Privacy
Privacy notice
We collect as little as we possibly can.
✎ Draft privacy notice describing how the site is being built. Have it checked before launch, and add who runs the site and how to contact them.
This notice explains what information the Overheard at Oxford website handles and why. In short: you can submit anonymously, we don't ask who you are, and we don't track you around the web.
When you submit an overheard
We store what you type into the form:
- the overheard itself;
- where it was said (a college, a place in Oxford, or a place elsewhere);
- when it was said and any context, if you give them;
- the date and time you sent it.
We don't ask for your name, email address or any account. Please don't include anyone's name or identifying details in your submission. If you do, we'll remove them before anything is posted.
Submissions are stored securely with our database provider, Supabase, and can only be read by the person who runs this account.
When you pitch an article
Pitches work differently from overheards, because we need a way to reply. When you send a pitch we store your working title, the pitch itself, the byline you'd like (if any), and the email address or Instagram handle you give us. We only use these to discuss your pitch, and they're stored in the same secure database as submissions. If you'd like your pitch and details deleted, just ask.
Stopping spam
To keep bots out, our forms use Cloudflare Turnstile, which checks that you're a human. Cloudflare processes some technical information about your browser to do this, under its own privacy policy.
To stop any one person flooding us with submissions, we keep a scrambled (hashed) version of your IP address for up to 24 hours, then delete it. We can't turn it back into your actual IP address, and it's never linked to what you submitted.
Cookies and tracking
We don't use advertising or tracking cookies, and we don't use analytics that follow you across sites. Our fonts are served from our own website, not from Google.
The home page shows our latest Instagram posts. We fetch the images and serve them from our own website, so simply viewing the home page doesn't send your details to Instagram. Clicking a post takes you to Instagram, where Meta's privacy policy applies.
Hosting
The website is hosted by Netlify, which keeps short-term technical logs (such as IP addresses) to run and secure the service.
Your rights
Under UK data protection law you can ask what we hold about you and ask us to delete it. Because submissions are anonymous, we usually can't tell which one is yours, but if you can tell us what you submitted and roughly when, we'll find and delete it. Send us a direct message on Instagram.
Last updated: October 2026