§Privacy policy

Privacy policy

Last reviewed: 19 August 2026. Costely has no accounts, no newsletter, no advertising and no analytics. This page describes the little that is processed anyway, because a web server cannot work otherwise.

Who is responsible

Costely is run privately and decides what happens with the little data described below, which makes it the controller. Every request under this policy — access, correction, deletion, objection — goes to info@costely.com and is answered from there.

What is processed

• Server log entries. The hosting provider records the request: IP address, time, page requested, referrer, browser string. This is standard for any web server and is used to keep the site running and to spot abuse. These entries stay with the provider under its own retention period; we do not copy them anywhere, do not join them to anything else and do not use them to build a picture of a reader. Ask at info@costely.com and we will tell you which provider serves the site and how long it keeps its logs.
• A vote guard. When you press a vote button we count how many actions have come from your address in the last minute, so that one reader cannot flood one comparison. The counter is filed under a keyed hash (HMAC) of your address and the page, made with this site’s secret key, and it holds nothing but that number. It is deleted automatically after sixty seconds, it cannot be turned back into your address without the key, and it is never used to recognise you elsewhere. The vote itself is an anonymous counter with nothing attached to it.
• What you send us. If you write to us, we keep your message and address for as long as it takes to answer it and to keep a record of corrections.

Nothing is stored in your browser: no cookie, no local storage — see the cookie policy. We collect no names, no accounts, no location beyond what an IP address implies, no profiles, and we build no advertising audiences. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Legal bases, for readers in the EU, EEA and United Kingdom

• Server logs and the vote guard: our legitimate interest in a working, un-abused service, Article 6(1)(f) GDPR.
• Correspondence: our legitimate interest in answering you, Article 6(1)(f).

Who else can see it

• A commercial hosting provider, acting for us, operates the servers and their logs.
• Google Fonts. Typefaces are requested from Google’s servers, so your browser contacts Google and Google sees your IP address; no cookie is set by that request. This is a transfer to the United States. If you would rather that request never happened, tell us — the fonts can be served from our own domain instead, and we regard that as the better arrangement.

Nothing else leaves the site. There is no analytics service, no tag manager, no advertising network, no social media pixel and no embedded video.

International transfers

The font request described above reaches Google, a company in the United States, and is the one transfer this site causes. Everything else stays with the hosting provider and is passed to nobody.

Your rights in the EU, EEA and United Kingdom

You may ask for access to your data, rectification, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Because we hold no identifiers, in most cases there is nothing to look up: an IP address in a log is not linked to a name, and we cannot identify you from it. You may also lodge a complaint with the data protection authority of the country where you live or work, or where you think the problem happened.

Readers in the United States

For California residents under the CCPA as amended by the CPRA, and for residents of other states with comparable laws: in the past twelve months we have not sold personal information and have not shared it for cross-context behavioural advertising, and we do not do so now. We process no sensitive personal information. The categories we handle are limited to internet activity and device identifiers in server logs, retained for security. Because we run no sale or sharing, there is no opt-out to offer; requests to know or delete may still be sent to info@costely.com and we will answer them.

Children

The site is a reference work for adults. We do not knowingly collect data from children and there is nothing here to sign up for.

Automated decisions

There are none. Nothing on the site profiles you or makes decisions about you.

Changes

If this policy changes, the review date at the top changes with it. Material changes will be noted on the page itself.