{ "schemaVersion": 1, "lastReviewed": "2026-10-14", "product": "DunDunSee", "origin": "https://dundunsee.com", "scope": "Application-declared storage keys and intentional app/network integrations. Not an exhaustive report of browser/hosting/CDN infrastructure.", "dataProcessing": { "inMemory": { "location": "Browser tab (React application memory)", "contents": "Current redundancy inputs, calculation results and on-screen state while the app is in use", "retention": "Not independently persisted by this mechanism; normally disappears when the page is closed or reloaded", "networkTransmission": "No application API posts this working state" }, "sessionStorage": { "description": "Five named keys for navigation/tutorial progress", "retention": "Per-tab browser sessions (including reloads or restoration), until the all-keys Info reset for the current tab." }, "localStorage": { "description": "One optional persistent check-in record", "retention": "Across visits, until the all-keys Info reset or browser site data clearance." }, "cookies": { "applicationCode": "DunDunSee application code does not write cookies", "limits": "Not a claim about any cookies or headers originating from browsers, hosts or third-party services." } }, "storage": [ { "key": "dundunsee-brand-reveal-seen", "location": "sessionStorage", "contents": "Whether the opening brand animation was viewed", "purpose": "Avoid unnecessary repeated animation", "erase": "Info > Privacy > Clear saved information removes this key in the current tab, or end the browser session / clear site data." }, { "key": "dundunsee-returning-checkin-user", "location": "sessionStorage", "contents": "Returning check-in flow flag", "purpose": "Choose returning navigation", "erase": "Info > Privacy > Clear saved information removes this key in the current tab, or end the browser session / clear site data." }, { "key": "dundunsee-intro-tutorial-offer-seen", "location": "sessionStorage", "contents": "Tutorial offer shown flag", "purpose": "Avoid repeated tutorial invitations", "erase": "Info > Privacy > Clear saved information removes this key in the current tab, or end the browser session / clear site data." }, { "key": "dundunsee-tutorial-viewed-this-session", "location": "sessionStorage", "contents": "Tutorial viewed flag", "purpose": "Guide tutorial display in the current tab", "erase": "Info > Privacy > Clear saved information removes this key in the current tab, or end the browser session / clear site data." }, { "key": "dundunsee-user-session-v1", "location": "sessionStorage", "contents": "Flags: tutorial seen, brand reveal seen, first check-in completion", "purpose": "Maintain interface flow through reloads", "erase": "Info > Privacy > Clear saved information removes this key in the current tab, or end the browser session / clear site data." }, { "key": "dundunsee-checkin-memory-v1", "location": "localStorage", "contents": "Optional original/previous package summaries including financial inputs and calculated results, cadence, returning/unlock flags and a dated categorised notes array; pre-existing personal hope text migrates into that array", "purpose": "Restore returning check-in experience", "erase": "Info > Privacy > Clear saved information removes this persistent record, or clear browser site data." } ], "outsideStorage": [ { "location": "Link URL query string and browser history when a company scheme link is opened or shared", "fields": [ "ddsScheme", "ddsWeeks", "ddsLabel" ], "meaning": "Scheme version, company weeks-per-year and optional company label only; not private salary, debt or personal calculations", "note": "The website host receives requested URLs as part of normal web delivery; Cloudflare Web Analytics documents that its beacon does not log query strings. Share recipients and browsers can see the link." }, { "location": "Clipboard, operating-system share sheet or downloaded file", "trigger": "Only when the visitor intentionally copies, shares or downloads a generated output", "note": "The selected content then becomes subject to the visitor's chosen browser, operating system and destination app." } ], "network": [ { "provider": "Vercel", "destination": "https://dundunsee.com", "purpose": "Serve website HTML, CSS, JS, fonts, images and guide pages", "trigger": "Opening the website or retrieving assets", "note": "Normal hosting infrastructure may process request details and access logs. This document does not audit provider infrastructure logs." }, { "provider": "Cloudflare", "destination": "https://static.cloudflareinsights.com/beacon.min.js", "purpose": "Load Cloudflare Web Analytics client script", "trigger": "Opening a page where the beacon is embedded", "note": "A third-party script runs inside the page; technical access to origin data cannot be ruled out by a Content Security Policy." }, { "provider": "Cloudflare", "destination": "https://cloudflareinsights.com/cdn-cgi/rum", "purpose": "Receive site visit and page-performance metrics", "trigger": "Cloudflare analytics beacon on page load, navigation or leaving", "note": "Cloudflare documents collection of host/path/referrer, browser/device/OS, country and performance dimensions; it says it does not log query strings. No custom analytics events are configured. Standard browser requests also expose connection metadata to the receiving service, separately from the selected analytics metrics; this source inventory does not audit Cloudflare's connection logs." }, { "provider": "Monzo Business", "destination": "External Monzo Business payment page", "purpose": "Optional one-off support payment", "trigger": "Only when the visitor chooses an external payment link", "note": "Payment details are handled by Monzo, not stored in DunDunSee." }, { "provider": "External resource websites", "destination": "Links to GOV.UK, Acas, MoneyHelper, Cloudflare information", "purpose": "Optional reading of official or service documentation", "trigger": "Only when the visitor opens those links" } ], "safeguards": [ "Six declared storage keys only, with exact key-presence checks running on the user's device and no value display or upload.", "Current financial calculations and optional check-in values are not deliberately included in Cloudflare analytics events.", "No DunDunSee account or database and no custom behavioural analytics, session recording or advertising pixel.", "Content Security Policy allows only the listed Cloudflare beacon script path and its reporting host, not arbitrary third-party scripts and connections.", "Info > Privacy > Clear saved information removes and verifies all six DunDunSee-owned keys in the current tab, then restarts at the homepage to discard in-memory calculations; failure is reported if browser storage cannot be verified.", "Cloudflare's externally delivered JavaScript is a residual third-party risk; a narrowly scoped CSP does not isolate the script from the page." ], "limitations": [ "Whether a key is present is not proof that its data is valid, current or complete.", "Browser site-data tools reveal more than this app-only inspector, including other keys, caches and cookies if present.", "Browser privacy tools or content blockers may prevent Cloudflare's beacon from loading, so traffic counts may be incomplete.", "The audit is based on application source; it cannot guarantee that a browser, provider or script has not changed outside this code.", "Reset cannot remove session storage held separately by other open tabs, nor browser history, caches, downloads or copied links; other tabs can recreate shared local storage and fresh visits create new navigation flags." ], "references": [ "https://developers.cloudflare.com/web-analytics/data-metrics/data-origin-and-collection/", "https://developers.cloudflare.com/web-analytics/data-metrics/dimensions/", "https://developers.cloudflare.com/web-analytics/faq/" ] }