Last updated 10 October 2026

Privacy and cookies

EditXP only uses one essential cookie, to keep you logged in. We don’t use tracking or advertising, and we never sell your data.

Who is responsible

EditXP is run from the UK by its owner, who is the data controller. Contact us through the contact form.

What we store on your device

Name	What it does	How long
`better-auth.session_token` Cookie	Keeps you logged in as you move between pages. Only set when you log in.	30 days, or until you log out
`editxp:notice` Local storage	Remembers that you’ve seen the cookie notice.	Until you clear it

Both are strictly necessary for things you ask for, so under the UK Privacy and Electronic Communications Regulations they don’t need your consent. On the live site the cookie’s name starts with __Secure-. When you sign up, log in or post, Cloudflare Turnstile may check that you’re a person rather than a bot. Our visitor statistics use Cloudflare Web Analytics, which doesn’t use cookies.

What we collect and why

Account detailsEmail, display name and password (stored hashed), so you can log in. Kept until you delete your account.Contract

Your edits, ratings and commentsSo they can be shown, rated and scored. Kept until you delete them or your account.Contract

Sign-up and login recordsIP address, network port, browser and time of each sign-up and login. Used for security and because UK law requires this information in reports of child abuse material. Kept for 6 months.Legal duty and legitimate interest

Reports and moderationReports you make or that are made about your content, a copy of the content at the time, our decisions, strikes and appeals. Kept for 2 years after the case closes so we can handle appeals and complaints and show regulators how we moderate.Legal duty and legitimate interest

Evidence of serious illegal contentIf we report child abuse material to the National Crime Agency, the law requires us to keep the content and related data for 1 year and the report reference for 5 years. This overrides deletion requests.Legal duty

Messages and requestsWhat you send through the contact form and our replies. Kept for 2 years after the request is closed.Legal duty and legitimate interest

Admin recordsA log of every action the admin takes, so decisions can be checked later. Kept for 2 years.Legitimate interest

Who else handles your data

Only companies that help us run EditXP, under contracts that stop them using it for anything else:

Cloudflare: hosting, our database, video streaming, file storage, bot checks and visitor statistics.
Resend: sending account and notification emails.
OpenAI: if switched on, an automatic safety check of comment text. It doesn’t receive your name or email.

Some of these companies may process data outside the UK. Where they do, they use approved safeguards such as the UK’s International Data Transfer Addendum. We may share information with the police or the National Crime Agency where the law requires it.

Your rights

Under UK GDPR you can ask to see, correct, download or delete your data, or object to how we use it. Use the contact form. We reply within one month. If you’re unhappy with how we handle your data, you can complain to us, and you can also complain to the Information Commissioner’s Office at ico.org.uk.