps its records on your own devices. If you turn sync on they are copied between your devices through your own iCloud, using Apple’s CloudKit private database, and backups go to your own iCloud Drive. That is between you and Apple: there is no account to create with me, no server of mine involved, and nothing comes to me. Where a released app differs from that, its own privacy notice says so.

Beamer desktop

Beamer connects your paired computers directly over your network. Keyboard, pointer and clipboard data travel between those computers, without an account or a server of mine. Settings, pairing details and diagnostic logs are kept on your computers; logs can include computer names and network addresses, so check them before choosing to send one to me for support. Beamer has no advertising or analytics and does not automatically send me crash reports. When Check for updates is on, it asks GitHub for the latest release at start-up and once a day. GitHub sees your IP address as part of that request. You can turn this off in Overview.

Beamer Pocket

Beamer Pocket is the Beamer companion for iPhone, iPad and Android. It needs no account with me and has no advertising, analytics or built-in crash-reporting service. Control input, including text you type, and the device details needed to pair and connect go directly between your devices over your local network, with the control connection encrypted. The camera is used only to scan a pairing QR code; Pocket does not save or upload camera pictures. Pairing details, settings and custom layouts are stored on your device; layouts can also be shared with your paired computers or exported by you. On iPhone and iPad, files you accept from a paired computer are saved in Pocket’s folder in Files. Where supported and enabled, Pocket can show information from your desktop, such as the active app, window title, media and presentation notes, and exchange controls and status with your paired watch. None of this is sent to me or used for tracking.

Beta testing is separate: Apple’s TestFlight shares crash logs, usage information and feedback with me under its own terms. Tester details may include your name and email address, depending on how you join and what you submit. If you choose to send feedback through Google Play or email, I receive what you send. I use testing data and feedback to investigate problems and improve Beamer. The enquiry and rights sections of this policy also apply when you contact me for support. The paid app’s terms are on the Beamer Pocket terms page.

The Beamer Pocket beta programme

If you apply to test Pocket, I collect your email address, the name you would like me to use (optional), your phone or tablet type and its system version, your computer’s operating system and version, which setups you can test, what you would use Pocket for, whether you can try a build each week, and your country if you choose to give it. If I select you, I also record the Apple or Google account address you test with, if it differs, and where you are in the programme: invited, installed, active or left.

You sign in to the programme board and to reporting in the app with that email address, using a one-time link or code. A report holds what you write: what happened, what you expected, optional steps, the Pocket and desktop versions, and my replies. The app also includes device details: its version and build, your system version, a device category such as phone or tablet, the mode you were using and how the last connection ended. You can see them before you send, and on Android you can leave them out.

Diagnostics and a screenshot are optional, and diagnostics are off until you turn them on. Diagnostics are a list of connection events and error types, shown to you in full before sending. They contain no typed text, clipboard, pairing codes, names, network addresses or file paths. A screenshot is whatever is on it, so check it first. Its hidden image details, such as location, are removed when it is uploaded. Nothing is sent unless you press send, and a report you save stays on your device.

I use all of this to run the beta: to choose testers, send builds, reply to reports and fix what is broken. The lawful basis is legitimate interests, because you asked to take part and this is the use you would expect. News about Beamer is a separate choice, off unless you turn it on.

The programme runs on my own server in the UK. Other testers cannot see your reports, and only I can read them. Programme emails are sent through Google Workspace, and the board’s traffic passes through Cloudflare on its way to my server. If you also send feedback through TestFlight, Apple shares it with me and I copy it into the board. Apple and Google see what their own testing tools need to deliver builds to you. The tools I use to keep track of the programme see counts and statuses only, never who you are or what you wrote. Nobody else receives any of it.

An application you never confirm is deleted after 7 days. If you were not selected, your application is deleted 90 days after the programme closes. Screenshots and diagnostics are deleted 30 days after I close the issue they belong to, and copies of TestFlight feedback 30 days after I have dealt with them. All of them are deleted when the programme closes. At that point what testers wrote in their reports is removed too, leaving only a record that an issue existed and what happened to it. Backups of the programme are deleted after 30 days.

Programme update emails have a link to pause them or leave. Leaving stops your access straight away and deletes your attachments. If you want your details deleted, email me and I will do it once I have confirmed it is you. That removes your email address, your application and what you wrote in your reports, keeping only a record that an issue existed and a coded marker that stops your TestFlight feedback being copied in again. Older copies can remain in backups until those expire, at most 30 days. Neither step removes you from TestFlight or Google Play testing, which you can leave in those apps.

Why I am allowed to hold it

When you send an enquiry, the lawful basis is legitimate interests: you have asked me to get in touch about work, and replying to you is the obvious and expected use of what you sent. Once you commission something, the basis becomes performance of a contract, and some records are then kept because tax law requires it.

Who else sees it

Enquiry form submissions are delivered to my inbox through Web3Forms, a form-delivery service acting as a processor on my behalf. The message passes through their systems in order to reach me.

Web3Forms is based outside the United Kingdom and runs its servers in the United States, so submitting the form sends what you wrote overseas. They do not keep form submissions. Each one is processed and forwarded straight to me, but their server logs can hold personal data for a short period, which they delete periodically. If you would rather not use Web3Forms, email me instead. Email is also processed by Google Workspace, as explained below, so it is not a UK-only alternative.

This website is hosted on Cloudflare Pages. Cloudflare processes the technical information that any web server sees when you visit a page, such as your IP address, for security and delivery purposes.

My email runs on Google Workspace, so anything you send me, by the form or directly, is stored and processed by Google, which operates servers outside the United Kingdom. For website enquiries, beyond those three I do not share, sell, rent or trade your information with anyone. Nobody is buying a marketing list from me.

How long I keep it

Enquiries that do not turn into work are deleted within twelve months. If you become a client, I keep the job records and correspondence for the life of the working relationship and for six years afterwards, because HMRC requires business records to be kept for six years.

If you want your enquiry deleted sooner than that, ask me and I will do it.

Your rights

Under UK GDPR you have the right to:

• ask what personal data I hold about you, and get a copy of it
• have anything inaccurate corrected
• have your data deleted, where I have no legal reason to keep it
• object to my processing it, or ask me to restrict what I do with it
• ask for your data in a portable format

Email me and I will deal with it. There is no charge, and I will respond within one month.

Complaints

If you think I have handled your data badly, please tell me first so I can put it right. You also have the right to complain directly to the Information Commissioner’s Office at ico.org.uk, or on 0303 123 1113.

Changes

If this policy changes, the date at the top of the page changes with it. I will not quietly alter it and pretend otherwise.