Privacy Policy
This service ("Tkinter Designer") is operated by Jason Stephenson. This page explains what we collect, why, and what you can do about it. It's written to be read, not to be impressive.
The short version: we collect your email address so you can sign in, we store the designs you save, and we use Google Analytics to count how many people visit which pages. There is no advertising, no tracking pixels, and nothing is sold or shared with anyone for marketing.
What we collect
| Data | Why | Kept for |
|---|---|---|
| Email address | The only way to sign in — we send a magic link instead of using passwords. | Until you delete your account |
| Saved designs (name and layout) | So your work is there when you come back. | Until you delete them or your account |
| Activity records (that you downloaded code or exported a file, and when) | To see whether the tool is actually being used. Counts only — never the contents. | Until you delete your account |
| A random visitor number stored in your browser | So we can tell one person downloading ten times from ten people downloading once. It is a random number with nothing in it: not your name, not your address, not anything measured about your device. If you sign in it is not used to identify you. | One year, or until you clear cookies |
| Sign-in and session tokens | To keep you signed in. Only a SHA-256 hash is stored, never the token itself. | Sign-in links 15 minutes; sessions 60 days |
| Analytics: pages you visit, roughly where you are (country or city level), and your device and browser | To see which pages are worth keeping. Collected by Google Analytics and held by Google, not by us. It is not tied to your account or your designs. | Google's retention setting — 2 months by default, up to 14 |
| A hash of your IP address and email at sign-in | To stop one person mail-bombing an address or hammering the sign-in form. The address itself is never written down — only an irreversible hash of it. | At most 24 hours |
We do not ask for your name, and we have no reason to want your real one. We don't collect payment details because the service is free.
Cookies
Two cookies of ours. tkd_session keeps you signed in and expires after 60 days. tkd_vid holds the random visitor number described above and expires after a year;
it is what lets us count people instead of clicks. Both are HttpOnly (JavaScript can't read
them) and SameSite=Lax, neither is shared with anyone, and clearing them costs you nothing but
a fresh sign-in.
Google Analytics sets two more, _ga and _ga_G-V4SC9DW4QW, which last
about two years and let Google tell repeat visits from new ones. There are no advertising
cookies. If you'd rather not be counted, blocking cookies for this site or installing Google's opt-out add-on stops it, and nothing on the site breaks if you do.
The designer also keeps a working draft of your current layout in your browser's local storage so an accidental refresh doesn't lose it. That stays on your device and is never sent to us unless you save the design to your account.
Who else touches your data
Three companies, each handling data on our instructions:
- Cloudflare — hosting, the database your designs live in, and the anti-bot check on the sign-in form.
- Brevo — sends the sign-in email. They receive your email address and the link, and nothing else.
- Google — Google Analytics, which counts visits. Google receives the pages you look at, your device and browser, and your IP address, which it uses to work out a rough location and then discards. It never receives your email address or your designs.
That's the complete list. We don't sell personal data, we don't share it for advertising, and we don't hand it to anyone else except where the law actually requires it.
Designs you choose to share
Sharing is off by default. If you turn on a share link for a design, anyone holding that URL can view it without signing in — treat the link as public. The page deliberately doesn't reveal who created the design. You can revoke a link at any time from the designer, which breaks it permanently.
Your rights
If you're in the UK, EU, or somewhere with comparable law, you have the right to access your data, correct it, delete it, take it elsewhere, and object to how it's used. Two of those you can exercise yourself, right now, without asking us:
- Get a copy — your account page has a one-click JSON export of everything we hold about you.
- Delete everything — the same page permanently erases your account, designs, and activity history. It's immediate and can't be undone.
For anything else, send us a message. You also have the right to complain to the data protection authority in England & Wales.
Security
Sign-in links and session tokens are stored only as SHA-256 hashes, so a copy of the database wouldn't let anyone sign in as you. Sign-in links are single-use and expire after 15 minutes. Everything is served over HTTPS. No system is perfectly secure, but we don't store passwords — there are none — and we keep as little as the service can function on.
Children
The tool is aimed at students learning Python, so some users will be young. We don't knowingly collect data from children under 13 (or under 16 where local law sets that bar) without parental consent. If you believe a child has signed up without it, tell us and we'll delete the account.
Changes
If this policy changes in a way that matters, we'll update the date at the top and, for significant changes, say so in the app. Continuing to use the service after a change means you accept the updated policy.
Contact
Questions, requests, or complaints: use the contact form. It reaches the controller directly, and we'll reply to the address you give.
See also our Terms of Service.
Open the designer →