Privacy Policy

This policy explains what happens to your information when you use this website, any of the apps and websites listed on it, or the DPC app, which is not listed but is covered here too. It was last updated on 28 July 2026.

Lewis Developing is Alun Lewis, working as a sole developer in the United Kingdom, and is the data controller for everything described below. You can reach me at hello@lewisdeveloping.co.uk.

The short version

I do not track you, and I do not sell or share anything about you. There is no advertising in any of my apps or on any of my websites, and no profiling. Most of what I have written collects nothing at all — the two mobile apps below cannot even reach the internet. My servers do keep short-lived logs, described next, and the remaining exceptions are set out honestly, product by product, further down.

Server logs

Every website here, and the service behind the All Saints app, keeps ordinary server logs. This is the routine record a web server makes of the requests it answers: the IP address the request came from, the page or endpoint asked for, the time, the response, and details of the browser or app that asked. Logs exist so that I can find out why something broke and notice when a service is being abused.

Those logs are forwarded to Better Stack, a log hosting service, where they are kept for three days and then deleted automatically. I do not use them to build a picture of who visits or to follow anyone between sites, and they are not combined with anything else.

Ordinary logs are written so as not to contain your name, email address or password: where an entry needs to refer to an account it records the account's internal id number instead. Passwords and sign-in tokens are never logged.

The two church apps are a deliberate exception, because a rota that anyone with permission can change needs a record of who changed it.

In All Saints, each edit is logged with the name of the person who made it, what was changed, and the value before and after. Since the rotas list people by name, those before-and-after values are often somebody's name.
In DPC, administrative actions — approving or rejecting a registration, changing someone's role, resetting a password, deleting an account — are recorded with the email addresses of the administrator who acted and the person acted upon. Ordinary rota edits are not attributed.

None of this is analytics. It exists so that when something changes, it is possible to see who changed it and put it back. These entries are deleted from the logs after three days like everything else. DPC also keeps its own record of administrative actions in its database, so that access decisions can still be accounted for once the logs have gone; that record is deleted after six months.

This website

lewisdeveloping.co.uk sets no cookies and stores nothing on your device. There is no analytics software on it, of any kind. There are no forms: the Contact page is an ordinary email link, so nothing is submitted through the site.

The site is hosted by Vercel, whose servers handle every request and produce the logs described above, which reach Better Stack and are deleted after three days.

The Donate page links out to a payment page hosted by Stripe. If you follow it, anything you enter is given to Stripe rather than to me, under their privacy policy. I never see your card details — only that a donation arrived.

The apps

GEDCOM Viewer (iOS and Android)

Your genealogy files never leave your device. The app reads the .ged file you choose, parses it on the device, and displays it. Nothing is uploaded, backed up to me, or sent anywhere.

This is enforced rather than merely promised: the Android app declares no internet permission at all, so it is incapable of making a network connection, and the iOS and macOS builds contain no networking or iCloud code. There are no accounts, no analytics and no crash reporting. I have no way of knowing which files you open or what is in them.

Noise Generator (iOS, macOS and Android)

The noise is synthesised on your device in real time — there are no recordings to download and nothing to send back. The app has no accounts, no analytics and no network code. Your settings (noise type, volume, timer) are kept on the device only. The Android permissions it asks for are for showing a playback notification and continuing to play in the background; it has no internet permission.

All Saints (iOS and Android)

This app shows duty rotas for All Saints Presbyterian Church, and it is the one app here that holds personal information, because it needs accounts.

When you register, the app stores:

your email address, forename and surname;
your password, kept only as a bcrypt hash — the password itself is never stored and cannot be recovered from the hash;
whether your email has been verified, and whether your registration has been approved.

New registrations are reviewed and approved by a church administrator before access is granted, because the rotas name members of the congregation. If you appear on a rota, the app displays your name in that context to other approved users of the app.

Sign-in uses access and refresh tokens, which are held on your device in the iOS Keychain or, on Android, in encrypted preferences protected by the Android Keystore. Verification emails are sent through Resend. The service behind the app runs on DigitalOcean, with the rota and account data in a PostgreSQL database there, and its logs go to Better Stack as described above.

There is no analytics or crash reporting in the app itself, and none of this information is used for anything beyond running the rota. If you would like your account and details removed, email me and I will delete them.

DPC (iOS and Android)

DPC is a duty planner for a church rota. It is not listed on my portfolio and is not open to the public: you need an account, and accounts are approved by an administrator before they give access. It is mentioned here because it holds personal information and because its store listings point at this page.

The account itself holds your email address, forename and surname, a hash of your password, and whether your address has been verified and your registration approved. As with All Saints, the password itself is never stored. Sign-in tokens are kept on your device in the iOS Keychain or Android's encrypted storage.

The rota data behind the app names the people rostered for each duty, and is maintained in a Google Sheet which the service keeps in step with its own database. Google therefore holds that rota as the operator of the spreadsheet. The service runs on Vercel with a PostgreSQL database, sends verification and password-reset email through Mailgun, and produces the three-day logs described above.

Administrative actions are recorded in an audit log, as described under Server logs above: it notes who did what to whom and when, using email addresses, and is deleted after six months. There is no analytics or crash reporting in the app. If you would like your account removed, email me, or use the delete-account option in the app itself.

The websites

All Saints Sermon Transcripts

A static site with no accounts, no cookies and no analytics. When you search, the words you type are sent to the server so that matching passages can be found and returned; they are not stored, and they are not associated with you. The site is hosted by Vercel, and produces the three-day server logs described above.

Fractal Beauty

Entirely static, and the rendering happens in your own browser. There are no accounts, cookies or analytics. It is hosted on GitHub Pages, so GitHub's servers see the request and keep their own logs.

German Metrical Psalter

This site generates German metrical settings of the Psalms using large language models, so some information does go to other companies.

Model providers. The psalm text and the prompt are sent to whichever provider you select — Anthropic, OpenAI, Google, xAI, DeepSeek, or a model reached through OpenRouter — and the result comes back from them. If you edit the prompt yourself, what you type is sent too, so please do not put personal information in it. Each provider handles that text under its own terms.
Trigger.dev runs the generation job, since it takes longer than a web request allows.
Upstash Redis holds the job while it runs — the text produced so far and its status — and discards it automatically after one hour.
Better Stack. Beyond the ordinary logs described above, each generation is recorded with your IP address and the city and country your request appears to come from, alongside which psalm and model were chosen. This exists so I can see how much the site is being used and spot abuse, since the model providers charge me for every request. It is deleted after three days like everything else.

There are no accounts and no cookies. Your display preferences are saved in your browser's own local storage, on your device, and you can clear them from within the site or through your browser settings.

Reformation Directory

Still under development. As it stands it is a static library of Reformation texts with no accounts, no cookies and no analytics; searching happens in your own browser.

Christian Directory (preview)

Also under development, and the one website here that has accounts and measurement.

Business accounts. If you list a business, the account holds your email address and a bcrypt hash of your password, together with the listing details you supply — business name, address, phone number, contact email and location. Listings are meant to be published, so treat what you enter as public. Verification and notification email is sent through Resend.
Sign-in cookies. Logging in sets HTTP-only cookies that keep you signed in for up to seven days. They are strictly necessary for the account to work and are not used for tracking.
Failed sign-in attempts are recorded against the email address and IP address that made them, so that repeated guessing can be locked out. These records are kept only for that purpose.
No analytics. The site carries Vercel's analytics component, but the feature is not switched on for this project, so nothing is collected or reported. If that ever changes, it will be described here first. Vercel's measurement is in any case cookieless and aggregate, and does not follow visitors between sites.
Maps are drawn with tiles from OpenStreetMap. Loading a map means your browser requests those tiles directly from OpenStreetMap, who therefore see your IP address.

Elswick Parish Church

I built this site, but the church runs it and it has its own privacy policy, which is the one that applies to it. See elswickchurch.org/privacy.

If you email me

If you write to me — about an app, a bug, a suggestion, or anything else — I keep your message, and whatever you chose to put in it, for as long as it is useful in dealing with what you wrote about. I use it to reply to you and for nothing else. You are not added to any mailing list, because I do not operate one, and I never send marketing email.

Children

None of these apps or websites is aimed at children, and I do not knowingly collect information from a child. The only product that collects anything personal at all is the All Saints app, which is for members of a particular congregation and requires approval by an administrator. If you believe a child has given me information, please email me and I will delete it.

Your rights

Under UK data protection law you may ask what personal information I hold about you, ask for it to be corrected, ask for it to be deleted, ask me to restrict or stop processing it, or ask for a copy of it in a portable form. In practice, unless you hold an All Saints or DPC account, a Christian Directory listing, or have written to me, the only thing I hold about you is a server log entry that will delete itself within three days.

To make a request, or to raise a concern, email hello@lewisdeveloping.co.uk. I will respond within one month. If you are unhappy with my response you are entitled to complain to the Information Commissioner's Office.

Google API Services

Where any of my apps receives information from Google APIs, its use and transfer of that information adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Changes to this policy

If one of these apps or websites starts collecting something new, this page changes with it, and the date at the top is updated. Since the store listings for my apps point here, this page is always the current statement for them.

Further information

Contact

If you have any questions about this policy, please email me at hello@lewisdeveloping.co.uk.