Privacy

This page explains what personal data OpenCharities publishes and collects, why, and what you can do about it.

Who we are

OpenCharities is run by Jason Cartwright, an individual, who is the data controller for this site. To ask a question, correct something or make a request, get in touch through jasoncartwright.com.

What this site publishes about people

OpenCharities republishes the UK's three official charity registers:

• Charity Commission for England and Wales
• Office of the Scottish Charity Regulator (OSCR)
• Charity Commission for Northern Ireland

Each regulator publishes its register as open data. Most of it is about organisations, but some of it is about people:

• Trustees. For England and Wales, each trustee's name, whether they chair the charity, whether they are an individual or an organisation, and the date they were appointed, from the Charity Commission's register extract. For Northern Ireland, trustee names from the Charity Commission for Northern Ireland's public charity pages. We don't hold trustee names for Scottish charities.
• Trustee pages. Each trustee name has its own page listing the charities it appears on. The page is built from the name alone, so where two people share a name, their roles appear together.
• Charity contact details. The address, phone number, email address and website each regulator publishes for a charity. For Scottish charities the address is the one OSCR publishes as the principal office or trustees' address.
• Filed documents. Copies of the accounts and annual reports charities file with the regulators, and their text, which you can search. These are the charities' own documents and can name trustees, staff and other people.
• Charity websites. The text of pages on each charity's own website, and a screenshot of its home page (see below).

The registers we use don't give trustees' dates of birth, and we don't hold an address for each trustee. Charity pages, trustee pages and documents are listed in our sitemap, so search engines can find them.

Why we publish it

Charities hold money and trust on the public's behalf, and the regulators publish who runs them so that anyone can check. Our lawful basis is legitimate interests: making the public registers easier to search, compare and reuse, so people can understand the charities they give to, work with or are served by. We only republish what the regulators and the charities themselves have already made public.

Keeping up with the registers

• The registers are the authoritative source. If something about you is wrong, ask the regulator to correct it, and the correction will reach this site when we next refresh the data.
• Trustee lists are replaced in full each time we refresh from the registers, so when a regulator removes a trustee, they disappear from this site at the next refresh.
• Charities removed from a register are kept here and marked as removed.
• Copies of filed documents are not removed automatically if a regulator later withdraws one. If a document should come down, get in touch.

Objecting or asking for removal

You can object to us publishing something about you, or ask for it to be removed, by getting in touch through jasoncartwright.com. Tell us the page and what concerns you. We'll look at each request, weighing it against the public interest in the registers, and reply.

If you run a charity's website

Each charity's register entry can include its website. We visit those websites to make their text searchable here.

• Our crawler identifies itself with the user agent Mozilla/5.0 (compatible; OpenCharities/1.0; +https://opencharities.uk).
• It follows your robots.txt. It matches rules for OpenCharities or *, honours Disallow, and honours a Crawl-delay of up to 5 seconds. It waits at least half a second between requests to the same site.
• It reads up to 150 pages in all, fewer for smaller charities, starting with your home page and then following your sitemap or the links on your site. It stays on your site, doesn't run JavaScript, and keeps only the text of web pages, not images or files.
• We keep each page's address, title and visible text. Each new crawl replaces the last.

To stop the crawler, add this to your robots.txt:

User-agent: OpenCharities
Disallow: /

The text we hold from your site is removed the next time we crawl it.

Screenshots. We also show a small screenshot of each charity's home page. It is taken through Cloudflare's Browser Rendering service, so the visit comes from Cloudflare rather than from our crawler, and it does not check robots.txt. We store a 600-pixel-wide image and show it on the charity's page. To have a screenshot removed, get in touch.

Site icons. To show your site's icon, our server asks Google's favicon service for it by your domain name, and stores the icon.

What we collect when you visit

Analytics

We count visits with fivebar (fiveb.ar), a cookieless analytics service that is also run by Jason Cartwright. It doesn't set cookies on your device.

It receives the page's address, the page you came from, the width of your window and how you used the page, such as time on screen and how far you scrolled. It uses your IP address and browser details to count you once a day, but does not keep them. Its own privacy page, linked above, says what it keeps.

Cookies

• Browsing, searching and downloading data set no cookies.
• The Ask page sets one cookie, csrftoken, which protects its form from forgery and holds nothing about you.
• The staff login, for the people who run the site, sets a session cookie for them only.

The site doesn't use your browser's local storage.

Logs and searches

The site itself doesn't keep a log of the pages you view or your IP address, and doesn't store what you search for. Like any website, the services that carry traffic to it handle your IP address in order to deliver pages and keep the site secure.

Asking about a charity with AI

Each charity has an Ask page where you can type a question about it. Your question is sent, with that charity's public data, to Google's Gemini service, which may also search the web to answer it. We keep a record of each question: the question, the answer, when it was asked and your IP address. These records are not yet deleted automatically. Please don't put personal information in a question.

AI assistants (MCP) and data downloads

Our MCP server and our data downloads need no key or sign-in.

• The MCP server is stateless: no cookies and no sessions.
• For each MCP request we log the method, the tool's name, how long it took, whether it worked, and the name the AI assistant gives itself. We never log what was asked for or searched.
• The send_feedback tool lets an assistant send us a short note, only with your agreement. Notes that contain an email address, an IP address or a web address with a query string are refused. We keep each note for up to 365 days. Your IP address is stored only as a keyed hash, used to limit how many notes one address can send, and never in readable form. The note itself is never written to our logs.

Where data is processed

• The site runs on a server at Hetzner in Falkenstein, Germany.
• Traffic reaches it through Cloudflare. Copies of filed documents and the website screenshots are stored with Cloudflare, and screenshots are taken with Cloudflare's Browser Rendering.
• Fonts, a shared stylesheet, and the map and chart code load from opencommons.uk. Map tiles load from maptiles.opencommons.uk, which passes requests on to OpenFreeMap, so your browser doesn't contact OpenFreeMap directly. These are run by Jason Cartwright too.
• Pointing at or tabbing to a charity's company number fetches the company's details from opencompanies.uk, another OpenCommons site.
• Analytics go to fivebar, and Ask questions go to Google, as above.

How long we keep it

• Register data: for as long as the site runs. Trustee lists follow the register at each refresh, and removed charities stay, marked as removed.
• Website text: until the next crawl replaces it.
• Document copies and screenshots: until replaced or removed on request.
• MCP feedback notes: up to 365 days.
• Ask records: not yet deleted automatically.

Your rights

Under UK data protection law (the UK GDPR) you can ask for a copy of the personal data we hold about you, and ask us to correct it, delete it or restrict how we use it. You can also object to us publishing it. Get in touch through jasoncartwright.com.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office.

Changes

We'll update this page when what the site does changes.

Last updated: 13 October 2026