Privacy policy

Positively Devious is a free, volunteer-run Leicester guide helping young people and families find local activities, opportunities, spaces and support.

Who is responsible for your information

Positively Devious is the data controller. That means we decide how the personal information described on this page is used. We are a volunteer-run project based in Leicester, UK. We are not a registered company or charity.

You can reach us about anything on this page by email at hello@positivelydevious.co.uk. Use that address to ask a question, correct a page, object to us using your information, or ask us to delete it. We aim to reply within a few working days.

We collect only what we need to run, improve and keep the guide accurate. We do not sell personal information.

What information we collect

When you send us a listing

The submit form asks for your name, your email address and the details of the activity. We use this to check the activity and to come back to you if something is unclear. We keep the record while the listing is live, and for up to two years after we deal with it, so we have a history of where a page came from. Your contact details are not published unless they are clearly the organisation's own public contact details.

When you report a problem

The report form saves which listing you mean, the type of problem, what you wrote, and your email address if you choose to give one. You can tick a box to say you want to stay anonymous, and we save that choice too. We use reports to fix or remove pages and to act on safety concerns. We keep them for up to two years, because we may need to show what we were told and what we did about it.

When you use the feedback button

The feedback button saves your message, the type of feedback you picked, the page you were on, the size of your browser window and your browser's user agent (the text your browser sends that says what device and browser it is). If you add your email address, we save it and use it only to reply to you. We use all this to find broken and confusing parts of the site. We keep feedback for up to 12 months after we have dealt with it.

What people search for

When you search or use the filters on the discover page, we save what was searched for. That is the words typed in, the filters chosen (type of thing, free things only, ages) and how many results came back. We do not save your name, your email address or anything else that points to you. We use it to see what young people are looking for that Leicester does not have yet. We keep these records for up to 12 months.

Where you are

If you ask the site to sort by nearest, your browser will ask you to share your exact location. If you say yes, that location is used inside your browser to work out distances. It is not sent to us and we do not store it. It is gone when you close the page. If you say no, everything else still works.

Maps and place lookups

The maps are not ours. The map pictures come from CARTO and are built from OpenStreetMap data. When a map loads, your device asks CARTO for those pictures, so CARTO can see your IP address. We do not send them anything else about you.

When you type a place name or postcode into the location box, our own server asks Postcodes.io or OpenStreetMap to turn it into a point on the map. Those services see the words you typed. They do not see your IP address, because the request comes from our server and not from your device.

Organisation and outreach information

We keep information about organisations and their public activities so we can create and check pages. This may include an organisation name, a staff member's professional name or role, public business email or telephone number, source links, our correspondence and contact preferences.

We usually obtain this information from organisation websites, public directories, public social-media pages, published documents or information an organisation sends to us. Public availability does not remove anyone's privacy rights.

Basic service data

The companies that host our site and database keep their own security logs. Those logs can include your IP address and the pages you asked for. They exist to keep the site running and to stop attacks, and those companies delete them on their own timetables. We do not use advertising trackers, we do not sell behavioural profiles and we do not add advertising cookies. You do not need an account to browse the guide.

Why we use this information

• To review, publish and maintain organisation and listing pages.
• To ask organisations to confirm or correct information attributed to them.
• To respond to submissions, reports, questions and safety concerns.
• To remember contact objections and avoid contacting people again.
• To secure, operate and improve the service.

Our main lawful basis is legitimate interests: running a useful, accurate local guide and giving organisations a straightforward way to correct or remove their information. We limit first contact to relevant professional or organisational routes, explain where the information came from and provide a simple way to object. Where consent is required for a particular activity, we will ask for it.

You can object at any time to the use of your personal information for outreach or direct marketing. We will stop and retain only the minimum suppression information needed to respect that choice.

Who receives information

Authorised Positively Devious editors can access information needed for moderation, research and correspondence. We also use service providers: Vercel hosts the website, Supabase holds the database and uploaded images, an email service sends and receives our emails, and CARTO, OpenStreetMap and Postcodes.io provide maps and place lookups. They may process information only to provide those services to us.

We may disclose information where required by law or where reasonably necessary to protect someone from serious harm.

How long we keep information

We keep organisation research and correspondence while a page is active and while it is reasonably needed to maintain an accurate record. We review public contact information when the underlying page is checked and remove personal business-contact details when they are no longer needed. Submission and report records are kept only as long as needed for moderation, safety and audit purposes, and normally no longer than two years.

If you ask us not to contact you, we keep the minimum address and preference record needed to prevent future contact. This avoids accidentally adding the same address again.

Security and international processing

We use access controls and reputable hosting providers to protect information. Some providers may process information outside the UK. Where that happens, we require an appropriate legal safeguard for the transfer.

Your rights

Depending on the circumstances, you can ask for a copy of your personal information, ask us to correct or delete it (erasure), restrict how it is used, or object to our use of it. An objection to direct marketing is absolute: we always stop.

To use any of these rights, email hello@positivelydevious.co.uk and tell us what you want us to do. That is also the address for stopping our emails, correcting a page or asking us to take one down. It helps if you give us enough to find the record, such as the page address, the email address you used or the organisation name. We will reply within one month. If we cannot do what you ask, we will tell you why.

You can also use our contact page.

You can also complain to the Information Commissioner's Office.

Young people

The guide is designed for young people and families, but public browsing does not require an account. If a young person contacts us, we use only the information needed to respond, moderate their contribution or address a safety concern.

Changes to this policy

We may update this policy as the service develops. The latest version and update date will always appear on this page.