Privacy

Privacy and your data

The short version: the site keeps what an account needs and what you choose to post. Nothing is sold, there are no ads, and nobody is followed around the web. You can download or delete your account and everything in it yourself, at any time.

Who is responsible

BigRanks is run by one private person in Poland, not a company, who is responsible for the personal data described on this page (the controller, in the words of the GDPR). To ask about your data or to use any of the rights below, write to [email protected], or use the feedback form.

If you only read the site

You can read the site without an account, and without one the site stores nothing that names you. This is what does happen when you visit:

• Cloudflare sits in front of the server, so it receives your IP address with every request, as any network that carries a website does. It protects the site from attacks and delivers its files from servers close to you.
• Forms count attempts per address to slow down floods of requests. The address is scrambled with a secret value first, and the counter expires on its own within an hour.
• Visits are counted with Cloudflare Web Analytics, which sets no cookie and stores nothing in your browser. It reports how many people came, to which pages and from which sites, not who they are.
• Posters, covers, photos and trailer stills are often loaded straight from the sites that host them: Wikimedia Commons, TVmaze, fanart.tv, Steam, IGDB, AniList, TMDB and YouTube's image server. Your browser asks them for the picture, so they see your IP address, as they would for any image on the web. The site sends them nothing about you.
• Trailers and clips play in YouTube's privacy-enhanced player (youtube-nocookie.com), which loads only when you press play. From then on YouTube's own privacy policy applies.
• If you play Reveal without an account, your progress is kept in a session tied to a cookie on your device, not to anything that names you. Beyond that, the site counts only how many games were started and finished.
• The feedback form asks for an email address only if you want a reply. What you write, the page you came from and the address, if you give one, are stored for the person who runs the site to read. Ask and a message is deleted.
• A report of illegal content needs an email address, so that the report can be followed up. The report is kept as the record of the notice and of what was done about it.
• If you give money through the support page, the payment happens on the platform you choose, under that platform's own policy. A payment panel shown on that page loads only when you ask for it. Nothing about your gift is stored here: the totals on the support page are typed in by hand.

If you have an account

To run an account the site stores your email address, your username, your password (only as a one-way hash, never in a form that can be read back), when you joined and last logged in, when your email address was confirmed, the language you last read the site in, your email settings, your trust level and, if you added one, your donation link.

And what you choose to do here: your ratings of titles, seasons, aspects and people's work, what you finished or dropped, takes and the YouTube clips attached to them, reviews, upvotes, battle votes, quiz and Reveal results, badges, the people and members you follow, your watchlist, your notifications, and the reports and feedback you send.

Public, on your profile and next to what you posted: your username, the month you joined, your ratings, takes, published reviews, quiz results and badges, and your donation link. Never shown to other members: your email address, your watchlist, reviews still waiting for a moderator, the reports you file and your notifications.

To keep the averages honest, some actions leave a small record: registering, confirming your address, rating, writing, upvoting, voting in a battle, adding to your watchlist and reporting. The record says what was done, when, and holds a scrambled form of the IP address it came from. The site also notes when your confirmation email was sent. These records are read only to find groups of fake accounts, and they never ban anybody automatically: a person decides, and the outcome is logged in public, as the trust page explains.

Reviews, and takes held back by an automatic rule, wait for a moderator before they appear. The moderator may first give the text, without your name or email address, to an automated checker: a language model running on the moderator's own computer, or Anthropic's Claude. Its answer can only speed up the publication of a clearly harmless text; it never rejects anything, only a person does.

The site sends you a confirmation link, a welcome letter, and a daily letter on days when you have new notifications. The daily letter can be turned off with the link at the bottom of every letter or in your settings.

Why, in plain words

• Running the account you asked for, showing what you post and sending the letters that belong to it: that is the agreement between you and the site (GDPR Article 6(1)(b)).
• Protecting the site, counting votes honestly, stopping spam and fake accounts, and fixing faults: that is the site's legitimate interest in working and being trustworthy (Article 6(1)(f)). You can object to it; see your rights below.
• Handling reports of illegal content: a legal obligation under the EU Digital Services Act (Article 6(1)(c)).

Nothing is sold or rented to anybody, there is no advertising, and nothing here builds a profile of you for advertising.

Cookies and your browser

Only what the site needs in order to work, which is why there is no cookie banner:

• sessionid: keeps you logged in, or holds a visitor's Reveal game. It lasts up to two weeks.
• csrftoken: stops other sites from submitting forms in your name. It lasts up to a year.
• django_language: the language you picked, set only when you switch, and gone when you close the browser.
• theme: light or dark, kept in your browser's local storage if you chose one. It never leaves your device.
• Cloudflare may set a security cookie of its own while it checks traffic for bots. The registration form also uses Cloudflare Turnstile to tell people from scripts.

There are no advertising or tracking cookies.

Who handles data for the site

A few companies process data on the site's behalf, each only for its own job:

• Hetzner: the server and its database, in Helsinki, Finland.
• Cloudflare: the network in front of the server, protection against attacks and bots, the forwarding of mail sent to the site's address, and the storage that holds the off-site copy of the database.
• Brevo: sends the site's emails, from the confirmation link to the daily letter.
• Google: the mailbox in which mail to [email protected] is read and answered.
• Anthropic: only the text of a review or take, and only when a moderator uses Claude as the checker described above.

The database lives on the server in Finland, inside the European Union. Some of the companies above are based outside the European Economic Area, mostly in the United States. Where data leaves the EEA, it goes under the safeguards those companies provide for it: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

How long it is kept

• Your account and everything in it: until you delete it, which removes it at once.
• Copies of the database are made every night and kept for 14 days, on the server and off it. Something deleted is gone from them about two weeks later.
• Notifications: 90 days.
• The counters on forms: an hour at most.
• Feedback messages and the anti-abuse records described above stay when an account is deleted, with the link to the account removed. They have no fixed deletion date yet; when one is set it will be written here. Until then, ask and yours are deleted.
• Reports of illegal content: kept as the record of the notice and of what was done about it.

What a deleted account leaves behind carries no name: numbers that were already settled, such as the final count of a battle round, and the public moderation log.

Your rights

Under the GDPR you can see your data, take it with you, correct it, delete it, ask for its use to be restricted, and object to its use. Most of this needs nobody's help:

• Your data, in your account, downloads everything the account holds as one JSON file.
• The same page deletes the account and what you posted, for good, as soon as you confirm with your password.
• Ratings and takes can be changed or removed, and reviews edited, where you posted them. To change your username or email address, or to have a single review removed, write in.
• For anything else, including an objection or a request to restrict, write in using the contact above. You get an answer within a month, and usually much sooner.

You can also complain to a data protection authority. The site is run from Poland, so that is the Polish President of the Personal Data Protection Office (UODO, uodo.gov.pl), but you may turn to the authority where you live instead.

BigRanks on social media

BigRanks posts on Bluesky, Mastodon, X, Facebook, Instagram, TikTok and YouTube. When you follow, like or comment there, that platform's own privacy policy applies, and what you do there stays between you and that platform.

The tools that publish there post only what BigRanks itself writes, and may read the totals on those posts, such as how many likes one got. They do not reply, follow or send messages, and they collect nothing about the people who visit this site or follow those accounts. What they take from this site are public feeds of its quizzes, games and battles, which carry nothing about members or visitors.

Changes, and which version counts

This page changes when the site does, and the current version is always the one here. It last changed on 4 October 2026. It is written in English and translated into the other languages the site speaks as a courtesy; where a translation and the English differ, the English text is the one that governs.