Effective date: 3 September 2026.
1. Who is responsible
This policy covers Ceylon Anilau, identified as Ceylon by Anilau during Google sign-in. The site operator is Anilau (Анилау). For privacy questions, corrections, complaints and account deletion, contact admin@anilau.com.
This policy does not automatically cover other Anilau websites or external services you visit through links.
2. Information we process and why
- Account information: username, email, login and email-verification information, and the linked Google identity. We use these for registration, authentication, account recovery, service notifications and associating your contributions with your account. Site passwords are stored as hashes, not plain text.
- Profiles and contributions: names, photos, phone numbers, profile email, contact details, descriptions and optional date of birth you provide; listings, prices, addresses/coordinates, images, articles, reviews and translations. These support profiles, publication, search, contact between users and moderation.
- Support requests: name, message, attachments, account association where available and the page from which a request was sent. These help us answer questions, investigate complaints and resolve problems.
- Technical information: IP address, browser/device characteristics, request times and parameters, errors, sessions and actions requiring review. These support operation and security. Cookies and statistics are described below.
- Additional features: if you use the API or receive TropiCoins for contributions, we maintain access-key, activity and reward records needed for those features.
You choose whether to register, connect a Google account, publish information or contact support. Information you provide is used for those actions and the functions described here. Reading this policy or accepting the terms of service does not consent to every processing activity or replace separate consent where required. Withholding information needed for a particular feature may prevent that feature from working.
3. Sign in with Google
When you choose Google sign-in, Google supplies an account identifier, email, email-verification information and basic profile information including your name; its response may also contain a profile-image URL. We request only openid, profile and email. We do not receive your Google password or request access to Gmail, Drive, Calendar or your contact list.
The site stores your Google ID, email and a site username derived from your Google name for sign-in. The username can be visible to other visitors and appear in your public profile address. Your Google photo is not automatically copied into your profile. Your login email is not automatically published as a contact address: public profile email is entered separately.
The Google identity is used to find an existing account or create a new one. A matching email can link sign-in to an existing account. The Google token is used to complete sign-in; the current sign-in mechanism does not store it as a permanent account field for later access to other Google services.
We do not sell Google user data, use it for targeted advertising or provide it to advertisers. Access is limited to sign-in, support, security and lawful requirements, including necessary technical providers described below.
You can remove the connection through your Google Account's connected-app settings. This does not delete your Ceylon Anilau account or data already stored here. For deletion, contact admin@anilau.com. Google's instructions.
4. Public information
Public profiles, published listings, articles, reviews and associated media are accessible to visitors, including people without an account. Phone numbers, email addresses and social contacts added to a public profile or listing may also be visible. Do not publish identity documents, bank details, other people's contacts without permission or information you do not want to disclose.
Search engines can index public pages and third parties can copy them. Removal from this site does not ensure immediate removal of external copies. Contributions awaiting moderation and support requests are accessible to authorised personnel; do not include unnecessary sensitive information.
5. Cookies, statistics and external connections
The site uses session cookies for sign-in and form protection. The current session lifetime is 120 minutes; session expiry does not mean all related server records are physically erased at the same moment. Choosing “remember me” may keep you signed in longer.
For view counts, the bali_visitor_id cookie contains a random browser identifier. It lasts up to 365 days and is renewed on subsequent counted views; repeat views of the same item are distinguished within a 24-hour window. Where set by a supported referral link, the source cookie records the source for 30 days; the source may be retained in your account when you register.
Google Analytics helps assess traffic and interaction with pages. Google receives browser-request information, such as the page URL and IP address, and may use cookies/identifiers. This is separate from Google sign-in and does not depend on choosing that login method. See how Google uses partner-site information.
In the current site version, analytics loads when a page opens. Dismissing the cookie notice saves a hide-notice preference in localStorage; it does not disable analytics or constitute a separate analytics-consent choice. The site sets no expiry for that preference. You can clear cookies and localStorage in your browser; blocking necessary cookies may prevent sign-in. Google also provides Analytics collection controls. These options do not replace the site's obligation to obtain consent where required.
Pages also load Google Fonts and jsDelivr resources for presentation and functionality; those providers receive network information needed to serve the requests. External websites and messaging services you open through links apply their own privacy rules.
6. Recipients and processing locations
The site uses hosting and file storage, service-email delivery, Google sign-in and Analytics, and external page resources. Site administrators and technical providers have access as needed for their task. Information may be disclosed to competent authorities where there is a lawful basis.
When automatic translation is used, selected text, including price comments, is sent to Microsoft Azure Translator. Contact details or other personal information included in the text can be part of the translation request. Avoid unnecessary personal information in text submitted for translation. The resulting translation is stored with the content on the site.
Information may be processed outside the country where you are located: Google, Microsoft and the other services named here do not operate only in Sri Lanka. We do not claim that all information is stored exclusively in Sri Lanka or in the user's country. For questions about a particular recipient, processing location or available safeguards, contact admin@anilau.com.
7. Retention and deletion
Different categories have different retention conditions; there is no single automatic deletion period for all information.
- Account information, the Google connection, profile and feature history are retained to support use of the account. Simply not signing in does not trigger automatic account deletion. You can request removal or correction through the contact email.
- Publications, reviews, media and related records are retained to display and manage content until removed using available user controls or by an administrator. Cleaning up old listings does not delete an entire account.
- Support requests and technical records are used to handle questions, diagnose problems and protect the site. The application log is configured for daily rotation retaining 14 dated files; this is not the retention period for all server logs, emails or backups.
- Backups and external-provider records are handled separately from the main database. For a deletion request, we determine the affected systems, removal process and timing, or grounds for retaining particular information. We do not promise immediate erasure of every copy.
- Retention of Google Analytics statistics depends on that service's settings. Browser-cookie lifetimes should not be treated as the retention period for all Analytics information; you can request further details from us.
Listing expiry or hiding content does not necessarily remove the original record and files. Following a deletion request, limited information may remain where necessary to meet legal requirements or resolve a justified dispute; the scope and duration of an exception are limited to that purpose. Active data and backup copies may be removed on different schedules.
8. Your requests and security
Contact admin@anilau.com to request access, correction, deletion of your account or content, withdrawal of consent, restriction or objection to processing, and other rights available under applicable law. We may request proportionate evidence that an account is yours; do not send passwords, login codes or identity documents without an agreed need. We respond within the applicable legal timeframe and explain any limitations. You may contact the competent data-protection authority.
We use HTTPS, access controls and password hashing. These reduce risk but cannot guarantee absolute security. Report suspected exposure or account compromise through the contact address.
The service is intended for adults. Do not create an account for a child or publish their personal data. Tell us if such information has been posted so we can review it and take necessary action.
9. Policy changes
The current version and its effective date appear on this page. We communicate material changes through an available channel and obtain consent before a new use of information where that consent is required.