How oPortfolio handles your data

The short version

• Your diary is visible only to you inside the service. No programme, supervisor or employer is given access.
• I need your email address to sign you in. Everything else you write or upload is optional and yours.
• I do not sell data, run advertising, use analytics trackers, or feed your writing to any AI or third party.
• You can download everything at any time and delete it whenever you want.
• Your entries, links and files are encrypted in your browser with a key derived from a passphrase only you know. The servers store ciphertext; I cannot read your diary even with full access to them.

What I collect

• Account: your email address, a display name (taken from your email unless you change it), when you last signed in, and whether the account is active.
• Profile (optional): preferred name, professional group, specialty or role, organisation, and reading preferences such as your chosen font.
• Diary content (encrypted): entry titles, the reflections you write, links you add, and files you upload (up to 25 MB each) are encrypted on your device before they are sent; the server stores only ciphertext. Earlier versions of an entry are kept, also encrypted, so edits never silently overwrite.
• Diary metadata (not encrypted): entry dates, the entry type you choose, curriculum objectives you map, file sizes and timestamps — needed for lists, counts and retention. They contain no content.
• Key material: your diary key wrapped under your passphrase and under your recovery key. Neither the passphrase nor the recovery key ever leaves your browser, so this material is useless without them.
• Archives: the ZIP file (PDF, JSON, attachments, manifest) created when you ask for a download.
• Security records: one-way hashes of sign-in links and sessions (never the links themselves), the time of each sign-in, and short-lived counters keyed by email address and network address to slow down abuse.
• Audit log: a tamper-evident record of actions taken on your account — who did what, when, to which item — that deliberately never includes the content itself.
• Notice confirmations: which version of this notice and the usage rules you confirmed, and when.

I do not collect passwords, device fingerprints, precise location, or third-party cookies. Reflections are your own words; they may reveal things about your health, beliefs or wellbeing, which the law treats as special category data. You decide whether to write them.

Why, and on what legal basis

• Providing the diary (storing, showing, exporting your entries; sending sign-in and service emails): necessary to perform the service you have asked for — UK GDPR Article 6(1)(b).
• Keeping the service secure (rate limits, audit log, malware scanning of uploads, error logs): my legitimate interest in protecting the service and the people who use it — Article 6(1)(f). This is low-intrusion and what you would expect.
• Sensitive content in your reflections: your explicit consent, given when you confirm this notice at sign-in — Article 9(2)(a). You can withdraw it at any time by deleting the content or your diary.

You must not put patient-identifiable information, clinical data, or unnecessary identifying details about colleagues or other people in your diary. There is no lawful basis for me to hold that data, and I treat its presence as an incident: I will ask you to remove it and record that it happened, without copying it.

Who can see your data — including me

Inside oPortfolio, only the author can open a diary. The code enforces this on every page, API call, file download and export; a request from anyone else is answered as if the item did not exist. There is no administrator screen that shows diary content, and every in-product action is written to the audit log.

End-to-end encryption. Your content is encrypted in your browser before it is sent, with a key that exists only on your device. What I operate — the database, file storage and backups — holds ciphertext and wrapped keys that cannot be opened without your passphrase or recovery key. So I cannot read your diary, and neither can anyone who obtains a copy of the servers' data. The flip side is that I cannot recover it for you either: if you lose both your passphrase and your recovery key, the diary is gone.

What encryption does not cover. Dates, entry types, objective mappings, file sizes and timestamps are stored in clear so lists and retention work; they contain no content. And because your browser decrypts using the code this website serves, you are trusting that code — it is open source, loaded only from this origin with a strict Content Security Policy, and never includes third-party scripts. Uploaded files cannot be virus-scanned by the service, so only attach files you trust.

I will disclose data to others only when the law requires it — for example a court order — and I will tell you first unless I am legally prevented from doing so.

Service providers

The service runs on infrastructure I rent from providers acting on my instructions under written contracts: web hosting, a database, file storage for uploads and archives, and an email delivery service for sign-in links. Emails never contain diary content.

The named providers and their locations will be listed here before the service accepts real users; the intention is UK or EU hosting throughout, with no transfers outside the UK or EEA.

How long I keep things

• Diary content and files: until you archive or delete them, or until 90 days after you finish your diary — then everything is permanently purged. You can reopen within those 90 days to cancel the deletion.
• Downloaded archives: the ZIP is deleted from storage 7 days after it is created; download links last 5 minutes.
• Sign-in links: 15 minutes. Sessions: 60 minutes idle, 12 hours at most. Spent records are removed after 7 and 30 days respectively.
• Abuse counters: 24 hours.
• Audit log and notice confirmations: kept for the life of the diary as an accountability record; they contain no content.
• Backups: kept only as long as needed to recover from failure, and deletions are re-applied if a backup is ever restored.

Your rights

You can, at any time and free of charge:

• Access and take away your data: use Download my diary in the service for a complete, portable copy (PDF and JSON).
• Correct anything: edit entries and profile details in the service.
• Delete everything: finish your diary in the service (purged after 90 days) or email me for immediate deletion.
• Restrict or object to processing, or withdraw consent for sensitive content — email me and I will act within one month.
• Complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. I would appreciate the chance to put things right first.

I make no automated decisions about you, and nothing in the service scores, ranks or assesses your reflections.

Cookies

One strictly necessary cookie keeps you signed in (deleted when you sign out or after 12 hours) and one remembers your font preference. There are no analytics, advertising or third-party cookies, so no cookie banner is needed.

Security

Sign-in uses single-use email links, so there is no password to steal; your diary passphrase is separate and never sent to the server. Sessions and links are stored only as one-way hashes. All traffic is encrypted in transit and diary content is encrypted end-to-end, and the code is open source and checked automatically for known vulnerabilities. If a breach ever affects your data I will tell you without undue delay and report it to the ICO where required. This service is not for anyone under 18.

Changes to this notice

This is version 2026-08-29. If I change it materially you will be asked to read and confirm the new version the next time you sign in, and the previous versions remain available on request.