Privacy Policy

Effective date: 3 September 2026.

1. Who is responsible

This policy covers Ceylon Anilau, identified as Ceylon by Anilau during Google sign-in. The site operator is Anilau (Анилау). For privacy questions, corrections, complaints and account deletion, contact admin@anilau.com.

This policy does not automatically cover other Anilau websites or external services you visit through links.

2. Information we process and why

• Account information: username, email, login and email-verification information, and the linked Google identity. We use these for registration, authentication, account recovery, service notifications and associating your contributions with your account. Site passwords are stored as hashes, not plain text.
• Profiles and contributions: names, photos, phone numbers, profile email, contact details, descriptions and optional date of birth you provide; listings, prices, addresses/coordinates, images, articles, reviews and translations. These support profiles, publication, search, contact between users and moderation.
• Support requests: name, message, attachments, account association where available and the page from which a request was sent. These help us answer questions, investigate complaints and resolve problems.
• Technical information: IP address, browser/device characteristics, request times and parameters, errors, sessions and actions requiring review. These support operation and security. Cookies and statistics are described below.
• Additional features: if you use the API or receive TropiCoins for contributions, we maintain access-key, activity and reward records needed for those features.

You choose whether to register, connect a Google account, publish information or contact support. Information you provide is used for those actions and the functions described here. Reading this policy or accepting the terms of service does not consent to every processing activity or replace separate consent where required. Withholding information needed for a particular feature may prevent that feature from working.

3. Sign in with Google

When you choose Google sign-in, Google supplies an account identifier, email, email-verification information and basic profile information including your name; its response may also contain a profile-image URL. We request only openid, profile and email. We do not receive your Google password or request access to Gmail, Drive, Calendar or your contact list.

The site stores your Google ID, email and a site username derived from your Google name for sign-in. The username can be visible to other visitors and appear in your public profile address. Your Google photo is not automatically copied into your profile. Your login email is not automatically published as a contact address: public profile email is entered separately.

The Google identity is used to find an existing account or create a new one. A matching email can link sign-in to an existing account. The Google token is used to complete sign-in; the current sign-in mechanism does not store it as a permanent account field for later access to other Google services.

We do not sell Google user data, use it for targeted advertising or provide it to advertisers. Access is limited to sign-in, support, security and lawful requirements, including necessary technical providers described below.

You can remove the connection through your Google Account's connected-app settings. This does not delete your Ceylon Anilau account or data already stored here. For deletion, contact admin@anilau.com. Google's instructions.

4. Public information

Public profiles, published listings, articles, reviews and associated media are accessible to visitors, including people without an account. Phone numbers, email addresses and social contacts added to a public profile or listing may also be visible. Do not publish identity documents, bank details, other people's contacts without permission or information you do not want to disclose.

Search engines can index public pages and third parties can copy them. Removal from this site does not ensure immediate removal of external copies. Contributions awaiting moderation and support requests are accessible to authorised personnel; do not include unnecessary sensitive information.

5. Cookies, statistics and external connections

The site uses session cookies for sign-in and form protection. The current session lifetime is 120 minutes; session expiry does not mean all related server records are physically erased at the same moment. Choosing “remember me” may keep you signed in longer.

For view counts, the bali_visitor_id cookie contains a random browser identifier. It lasts up to 365 days and is renewed on subsequent counted views; repeat views of the same item are distinguished within a 24-hour window. Where set by a supported referral link, the source cookie records the source for 30 days; the source may be retained in your account when you register.

Optional analytics. Google Analytics 4 and Yandex Metrica load only after you explicitly allow analytics in the cookie notice. Before consent, or after refusal, the site does not load these counters or queue your actions for later transmission. Refusal does not prevent registration, sign-in or publication. Google sign-in is a separate choice; closing an older cookie notice is not analytics consent.

We use statistics to understand visits, return visits, traffic sources, interface languages, broad geography, devices and interest in sections, and to measure registrations, submitted listings and articles, comments, ratings, searches, advertising views and clicks, and clicks on contact links. A contact click shows an intention to contact someone, not a confirmed conversation or transaction. Advertisers receive aggregate reports, not individual activity histories or account/contact details.

The site sends limited event labels and parameters, such as language, page/content type, category, contact channel and advertising placement. Page addresses are reduced to a safe page type and, where relevant, a public listing/article identifier; query strings and the original full address are excluded. Referrals are limited to the referring site's origin. We do not send names, usernames, email addresses, phone numbers, message/content text, search phrases, account identifiers or authentication/reset secrets as analytics parameters.

The providers receive technical connection information, such as IP address and browser/device information, and may use cookies and browser identifiers. These are not a guarantee of complete anonymity. Google Signals, advertising personalisation and User-ID are not enabled for this analytics setup. Yandex Metrica session recording is off. The analytics choice does not grant consent for advertising cookies.

Remembering your choice. Consent has no expiry imposed by the site and remains valid until withdrawn or a new consent choice is required. We store a versioned choice and its date in anilau_analytics_consent and localStorage. The consent cookie lasts up to 400 days and is renewed on visits; the localStorage copy has no site-imposed expiry. A refusal lasts 10 days from the choice, without extension on repeat visits; the notice can then appear again. Clearing site data, private browsing or browser restrictions may remove either choice. If persistent storage is unavailable, the choice can last only for the current page.

Withdrawing analytics consent. Use your browser's site-data settings to remove this site's cookies and local storage, then reload the page and choose “Without analytics” in the notice. Removing only cookies may restore a choice from localStorage. Clearing site data can sign you out and reset other preferences. This stops new analytics collection under that choice; it does not automatically erase information already received by the providers. For deletion questions, use the contact address in this policy.

Session, form-protection, remembered-login and language-preference data, the internal view-count identifier and referral-source cookie described above operate separately from optional external analytics. Refusing analytics does not automatically remove them or switch the site into a “necessary cookies only” mode. Browser-cookie lifetimes are separate from retention of server and analytics records; Google Analytics and Yandex Metrica retain information according to their service settings. See Google's partner-site information and the Yandex privacy policy. These services can process information outside your country.

Pages also load Google Fonts and jsDelivr resources for presentation and functionality; those providers receive network information needed to serve the requests. External websites and messaging services you open through links apply their own privacy rules.

6. Recipients and processing locations

The site uses hosting and file storage, service-email delivery, Google sign-in, Google Analytics and Yandex Metrica, and external page resources. Site administrators and technical providers have access as needed for their task. Information may be disclosed to competent authorities where there is a lawful basis.

When automatic translation is used, selected text, including price comments, is sent to Microsoft Azure Translator. Contact details or other personal information included in the text can be part of the translation request. Avoid unnecessary personal information in text submitted for translation. The resulting translation is stored with the content on the site.

Information may be processed outside the country where you are located: Google, Microsoft and the other services named here operate in multiple countries. We do not claim that all information is stored exclusively in your country. For questions about a particular recipient, processing location or available safeguards, contact admin@anilau.com.

7. Retention and deletion

Different categories have different retention conditions; there is no single automatic deletion period for all information.

• Account information, the Google connection, profile and feature history are retained to support use of the account. Simply not signing in does not trigger automatic account deletion. You can request removal or correction through the contact email.
• Publications, reviews, media and related records are retained to display and manage content until removed using available user controls or by an administrator. Cleaning up old listings does not delete an entire account.
• Support requests and technical records are used to handle questions, diagnose problems and protect the site. The application log is configured for daily rotation retaining 14 dated files; this is not the retention period for all server logs, emails or backups.
• Backups and external-provider records are handled separately from the main database. For a deletion request, we determine the affected systems, removal process and timing, or grounds for retaining particular information. We do not promise immediate erasure of every copy.
• Retention of Google Analytics and Yandex Metrica statistics depends on each service’s settings. Browser-cookie lifetimes are not the retention period for all analytics information; you can request further details from us.

Listing expiry or hiding content does not necessarily remove the original record and files. Following a deletion request, limited information may remain where necessary to meet legal requirements or resolve a justified dispute; the scope and duration of an exception are limited to that purpose. Active data and backup copies may be removed on different schedules.

8. Your requests and security

Contact admin@anilau.com to request access, correction, deletion of your account or content, withdrawal of consent, restriction or objection to processing, and other rights available under applicable law. We may request proportionate evidence that an account is yours; do not send passwords, login codes or identity documents without an agreed need. We respond within the applicable legal timeframe and explain any limitations. You may contact the competent data-protection authority.

We use HTTPS, access controls and password hashing. These reduce risk but cannot guarantee absolute security. Report suspected exposure or account compromise through the contact address.

The service is intended for adults. Do not create an account for a child or publish their personal data. Tell us if such information has been posted so we can review it and take necessary action.

9. Policy changes

The current version and its effective date appear on this page. We communicate material changes through an available channel and obtain consent before a new use of information where that consent is required.