Privacy notice

Signed-out and device storage

When you are signed out, survey drafts and completed prototype responses, a temporary watchlist, usefulness choices and personal workspace records may be stored in local browser storage. They are labelled “Saved on this device” and are not silently presented as synchronised. Anyone using the same browser profile may be able to see them. Clearing site data removes them and does not affect the public evidence.

The Benefits and Support Finder matches answers in the browser and does not permanently store income, disability, household or other profile answers.

Optional accounts

On a deployment with Supabase configured, Google OAuth or a time-limited email magic link can authenticate an account. Gov Progress does not receive or store a password. The authentication provider retains identity information needed for sign-in. Optional display name and profile bands, watchlist, visit timestamps, contribution history, survey answers and usefulness ratings are held in separate database tables protected by row-level security.

Profile fields are optional broad ranges. Savings include cash and investments but exclude the main home. Profile information is used to organise comparisons and relevant updates; it is not used to change the weight of a survey response or infer political affiliation or protected characteristics.

Gov Progress Monthly newsletter

Creating an account and subscribing to Gov Progress Monthly are separate choices. The newsletter is optional, its checkbox is unticked by default, and choosing not to subscribe has no effect on account access, watchlists or Public Priorities survey participation. We collect the verified delivery email only after an affirmative subscription choice and record the consent time, source and wording version.

The monthly email may contain verified UK data changes, government commitment updates, charts, Public Priorities respondent results, a current survey link, upcoming official releases, methodology and source links. Public Priorities results are voluntary website respondent results and are not described as representative UK polling.

A subscriber may choose a standard edition or a personalised edition. Personalisation uses only deliberately followed watchlist topics, broad change-since-last-visit information, upcoming releases and contribution counts. It does not include or target from exact income, savings or investment bands, dependants, sensitive profile details, detailed political answers or individual survey choices. Benefits or support personalisation is included only when the subscriber deliberately selects that topic. Political persuasion based on survey answers is not performed.

Resend is the supported email delivery processor for this implementation. It receives the delivery address, subject and email content only when the deployment operator configures and enables the newsletter. Gov Progress does not use newsletter tracking pixels and does not request open or click tracking. Every delivered issue includes a secure unsubscribe link that works without sign-in, plus account-preference and privacy links.

Subscription preferences are retained while the subscription or account is active. On unsubscribe, watchlist-based newsletter personalisation and pending address changes are removed from the active send data immediately; a proportionate consent and delivery audit is retained for up to six years to demonstrate the request and prevent duplicate sends. On account deletion, the active address and personalisation are removed and only a one-way email hash may be retained as a suppression record for as long as needed to prevent accidental contact. The production operator must document backup expiry and honour deletion requests through the contact route on the corrections page.

You can withdraw consent at any time in Account and privacy settings or through any newsletter’s unsubscribe link. Withdrawing newsletter consent does not delete the Gov Progress account. A previously unsubscribed address is not resubscribed unless the account owner makes a new affirmative choice.

Public Priorities survey privacy

Political survey responses may be sensitive when linked to an identifiable account. Authenticated contribution records and response payloads are separated. A signed-in user can read only their own retained response; public users can access only server-generated aggregate results. Individual responses and optional profile records are not exposed by public queries.

The authenticated flow enforces one contribution per account and survey month in the database. The signed-out prototype remains device-local and does not provide cross-device duplicate protection. Genuine anonymous public collection must remain disabled until proportionate anti-bot and rate-limiting controls are configured and tested.

Cookies and analytics

The project does not include analytics, advertising pixels or behavioural tracking. Essential browser storage may hold an authentication session, survey draft or the device-local features described above. A cookie consent banner is not used because no non-essential cookies are currently set. Consent controls must be added before non-essential cookies or analytics are introduced.

External links and local assets

Following a source link takes you to another organisation governed by its own privacy policy. Fonts and the D3 chart library are served locally by this website, so rendering the dashboard does not require requests to Google Fonts or jsDelivr.

Corrections and feedback

Relationship usefulness ratings and optional feedback are private. Signed-in users can update one current rating per graph configuration. Signed-out prototype feedback remains on the device and is not silently uploaded. Raw feedback is not exposed publicly, and aggregate usefulness results should not be published until an adequate disclosure-safe sample exists.

The separate corrections channel uses the provider, purpose and retention details shown on the corrections page when configured.

Visits, retention and deletion

For signed-in accounts, the service stores a previous and last meaningful visit timestamp so it can calculate “What changed” before advancing the comparison point. It does not write on every scroll or page event and does not retain a precise IP address for personalisation.

Account data is retained while the account is active or for the documented survey-research retention period, whichever policy applies. Users can clear optional profile fields, export their account data and request permanent account deletion from account settings. The supplied database function ends any newsletter subscription, creates a one-way suppression hash where needed, deletes the authentication identity and relies on cascading foreign keys to remove account-linked profile, watchlist, visit, contribution, response, usefulness, newsletter preference and consent records. A production operator should document backup expiry and any legally required residual retention before launch.

Security and international processing

Database row-level security restricts account tables to the authenticated owner. Browser code uses only a Supabase anonymous/public key; a service-role key must never be included. The deployment operator is responsible for selecting the Supabase region, configuring Google as an identity provider, reviewing provider terms and testing deletion, recovery, rate limiting and OAuth redirects on the production domain.