Privacy and your data
Last updated: 10 September 2026
feltandspout provides practical checklists and links to children’s stories and nursery rhymes for parents and carers. This page explains what happens to your information when you use the site.
Who is responsible
feltandspout is responsible for the information used to operate this website. Use our contact form for privacy questions, requests about your information or deletion help.
Your checklist without an account
Your bag choice, ticked items, excluded suggestions and items you add save in this browser’s local storage. They are not uploaded to our checklist database unless you sign in to save across devices. We also store your appearance and statistics preferences in this browser. This storage lets us provide the features you choose.
Browser-only information remains until you clear this site’s stored data or your browser removes it. Private browsing, clearing site data or changing browsers may lose the local list. Browser-only lists cannot be retrieved by us from another device.
If you sign in with Google
Signing in is optional. Google shares your email address, an account identifier and basic profile information such as your name and profile image with our authentication provider, Supabase. We do not receive your Google password or access to your Gmail messages, contacts or Drive files.
We use your account identifier to save and retrieve your checklist across devices. Your email is used to identify your account and handle account support. Authentication session information and a local copy of your account checklist remain in the browser to keep you signed in and help recover interrupted saves. Signing out returns to the separate browser-only list.
Account data is held in our Supabase project in London, UK. Access controls prevent other users from reading or changing your checklist. The site operator and authorised service administrators may access information when necessary to operate the service, investigate a problem or respond to your request. This is not an end-to-end encrypted storage service.
We process account and checklist information to provide the account-saving service you request. Keep custom items to practical packing reminders; please do not enter medical records, diagnoses, passwords or other sensitive information.
Optional visit statistics
Statistics are off until you choose “Allow visitor count” or enable “Allow visitor count” in Profile & preferences. Choosing “No thanks” leaves the checklist and videos available. You can withdraw permission at any time using Profile & preferences or “Visitor count settings” in the site footer. We save this choice in browser storage so we remember it on later visits. A browser Do Not Track or Global Privacy Control signal also disables this collection.
If you allow it, Umami processes page visits to help us understand which parts of feltandspout are useful. We send a fixed page name, the site hostname, browser language and screen dimensions. Network requests also expose connection information, such as your IP address and browser information, to the provider; Umami uses its privacy-preserving processing to estimate visitors and visits. We do not send your email, account ID, checklist contents, search text, sign-in codes or the full URL query string.
We use Umami’s EU data region. The current plan retains analytics data for six months. We do not enable advertising tracking, session recordings, heatmaps or account identification. The statistics dashboard is private to the operator. Permission is our basis for this optional analytics processing. Umami privacy information.
Hosting, security and external services
Hostinger hosts the site and processes connection logs, including IP address, requested address, time, browser information and response status. These help deliver the site, detect abuse and investigate faults. We rely on our legitimate interest in providing and securing the service for necessary operational logs and support.
Google handles sign-in. Supabase handles accounts and stored checklists. Umami handles optional statistics. Hostinger handles website delivery. These providers may use infrastructure or support operations outside the UK or EU under their applicable data-protection arrangements. See Google’s privacy policy, Supabase’s privacy policy and Hostinger’s privacy policy.
Video cards are ordinary links. Opening one takes you to YouTube, which handles playback under its own privacy and cookie settings. No YouTube player is embedded in this website. Other linked sites, including NHS guidance, have their own policies.
Book-shopping links
Our book-shopping links open an external retailer in a new tab. An affiliate link includes referral and campaign identifiers so a qualifying purchase can be attributed and commission calculated. ISBN search links also include the ISBN shown on the book card. We do not put your account details, checklist contents or anything you type on Felt & Spout in these links.
We use ordinary links, without embedded retailer widgets, advertising pixels or affiliate cookies on this website. After you follow a link, the retailer’s own privacy and cookie choices apply. Our optional visitor-count setting controls statistics on Felt & Spout, not another website’s processing. See how our affiliate links work.
When you contact us
Our contact form sends your name, reply email address, selected topic and message to the feltandspout Gmail inbox through our hosting provider’s mail service. We use these details to respond and resolve your request. The form uses a temporary security cookie and uses a keyed hash of your connection address with recent submission times to limit spam over a 24-hour window. Expired entries are removed when the next message is submitted. It does not save message contents in that spam-control record or subscribe you to marketing. Google processes our support email; the provider’s privacy policy is linked above.
Keeping and deleting information
We keep account information and the current saved checklist while you use the account, until you ask us to delete it. Analytics is retained for up to six months. We keep support correspondence only as needed to resolve the request and maintain a record of how it was handled, normally no longer than twelve months after resolution unless a legal obligation or unresolved dispute requires longer. Hosting and provider security logs follow the provider’s operational retention schedules.
You can delete your account in Profile & preferences: choose “Delete my account” and type DELETE to confirm. We check your signed-in account before removing your authentication account and its saved checklist from the active database. The site then removes this browser’s account copy, signs you out, and displays confirmation; it does not send a confirmation email. Your separate browser-only list and Google account are unaffected. You can also request help with deletion through our contact form.
Operational backups or legally required records may remain until their retention period expires. Local account copies on other devices may remain, especially when offline: clear stored data for feltandspout.com on each device to remove them.
Your choices and rights
Depending on the circumstances, you can ask to access, correct, receive a copy of, restrict or delete personal information we hold, and object to processing based on legitimate interests. You can withdraw analytics permission without affecting the lawfulness of earlier processing. Contact us using the form linked above; we may need to verify that the request comes from the account holder.
If you are unhappy with our response, you can contact the UK Information Commissioner’s Office or your local data-protection authority. We do not sell personal information or automatically subscribe account holders to marketing messages.
Parents, carers and changes
Accounts and packing tools are intended for adults. The literature section is intended for parents and carers choosing videos to watch with children; a child does not need an account. Please contact us if you believe a child has supplied personal information that should be removed.
We update this page when the service or its data use changes and show the update date at the top.