chilidictionary Privacy and cookies
Last updated 27 October 2026.
In short: we keep as little as we can. No email address, no real name. We count requests by browser, operating system and country, without your IP address. We may advertise chilidictionary on other sites and apps, but we give them nothing about you. There are no ads, advertising cookies or tags on this site yet. If we add any, none of them will be used until you say yes. You can download your data or delete your account yourself, on your account page.
Who is responsible
chilidictionary.co.uk is run by Alben Isayev, an individual in the United Kingdom, who is the "controller" of your personal data under UK data protection law (UK GDPR and the Data Protection Act 2018). Contact us by email at [email protected], or through the contact form.
What we hold
| What | Why | How long |
|---|---|---|
| Your account: nickname, password and recovery code (each stored only as a one-way hash we cannot read), role, when you joined and when you accepted the terms. If you joined as a tester: that you used a tester code, when, and any note we made of who we gave it to. | To run your account. | Until you delete your account. |
| What you post and do: entries, topics you open, votes, favourites, follows, and reports you send. Entries, topics and the nickname on them are public, and search engines copy and list them. Your nickname also has a public page listing your entries, how many there are and the points they have earned; it asks search engines not to list it, but it is named as the author page of your entries. Only vote totals are public, not who voted. | To show your contributions and run the site. | Until you delete or undo them, or delete your account. Reports you send stay until the entry or your account goes. A topic you opened stays until a moderator removes it or you delete your account, and if other people have written in it, it stays without your name. Entries that are deleted (by you or a moderator), and topics a moderator deletes, are removed for good after 30 days. Copies search engines have made can stay for a while after that. |
| Visit records (sessions): your IP address, browser details and the address of the last thing your browser asked us for (usually data a page loaded, such as a search, rather than the page itself), including anything after a "?". They are stored with the session that keeps the site secure and, if you are signed in, keeps you signed in. | Security: preventing forged requests and abuse. The last address also lets us take you back to where you were after you send a form. | Until the session expires: 120 minutes after your last activity, or while "keep me signed in" is active. Expired ones are deleted within the hour. |
| Request records: for each page or API request that reaches us, the time, the address asked for (without anything after a "?"), the response and how long it took, the names of your browser and operating system (for example "Firefox" and "Android", not the full browser details), and the country Cloudflare says it came from. For a page, also whether its script ran: each page carries a random number that the script sends straight back, which tells a browser from a program that only copies the page. The number means nothing outside that one record. No IP address, and a record is not stored with your account, though the time of something you posted could be matched to your post. | To see how the site is used and keep it working: which pages are wanted, what goes wrong, and which browsers and countries to support. | 90 days. |
| Web server logs: for each page and data request that reaches our server, the time, the full address asked for (including anything after a "?"), the response, the page that linked to it or asked for it, and the full browser details. No IP address. | Finding and fixing faults, and spotting abuse. | Up to 15 days. |
| Error log: when something goes wrong in the site's software, the time, what went wrong and where in the code, and, if you were signed in, your account's number. The description of the error can include what was being looked up, such as a nickname or a topic's address. No IP address. | Finding and fixing faults. | 14 days. |
| Rate limits: short-lived counts of how many requests have come from your IP address, or from your account if you are signed in, kept against a scrambled form of the address or account rather than the address itself; and a count of failed attempts for a nickname, at logging in and at resetting a password with a recovery code. | Stopping the site being flooded or abused, and stopping password and code guessing. | 1 to 10 minutes (5 minutes for a nickname's failed attempts), then deleted within the hour. |
| Contact messages and emails: what you write, the link or entry it is about, your nickname if you are signed in, and a name and email address only if you choose to give them; and our notes on how we handled it. If you email us, or we reply to you by email, your email address and the emails, kept in our mailbox. | To answer you and act on reports, complaints and requests. | Until handled, then 12 months, emails included. Spam may be deleted as soon as we have checked it. If you delete your account, your messages are kept for that time without your nickname. |
| Moderation records: what moderators did and to what — for example deleting or restoring an entry, resetting a password or deleting an account — with the nicknames involved. | To handle complaints and appeals, and to keep moderation accountable. | 12 months. |
| Backups of the database, taken before updates and once a day, and daily copies of the whole server. The daily database backup is kept on our own computer at home in the United Kingdom; the others stay on or beside the server. Database backups leave out visit records and rate limits. | Recovering from mistakes or failures. | Up to 90 days for the database backups; up to 7 days for the daily copies of the server. |
To make an account you need a nickname, a password and to confirm you are 18 or over; without them we cannot give you one. Everything else is up to you, such as a name or email address on the contact form.
We do not ask for your real name, email address or date of birth. We do not sell or rent your data. We never give your account details, your contact messages or lists of people who use the site to anyone for advertising, and we never upload them to an advertising platform.
Why we are allowed to (lawful basis)
- To provide the service you signed up for (contract): your account, posts and activity.
- Legitimate interests: keeping the site secure and working, finding and fixing faults, stopping abuse and spam, moderating content, counting requests to see how the site is used, promoting chilidictionary on other sites and apps, and seeing how our ads there are doing.
- Legal obligations: for example, dealing with illegal content under the Online Safety Act 2023, and answering requests about your data.
- Recognised legitimate interests (crime, safeguarding and emergencies): telling the police about a crime, or about someone at risk or in danger, when that is needed (see who else handles it).
Who else handles it
- Everyone. Entries, topics and the nicknames on them are public, and search engines such as Google and Bing copy and list them. We tell search engines when a page changes or is deleted, but copies they or others have made can stay for a while.
- Cloudflare, Inc. delivers and protects the site. Every request passes through Cloudflare, which processes your IP address and request details to do so, and tells us which country a request came from. It also asks your browser to tell it, for up to 7 days, about connections to us that fail. Cloudflare does this for us under its data processing addendum, and is a controller in its own right for the security and network data it keeps for itself (see its privacy policy). It may process data outside the UK, including in the United States, where it is certified under the UK Extension to the EU–US Data Privacy Framework, which UK law treats as protecting personal data adequately. The standard contractual clauses, with the UK Addendum, in its data processing addendum apply if that ever stops. Cloudflare also forwards email sent to [email protected] to our mailbox.
- Google keeps that mailbox (Gmail): emails you send to [email protected], and our replies to you, whether to an email or to a contact message that gave an email address. Google may process them in the United States, where Google LLC is certified under the UK Extension to the EU–US Data Privacy Framework. See Google's privacy policy.
- OVHcloud (OVH Limited) rents us the server the site runs on, in a data centre in London, and keeps the daily copies of it in the same data centre. It handles them only for us, under its data processing terms. Staff of OVHcloud companies in the EU and Canada may reach the server for maintenance and security; UK law treats those places as protecting personal data adequately.
- If you press show image on an entry, your browser fetches the image from the website that hosts it. That website sees your IP address and browser details, and can set or read its own cookies, but is not told which page you were reading.
- The police, courts and regulators. We give them personal data when the law requires us to, such as a court order or a notice from Ofcom. We may also share it with the police when that is needed to prevent or detect crime, to protect someone at risk, or because someone's life is in danger. We give only what is needed, keep a record, and tell you unless the law or an investigation stops us.
If you are mentioned in an entry
Entries and topic titles are written by members, and can mention real people. If one mentions you, we hold whatever the member wrote about you, for as long as the entry or topic stays on the site; deleted ones go for good after 30 days. We publish members' entries because running a community dictionary, where people can share opinions, is our legitimate interest. You can object, or ask us to correct or remove something about you, through the contact form. We will look at it promptly, and remove anything that breaks the guidelines or the law.
Advertising
Our ads on other sites and apps
We advertise, or may advertise, chilidictionary on other websites and apps, for example on Google and Bing search, Facebook, Instagram, TikTok, X, Reddit, LinkedIn, Pinterest and Snapchat. We choose broad settings for our ads, such as the country, the age range, and the subjects or searches they appear next to. Each platform then decides which of its users see them, using what it knows about them, under its own privacy notice, and it knows if you click one.
Our ads only invite people to join; they never use entries, topics or nicknames from the site. We give the platforms nothing about you. From them we get totals, such as how many people saw or clicked an ad, sometimes split by age range, gender, area or device. If you comment on, like or share one of our ads, or follow or message us there, we can see whatever that platform shows us, such as your name or username and your public profile, as with any post.
For choosing who sees our ads, and for the totals about them, we and the platform are jointly responsible. The platform holds that data and answers requests about it under its own privacy notice; if you ask us, we will pass your request on. Comments and messages you send us there stay on the platform, under its rules. To stop seeing ads chosen using what a platform knows about you, use that platform's ad settings.
A link from one of our ads, or a link someone shares on a social network, may carry a code the platform adds after a "?"
(for example gclid or fbclid). Our request records leave it out. Our web server logs and backups keep the
full address, including the code, for the times shown in what we hold; your session record keeps it
only until your browser's next request to us, usually a moment later. We do not use the code to find out who you are, and we do
not pass it on.
Ads and advertising tags on this site
There are no ads on chilidictionary yet, and no advertising cookies, pixels or tags (small pieces of code from another company that tell it about your visit). We may add two things: ads from an advertising network, to help pay for the site; and the platforms' tags, which tell a platform whether our ads led to visits or sign-ups, and can let it show our ads again to people who visited. Before any of that is switched on, we will:
- update this notice to name each company, link to its own privacy notice, and say what it collects and why, which cookies it uses and how long they last, where it sends the data, and whether to ask us or the company about it;
- say whether ads are chosen using your visits to this and other sites, and how to turn that off, both here and with each company;
- ask you first, with a cookie banner where saying no is as easy as saying yes, and show no ads and use no advertising cookies, pixels or tags until you say yes. The banner may be run by another company, and keeps a small cookie to remember your choice; we will name both;
- add a cookie settings link to every page, so you can change your mind at any time;
- announce the change on the site before it starts.
Whatever you choose, you will still be able to read and use all of chilidictionary. If you are under 18, please say no when we ask.
Cookies and local storage
We use only what the site needs to work, what you choose, and conveniences you can switch off, so we do not ask for cookie consent. There are no advertising or analytics cookies. If we add advertising ones, we will ask you first (see advertising).
| Name | What it does | Lasts |
|---|---|---|
chilidictionary-session | Links your browser to its session (security, and your sign-in). | 120 minutes after your last activity |
XSRF-TOKEN | Protects forms against forged requests. | Same as the session |
remember_web_… | Keeps you signed in — only if you tick "keep me signed in". Signing in to the site team's admin area always sets it. | Up to 400 days, or until you log out |
chili_uncounted | Set only if you ask us not to count your visits (under request records), or by the site team on their own devices: leaves this browser's visits out of the request records. | 400 days, or until you turn it off |
__cf_bm and similar | Set by Cloudflare to tell people from bots. | Up to 30 minutes |
The site also keeps a few things in your browser's local storage, on your device only.
- Needed, or chosen by you: your nickname while you are signed in, drafts you are writing, your light or dark theme, people you have muted, anything you posted while the site could not be reached, and whether you have switched off the conveniences below. On the site team's own devices, also how they last grouped the request records. These stay until you change them or clear your browser data.
- Conveniences you can switch off: for members, while signed in, copies of the last 20 topics you opened (with any search inside them) for reading offline, each for up to 30 days; your 30 most recent actions; when you last checked your activity; and copies of your votes, favourites, follows and reports. Switch them off on your account page (settings, "on this device") and they are deleted from this browser and not kept again. They also go when you log out. Guests get none of them.
Your rights
You have the right to:
- get a copy of your data, and take it elsewhere (data portability) — use download my data on your account page (settings). It covers your account, posts and activity, as a JSON file other services can read. For anything else we hold about you, ask through the contact form;
- delete your account and everything you posted — use delete my account on your account page (topics other people have written in stay, without your name);
- correct data that is wrong, or restrict how we use it — ask through the contact form.
Your right to object. Where we rely on legitimate interests (see above), you can object at any time, for reasons to do with your own situation. Tell us through the contact form. We will stop, unless our reasons to carry on outweigh yours, such as stopping abuse, or we need the data for a legal claim.
We will answer requests within one month. If you are unhappy with how we handle your data, tell us through the contact form (choose "Data request, or a complaint about how we use your data") and leave an email address so we can reply, or email us at [email protected]. We will confirm we have your complaint within 30 days and tell you what we have done. You can also complain to the Information Commission (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.
Age
Accounts are for people aged 18 and over. We remove accounts we learn belong to anyone younger.
Changes
If we change this notice, we will update the date at the top, and say so on the site if the change is significant.