§Privacy policy

Privacy policy

Last reviewed: 19 August 2026. Costely has no accounts, no newsletter, no advertising and no analytics. This page describes the little that is processed anyway, because a web server cannot work otherwise.

Who is responsible

[Controller: legal entity name, postal address, country. If the operator is established in the EU or offers the site to people in the EU, this is the controller under Article 4(7) GDPR. Add a representative under Article 27 if the operator is outside the EU, and a data protection officer if one is required.] Contact: [privacy e-mail address].

What is processed

• Server log entries. The hosting provider records the request: IP address, time, page requested, referrer, browser string. This is standard for any web server and is used to keep the site running and to spot abuse. [Retention: state the provider’s log retention, commonly 7 to 30 days.]
• A vote guard. When you press a vote button we store a short-lived server-side value keyed by a hash of your IP address and the page, so that one reader cannot flood one comparison. The vote itself is an anonymous counter with nothing attached to it. The guard expires by itself and is never used to recognise you elsewhere.
• One browser preference. Dismissing the cookie notice stores the value cst_ck_v1 in your browser for a year so the notice does not reappear. It holds no identifier and is never transmitted to us for any other purpose. Details on the cookie policy page.
• What you send us. If you write to us, we keep your message and address for as long as it takes to answer it and to keep a record of corrections.

We collect no names, no accounts, no location beyond what an IP address implies, no profiles, and we build no advertising audiences. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Legal bases, for readers in the EU, EEA and United Kingdom

• Server logs and the vote guard: our legitimate interest in a working, un-abused service, Article 6(1)(f) GDPR.
• The cookie notice preference: stored only after you act on the notice, and strictly necessary to remember that action.
• Correspondence: our legitimate interest in answering you, Article 6(1)(f).

Who else can see it

• The hosting provider, as our processor, operates the servers and their logs. [Name the provider and the country where the servers sit.]
• Google Fonts. Typefaces are requested from Google’s servers, so your browser contacts Google and Google sees your IP address; no cookie is set by that request. This is a transfer to the United States. If you would rather that request never happened, tell us — the fonts can be served from our own domain instead, and we regard that as the better arrangement.

Nothing else leaves the site. There is no analytics service, no tag manager, no advertising network, no social media pixel and no embedded video.

International transfers

Apart from the font request described above, data stays with the hosting provider. [If the provider processes outside the EEA, name the safeguard: standard contractual clauses, an adequacy decision, or the EU–U.S. Data Privacy Framework.]

Your rights in the EU, EEA and United Kingdom

You may ask for access to your data, rectification, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Because we hold no identifiers, in most cases there is nothing to look up: an IP address in a log is not linked to a name, and we cannot identify you from it. You may also lodge a complaint with your supervisory authority. [Name the competent authority for the operator’s country.]

Readers in the United States

For California residents under the CCPA as amended by the CPRA, and for residents of other states with comparable laws: in the past twelve months we have not sold personal information and have not shared it for cross-context behavioural advertising, and we do not do so now. We process no sensitive personal information. The categories we handle are limited to internet activity and device identifiers in server logs, retained for security. Because we run no sale or sharing, there is no opt-out to offer; requests to know or delete may still be sent to the address above and we will answer them.

Children

The site is a reference work for adults. We do not knowingly collect data from children and there is nothing here to sign up for.

Automated decisions

There are none. Nothing on the site profiles you or makes decisions about you.

Changes

If this policy changes, the review date at the top changes with it. Material changes will be noted on the page itself.