Privacy Notice

Who is responsible

Beacon is the controller for personal information used to operate bcon.uk. Send privacy questions or rights requests to [email protected] or the @beacon administrator account.

Information we use

This includes account and profile details; posts, replies, media, reactions, follows, reports and moderation records; and limited session, device and security information. If you separately choose to share a wellbeing check-in, Beacon also stores that response and limited consent evidence. Beacon Alert administrators may hold private referrer, evidence and coordination details.

Why we use it

We use information to provide the service you request, show public conversations, protect accounts, moderate harmful activity, operate verified alerts and meet legal obligations. We rely on the service agreement, legitimate interests in a safe and secure community, and legal obligations—not bundled data-processing consent.

Who can see it

Your profile and public activity can be seen outside Beacon. Organisation Pages may also choose to publish a separate contact email, phone number, website and social links on their public profile. The email used to sign in is not published as Page contact information. Anything deliberately published on a Page may be copied or indexed outside Beacon. Direct communications have restricted visibility inside the service. Information may also be processed by infrastructure providers or disclosed where the law, safeguarding or an official investigation requires it. Beacon does not sell personal information.

Profiles are included in search-engine discovery by default. You can turn this off in profile settings. Using an Op-sec display name always turns search-engine discovery off and removes the profile from Beacon's sitemap; removing the Op-sec name does not turn discovery back on automatically. These controls tell search engines not to index the profile, but Beacon cannot immediately remove copies already cached or indexed by another service.

The optional “How are you?” check-in asks for your explicit consent before the first response is stored. The current response is visible as an emoji only to you and signed-in members who follow you. It is not included on signed-out profiles and is not shared with signed-in non-followers. Only current, consented responses contribute to the thresholded Community Health statistics described below.

You can stop sharing from the same profile control. This erases the current response and current consent immediately. Beacon retains a dated, response-free record that consent was granted or withdrawn for accountability; this does not reveal which wellbeing option you selected and is removed when your account is deleted.

Optional push notifications

Web Push is optional and is enabled only after you choose to turn on notifications and allow them in your browser or device settings. Notifications can arrive while Beacon is closed. Their title and message may be visible on a lock screen, wearable, shared computer or other device surface, depending on your settings, so consider whether previews are safe on that device.

Your browser or operating-system provider uses its external push service to route notifications to the device and may process delivery, network and device information under its own privacy terms. Notification content is encrypted in transit. Beacon stores the endpoint and cryptographic keys together as an encrypted subscription capability, plus a one-way endpoint fingerprint and limited device metadata such as the browser description, timestamps, optional expiry and delivery status.

Each subscription is tied to the signed-in browser session that enabled it. Turning notifications off removes the server subscription and asks the browser to unsubscribe. Signing out deletes that session and its server-side subscription; expired or revoked sessions are not eligible for delivery and are removed. You can also withdraw notification permission at any time in your browser or device settings.

Account recovery and email summaries

If you request a password reset, Beacon sends a short-lived, single-use recovery link to your private sign-in email. The account remains usable without an email-confirmation step, and Beacon does not send an email merely because an account was created.

By default, Beacon may send a concise summary after you have not actively used the service for at least two days and have unread activity. It contains an aggregated personal-activity count, a data-light summary of Beacon Alert changes, and a small selection of public community highlights, followed by one link back to Beacon. Names, locations, images and case details from Beacon Alerts are not included. Further summaries are sent no more than once a week while you remain inactive, and only when there is new unread activity or a new Beacon Alert change since the previous summary. They stop once you have been away for 30 days. Using Beacon or signing in restarts this schedule from your latest activity. You can turn these summaries off from profile settings.

If no current device has notifications enabled seven days after you join, Beacon may send one optional setup reminder with Android and iPhone instructions. Eligibility is checked again immediately before delivery, so the reminder is not sent after notifications are enabled, optional email is turned off or the account is deleted. Beacon records only the delivery state and the date that this one-time reminder was sent.

Beacon uses Postmark to deliver these messages. Postmark therefore processes the sender and recipient addresses, message content, delivery metadata and ordinary network information needed to route the email. Beacon does not put private communications, report notes, warning text, missing-person names, locations or images into summary emails, and does not use email tracking pixels. Limited delivery, retry and suppression records are retained to operate and protect the service.

Installed app status

When you open Beacon as an installed app, Beacon records the first and most recent confirmation times against your account. This helps us understand setup progress without storing a device fingerprint, browser description or network address for installation tracking. Web browsers do not reliably tell Beacon when an app is uninstalled.

First-party product statistics

Beacon uses limited, first-party statistics to understand daily use and improve reliability. Existing service records provide aggregate counts such as new accounts, posts, Scopes and Blueys. While a signed-in member has Beacon visible, a periodic same-origin signal lets Beacon count one visitor per day and estimate engaged time.

The activity signal records only a broad platform category: Android, iOS, web or other. It does not record which pages you view, searches, post content, IP addresses, browser versions, device models or device identifiers. The member-level daily row is erased after eight days and administrators see aggregate totals only. Anonymous daily totals are retained for trend reporting. Beacon does not load Google Analytics, use a third-party analytics provider or set analytics cookies.

Sponsored pictures and feed posts are labelled as ads. Beacon measures their impressions and clicks using its own aggregate daily counters. An impression is counted after an ad is at least half visible for one second; clicking also confirms a view. Short-lived, opaque receipt hashes prevent repeat counting and are removed after their two-hour validity period. These records do not contain your account, IP address, browser or device details. Turning product statistics off in profile settings also stops ad measurement. Advertisers receive no member-level measurement from Beacon; following an ad opens the sponsor’s website under its own privacy policy.

You can turn activity and engaged-time measurement off under Usage statistics in profile settings. Turning it off stops future signals and removes your recent member-level activity. It cannot remove you from historic anonymous totals because those totals can no longer be linked to an account.

Editorial drafting

When an administrator requests AI drafting, Beacon sends the editorial draft, its source citations and the administrator's instructions to OpenAI to prepare a new revision. Editors review the final copy, sources and image rights before approving publication. The feature uses OpenAI's external API.

Public Community Health statistics

Beacon publishes a Community Health page using coarse percentages about community connection, consented wellbeing responses and public posting activity. It never publishes member totals, profiles or individual responses. Percentages are rounded into a daily snapshot, and small groups are combined or withheld to reduce the risk that a person could be identified from the statistics.

People who have not explicitly consented and selected a current wellbeing response are excluded rather than counted as Okay. Organisation Pages are also excluded from wellbeing statistics. The posting chart shows each day's relative share of a seven-day period rather than a number of posts.

How long we keep it

Information is kept only while it is needed to provide Beacon, protect the community, handle reports or meet legal requirements. Resolved alerts remove identifying information from live surfaces; limited records and backups may take longer to expire securely. Beacon's retention and deletion schedule gives the period, deletion action and accountable owner for each main type of information.

Your choices and rights

You can edit profile information, control search-engine discovery and first-party usage measurement, and download a copy of your data from profile settings as portable JSON after confirming your current password. Profile settings also provide a deliberately low-key permanent account-deletion control. It requires your current password and the exact word DELETE. Deletion removes your profile and the content you created in Beacon's community spaces, cannot be undone and cannot be recovered.

A still-active Beacon Alert request may be retained as a de-identified safeguarding case rather than being silently abandoned; its requester account link and private contact details are removed. Limited safety, moderation, legal and backup records may also take longer to expire where retention remains necessary and proportionate. You may ask for access, correction, deletion, restriction or portability, or object to some uses. You can complain to the UK Information Commissioner's Office if a concern is not resolved.