Privacy & Cookies
Last updated: 30 October 2026 · See also the Terms of Use and the Community Rules.
This policy explains what personal data Coindetails.com collects, why, how long it is kept, who receives it and what your rights are under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). Where the EU GDPR applies to you, the same rights apply.
In short: Coindetails.com uses only what it needs to run the site and your account. There are no statistics, no advertising and no tracking on the site, and we do not sell personal data.
1. Who we are
Coindetails.com belongs to the same network of websites as dragos.xyz. Both websites are run by the same operator, who is the data controller for Coindetails.com.
Coindetails.com has its own member accounts, separate from dragos.xyz: an account on one website does not sign you in to the other, and member data is not shared between the two websites.
Controller: Dragos S, operator of the dragos.xyz network of websites (including Coindetails.com), United Kingdom.
Contact: , or the Privacy / GDPR request channel on the Contact page.
2. Data we process and why
| Feature | Data | Purpose | Legal basis |
|---|---|---|---|
| Account | First name, last name, nickname, email address, password (stored only as a secure hash), role (member or administrator), creation and update dates, your confirmation that you are 18 or over and accept the Terms. If the administrator makes your account, the email address is optional — an account without one gets an address on the reserved domain “no-email.invalid”, which can never receive mail. A temporary account also has its last day and who set it. | Create and manage your account, let you sign in | Contract (Art. 6(1)(b)) |
| Sign-in session | A session identifier and a security (CSRF) token | Keep you signed in; protect forms against forgery | Contract; legitimate interest in security (Art. 6(1)(f)) |
| Password reset | Email address, a one-time token (stored only as a hash) and its expiry time | Send and check the reset link | Contract |
| Sign-in protection | One-way hashes (SHA-256) of the IP address and of the account name used in a sign-in or password-reset attempt, with the time — never the IP address itself | Limit password guessing and reset-email flooding | Legitimate interest in security |
| Emails from us | Email address, nickname, first name, your email preferences (service notices on/off, newsletter on/off), the date and place of your newsletter opt-in or withdrawal, and a record of each mailing (see section 3) | Send service notices and, only if you opted in, the newsletter; honour unsubscribes; show consent | Service notices: legitimate interest in informing members. Newsletter: consent (Art. 6(1)(a)) and PECR regulation 22 |
| Inside Mailer | Private messages between you and the administrator inside the site: subject, text, date, who wrote each message, read/unread and deleted status | Let you and the administrator communicate privately | Contract |
| Contact form | Your name or nickname, email address, the topic you chose, your message, a link if you add one, your confirmation (for copyright claims), the date and a ticket number. A one-way hash of your IP address, with the times of your messages, is used for one hour to limit how many messages one connection can send (5 per hour). | Answer your message; deal with reports, appeals, copyright claims and privacy requests | Legitimate interest in answering you; legal obligation for privacy requests and illegal-content notices |
| Reports | The reason you chose, the details you write, the page or link you report and a copy of what was reported; your nickname if you are signed in (or “visitor”); a one-way hash of your IP address, used only to stop the same report being sent again and again. The administrator's decision and notes are kept with the report. The person you report is never told who reported them. | Deal with abuse, scams and illegal content; keep evidence | Legitimate interest in safety; legal obligation where the law requires us to act |
| Activity log (administrator only) | Events on the site — for example a new account, a contact message, a report, a password reset, a deletion, or what the administrator changed on your account — with the IP address, operating system, browser and device type your browser reports, and, when the administrator asks for it, the country of the IP address (section 5). The most recent 1,000 events are kept; older ones are deleted automatically. | Investigate abuse, spam and fake accounts; keep the site secure | Legitimate interest in security |
| Member posts (Metal Detecting, Gold, Silver & Platinum Coins, Banknotes) | What you publish: title, text, the details you fill in (for example period, metal, condition), your pictures, the date, and your nickname as the author. For a find, the location only if you choose to add one: a written area, an approximate map position (shown to visitors rounded to about 1 km) or an exact map position. Pictures are re-saved by the site, which removes hidden data such as the GPS position stored by phones. The administrator is told about each new post in the activity log. | Publish your post on the site; let the administrator moderate it | Contract (you ask us to publish it); legitimate interest in keeping the site safe and lawful |
| Terms acceptance | Your account number, the version of the Terms of Use you accepted, the date and time, how you accepted (registration or the updated-Terms page) and a one-way hash of your IP address — never the IP address itself | Show which Terms you agreed to, and ask you again when they change | Contract; legitimate interest in being able to prove what was agreed |
| Site search | The words you search for are used only to find results and are not stored. A one-way hash of your IP address with the times of your searches is kept for one minute to limit searches to 30 a minute. | Show search results; stop the search being overloaded | Legitimate interest in providing and protecting the service |
| Notifications | Notices shown in your account (type, text, date, read or not) | Tell you about things that concern your account | Contract |
| Server logs | IP address, date and time, the page requested, browser details — recorded by our hosting provider | Run, secure and fix the site | Legitimate interest in security |
We do not sell personal data, and we do not use it for automated decisions that have legal or similarly significant effects on you.
3. Emails from Coindetails.com & Inside Mailer
Emails are sent from admin@coindetails.com through our hosting provider's mail server, to the address of your account.
- Emails you ask for — for example a password reset. These are always sent; they are part of the service.
- Service notices — occasional messages to members about the site itself: changes to the rules or this policy, planned downtime, security matters or your account. They never contain advertising. They are on by default for members, and you can turn them off at any time.
- Newsletter — news and offers from Coindetails.com. Sent only if you opted in by ticking the box when you registered or in your account. Opting in is never required to use the site.
Unsubscribing: every service notice and newsletter has a one-click unsubscribe link and supports the unsubscribe button of Gmail, Outlook and Apple Mail. You can also change both settings in My account › Email preferences. Unsubscribing takes effect immediately.
We do not share your email address with advertisers or partners, do not buy or rent email lists, and do not use tracking pixels or tracked links.
Records: for each mailing we keep, for 12 months, the subject, text and date, and the list of members it was sent to (nickname, email address, whether it was sent, failed or skipped, and the time), so we can answer questions and show that unsubscribes were respected. Only the administrator can see it. After 12 months it is deleted automatically.
Inside Mailer
Inside Mailer (My account › Inside Mailer) carries private messages between you and the administrator. They stay on Coindetails.com and are not sent by email. Only you and the administrator can read your conversations. The administrator may send the same message to many members at once; each member still gets a private conversation of their own.
When you delete a conversation it disappears from your Inside Mailer. It is erased for good once the administrator has deleted it too, or when your account is closed. You can ask for it to be erased earlier through the Privacy / GDPR request channel. To prevent spam, a member can send a limited number of messages per hour.
4. Cookies & browser storage
Coindetails.com has no statistics, advertising or social-media cookies and no trackers. There are two groups:
- Essential — storage the site needs to work or to remember a setting you chose (table below). It is always on; under PECR it does not need consent.
- External content: Google Maps — some finds show a map. The map is loaded from Google only if you allow external content, or press SHOW MAP on that find. When it loads, Google receives your IP address and may set its own cookies under Google’s privacy policy. It is off until you choose.
On your first visit you can ACCEPT ALL, REFUSE (essential only) or open SETTINGS. You can change your choice at any time: — or use COOKIES at the bottom of every page.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| PHPSESSID | Cookie | Keeps you signed in and protects forms | Until you close the browser |
| coindetails_consent_v2 | Local storage | Remembers your cookie choice (essential only, or external content allowed) and when you made it | Until you change or clear it |
| cd-main-menu | Local storage | Keeps the top menu as the administrator set it, so it does not flicker between pages | Until you clear it |
| spx-words, spx-off | Local storage | Words you added to the spell checker in text boxes, and whether you switched it off. The spell checker runs in your browser; your text is not sent anywhere for it. | Until you clear it |
Fonts, images and scripts are served from Coindetails.com itself, so opening a page does not send your IP address to other companies — except a Google map, and only after you allow it as described above. The small BLINKER badge in the footer is loaded from dragos.xyz, a site of the same network run by the same operator: your browser fetches the badge and its status from there (so dragos.xyz receives your IP address, like any website you open). It sets no cookies and stores nothing on your device. The share panel opens another app or website only when you choose one.
5. Location
- Approximate location: your country can be derived from your IP address. We use it only in the activity log (section 2). When the administrator opens the details of an event, the IP address may be sent to the free service ipwho.is to find its country; the answer is kept for up to 30 days. If the site runs behind Cloudflare, the country supplied by Cloudflare is used instead and no lookup is made.
- Precise location (GPS / device location): never collected automatically. When you post a find you may add a map position yourself, by typing or pasting it or by pressing USE MY LOCATION; your browser asks your permission first, and the position is used only for that find. You choose whether visitors see an exact position, an approximate one (rounded to about 1 km) or none. You can edit or delete it at any time. Think before showing an exact spot: it can lead others to private land.
6. Who receives data
- Our hosting provider, which stores the site, the database, files, backups and server logs, and delivers our emails.
- Your email provider (for example Gmail or Outlook), which receives the emails we send you under its own terms.
- ipwho.is, only for the country lookup described in section 5.
- Google, only when a Google map is shown to you after you allowed it (section 4).
- dragos.xyz (same network and operator), which serves the BLINKER badge in the footer and sees the IP address of the request (section 4).
- Everyone who visits the site sees what you publish in a member post (section 2), with your nickname.
- Cloudflare, only if the site is placed behind Cloudflare's network, as its security and delivery provider.
- Authorities, where the law requires it, for example for illegal content or a safety report.
Nothing you do on Coindetails.com is published to other people: accounts, messages, contact messages and reports are private.
7. International transfers
If a provider processes personal data outside the UK, the transfer relies on UK adequacy regulations or on appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
8. How long we keep data
- Account: while your account exists. A temporary account cannot sign in after its last day, but is kept until the administrator deletes it or makes it permanent. We delete your account when you ask us to close it, except what the law requires us to keep.
- Inside Mailer: until both you and the administrator delete the conversation, or your account is closed.
- Terms acceptance records: while your account exists and for up to 6 years after it is closed, so that what was agreed can be shown if there is a dispute.
- Search limits: 1 minute.
- Member posts and their pictures: until you or the administrator delete them, or your account is closed.
- Notifications: until you delete them or your account is closed; only the newest 200 are kept.
- Contact messages: 12 months, then deleted automatically.
- Reports: while open; closed reports are deleted 12 months after they were closed.
- Mailing records: 12 months.
- Activity log: the most recent 1,000 events.
- Sign-in and contact-form limits: 15 minutes (sign-in) or 1 hour (password reset, contact form).
- Country lookups: 30 days.
- Password-reset tokens: until used or expired.
- Backups: the site makes regular backups of its files and the members table. Each backup is kept until it is replaced by newer ones, so data you deleted may stay in a backup for that period before it disappears.
9. Your rights
You have the right to access your data, to have it corrected or erased, to restrict or object to its use (including, at any time, to direct marketing), to data portability, and to withdraw consent at any time where we rely on consent. An account the administrator made for you has the same rights: you can ask for a copy of what we hold, add or correct your email, remove the end date or close the account.
To use these rights, write to or use the Privacy / GDPR request channel. We may need to confirm your identity, and we reply within one month.
You can also complain to the UK Information Commissioner's Office (ico.org.uk). We would appreciate the chance to deal with your concern first.
10. Age
Coindetails.com accounts are for adults aged 18 and over. When you register you confirm that you are 18 or over; this is a self-declaration, not a proof of age. We do not knowingly collect personal data from anyone under 18. If we learn that an account belongs to someone under 18, we will close it and delete its data, except a record we must keep by law.
11. Security
We use HTTPS, password hashing, protection against cross-site request forgery, limits on sign-in and reset attempts, and access control for the administrator area. A password the administrator makes for you is random, shown once to the administrator to give to you privately and stored only as a hash; change it after you first sign in. Accounts without an email cannot use “Forgot password” — ask the administrator for a new password.
No online service is completely secure. If a personal-data breach is likely to put your rights at risk, we will tell you and the Information Commissioner's Office as the law requires.
12. Changes to this policy
We will update this page when the site changes — for example if statistics, advertising, payments or new member features are ever added. Nothing of that kind will start before this page is updated and, where the law requires it, before you are asked for consent.