Privacy policy

We don't want your data.

No cookies, no analytics, no sign-up. This page explains the little we do handle, in plain English.

Last updated: 23 October 2026

The short version
  • No account, no sign-up, no newsletter.
  • No cookies, no analytics, no ads, no tracking pixels.
  • We don't collect your name, email, location or anything that identifies you.
  • Things you type into our tools stay on your own device.
  • Fonts and images come from our own server, so no other company sees your visit.
  • We never sell or share data.

Who we are

Start the Bag (startthebag.com) is run by Cris Morgado as a Morgado Frankel Foundation initiative, based in the United Kingdom. For data protection law, Cris Morgado is the "controller" responsible for this site. Contact: .

What we collect, and why

1. Basic server logs

Like almost every website, our web server automatically records technical details of each request: your IP address, the date and time, the page asked for, your browser type and the page you came from. We use these logs only to keep the site secure and working, for example to block attacks and fix errors.

  • Kept for: 14 days, then deleted automatically.
  • Who can see them: only us, and our hosting provider DigitalOcean, LLC, which runs the server for us under its data processing agreement.
  • Legal basis (UK/EU GDPR): legitimate interests in running a secure website.
  • We never use logs to identify, profile or track you.

2. Things saved on your own device

Some features remember your choices in your browser's local storage, so they're still there when you come back:

  • your country and currency choice
  • 30-Day Quest progress, journal notes and quest contract
  • budget, savings pots, milestones and calculator inputs
  • filters and flashcard order

This information stays on your device and is never sent to us. These aren't cookies. They only work for features you choose to use, so under UK and EU rules they don't need a consent banner. To delete them, use the reset buttons on each page or clear this site's data in your browser settings.

3. Emails you send us

If you email us, we use your email address and message only to reply. We delete emails within 12 months unless we need them to fix a problem you reported. If you are under 13, please ask a parent or guardian to email us for you.

What we don't do

  • No cookies of any kind.
  • No Google Analytics or any other analytics.
  • No advertising networks, affiliate tracking or social media pixels.
  • No embedded videos or social media widgets that track you. "Watch" buttons simply open YouTube or TikTok, where their own privacy policies apply.
  • No location tracking. We guess your country from your browser's language setting, on your device only, and you can change it.
  • No selling, renting or sharing of personal information. Ever.

Young people

Start the Bag is designed for teenagers aged 13 to 19, and we follow the principles of the UK Information Commissioner's Age Appropriate Design Code: high privacy by default, no profiling, no nudges to share data, and no location tracking.

In the US, we don't knowingly collect personal information from children under 13, in line with the Children's Online Privacy Protection Act (COPPA). If we learn that a child under 13 has emailed us, we'll delete it.

Links to other websites

We link to apps, official government sites and other resources. Once you leave startthebag.com, that site's own privacy policy applies. Check it before signing up for anything, and remember that many apps need you to be 18 or to use a parent's account.

Your rights

Because we hold almost no information about you, there's usually nothing to give back or delete. You still have rights under the law where you live, and we'll answer any request within one month.

  • UK and EU: you can ask to see, correct or delete your data, or object to how we use it. You can complain to the UK Information Commissioner's Office at ico.org.uk.
  • US: we do not sell or share personal information as defined by California and other state privacy laws.
  • Canada: you have rights under PIPEDA and can contact the Office of the Privacy Commissioner at priv.gc.ca.
  • Australia: you have rights under the Privacy Act 1988 and can contact the OAIC at oaic.gov.au.

Security

The whole site is served over an encrypted HTTPS connection. Server access is limited to us, and logs are deleted automatically.

Changes

If we change how we handle information, we'll update this page and the date at the top. If we ever wanted to start collecting personal data, we'd say so clearly on the site first.

Contact

Privacy questions or requests: