Privacy Policy

Last updated: July 28, 2026  ·  Applies to ownasentence.com

1. Data controller

Own A Sentence ("we", "us", "our") is the data controller for personal data processed through ownasentence.com. We are responsible for deciding how and why your personal data is used.

For all privacy matters, contact our Data Controller at: Contact

2. Personal data we collect and why

We collect only the data strictly necessary to provide and protect the Service. Below is a complete account of every category of data we process:

2.1 Data you provide directly

• Sentence text — The content of your sentence (max 140 characters). Displayed publicly on the website. Legal basis: contract performance.
• Display name — The name or handle you choose. You may enter "Anonymous". Displayed publicly. Legal basis: contract performance.
• URL — An optional website link. If provided, displayed publicly as a hyperlink on your name. Legal basis: contract performance.
• Email address — Optional. Collected for Stripe to send your payment receipt. Stored by us only as a one-way SHA-256 hash — we cannot recover or read your email address from what we store. Legal basis: contract performance.

2.2 Data collected automatically

• IP address — We never store your raw IP address. We store a one-way SHA-256 hash of your IP address combined with a private server-side salt, used solely for rate limiting (maximum 3 submissions per hour per IP). Retained for 90 days, then automatically deleted. Legal basis: legitimate interests (fraud and abuse prevention).
• Stripe session and payment IDs — Reference identifiers (e.g. cs_live_xxxxx, pi_xxxxx) used to associate your payment confirmation with your sentence record. We never store card numbers, CVVs, or banking data. Legal basis: contract performance.
• Server access logs — Standard web server logs recording anonymised request data (hashed IP, page path, HTTP status code, timestamp). Retained for 30 days for security diagnostics, then deleted. Legal basis: legitimate interests (security).

2.3 Data we do NOT collect

• Raw IP addresses in any recoverable form;
• Browser fingerprints, device identifiers, or tracking pixels;
• Behavioural data, browsing history, or session recordings;
• Social media identifiers or login data;
• Any data from third-party advertising or analytics platforms.

3. Cookies

We use exactly one cookie, and it is strictly necessary:

• Session cookie (PHPSESSID) — A temporary, encrypted session cookie used to prevent cross-site request forgery (CSRF) during form submission. It contains no personal data and is deleted automatically when you close your browser. No consent is required for this cookie under applicable law.

We do not use analytics cookies (Google Analytics, Hotjar, etc.), advertising cookies, or any third-party tracking cookies. No cookie consent banner is required because we only use one strictly necessary cookie.

4. Third-party services

We use one third-party service that processes personal data on our behalf:

• Stripe, Inc. — Payment processing. When you proceed to checkout, you are transferred to a Stripe-hosted payment page. Stripe processes your card data under their own GDPR-compliant infrastructure. We have a Data Processing Agreement with Stripe. Stripe's Privacy Policy: stripe.com/privacy. Stripe may set their own cookies during the checkout process on their domain.

We do not use any other third-party services that process personal data.

5. How long we keep your data

• Approved sentence records (sentence text, display name, URL, tag) — Retained indefinitely as part of the permanent archive. This is integral to the Service you purchased.
• Email hash — Retained alongside the sentence record. Cannot be reversed.
• IP address hash — Retained for 90 days for rate-limiting purposes, then automatically deleted.
• Rejected sentence records — Sentence text and metadata retained for 90 days for fraud prevention, then deleted. Email and IP hashes follow the same schedule.
• Abandoned payment records (where payment was not completed) — Deleted after 24 hours.
• Server logs — Retained for 30 days, then automatically deleted.

6. Data security

We implement the following technical and organisational measures to protect your personal data:

• All data in transit is protected by TLS/HTTPS encryption;
• Email and IP addresses are stored exclusively as one-way SHA-256 hashes — they cannot be reversed;
• Database access is restricted to server-side application code only — no direct external access;
• The admin interface is protected by IP allowlisting and HTTP Basic Authentication;
• Configuration files and credentials are stored outside the web root and are never publicly accessible;
• All form submissions use CSRF tokens to prevent cross-site request forgery;
• User input is sanitised and output-escaped to prevent injection attacks.

Despite these measures, no internet transmission is 100% secure. We cannot guarantee absolute security and are not liable for unauthorised third-party access beyond our reasonable control.

7. International data transfers

Our web servers are located within the European Economic Area (EEA). Payment processing by Stripe may involve data transfers to the United States; Stripe relies on Standard Contractual Clauses (SCCs) approved by the European Commission for such transfers. We do not transfer personal data outside the EEA through any other mechanism.

8. Children's privacy

The Service is not intended for use by persons under 18 years of age. We do not knowingly collect personal data from children under 18. If you believe a person under 18 has submitted data through this Service, please contact us at Contact and we will delete it immediately.

9. Your rights

Under the UK GDPR and EU GDPR, you have the following rights in relation to your personal data:

• Right of access (Article 15) — You may request a copy of the personal data we hold about you.
• Right to rectification (Article 16) — You may request correction of inaccurate data. Note: sentence text is permanent by design and cannot be changed after purchase.
• Right to erasure (Article 17) — You may request deletion of your personal data. We will comply where lawfully required. For purchased sentences, the sentence text forms part of a permanent public archive — full removal is not possible while the Service operates. We can anonymise your display name and remove your URL. See our GDPR page for full details.
• Right to restriction (Article 18) — You may request that we restrict processing of your data while a dispute is being resolved.
• Right to data portability (Article 20) — You may request your data in a structured, machine-readable format (JSON or CSV).
• Right to object (Article 21) — You may object to processing based on legitimate interests.

Important: Because we store email addresses and IP addresses as one-way hashes only, we cannot identify your records from an email address or IP address alone. To exercise any of the above rights, please contact us at Contact and include your sentence number (e.g. #4,821). We will respond within 30 days.

10. Supervisory authority

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Telephone: 0303 123 1113

If you are in the EU, you may lodge a complaint with the data protection supervisory authority in your member state. We would appreciate the opportunity to address your concerns directly before you approach a supervisory authority.

11. Changes to this policy

We will post notice of material changes to this Privacy Policy on the homepage for at least 30 days before they take effect. The "Last updated" date at the top of this page will always reflect the most recent version. Continued use of the Service after changes take effect constitutes acceptance.

12. Contact

For all privacy and data protection enquiries: Contact
For GDPR-specific requests, please also see our dedicated GDPR Rights page.