Privacy

CheckAPostcode is run by Towpath Digital Ltd, a company registered in England and Wales, company number 16913912. Towpath Digital Ltd decides how the information described on this page is used. In law that makes it the data controller.

Registered office: Huntingdon Boathaven, The Avenue, Godmanchester, Huntingdon, England, PE29 2AF.

Towpath Digital Ltd is registered with the Information Commissioner’s Office, registration number ZC210106.

For anything about your information, email privacy@towpath.digital or write to the registered office. To tell us that a fact on the site is wrong, use the error-report form.

This site is for a general audience. It is not aimed at children.

We count visits ourselves, so that we know how much the site is used and which pages are useful, and can make it better. The counting itself sets no cookie and writes nothing to your browser’s storage. You can switch it off.

What your browser sends

When you open a page, a small script on it tells this site:

• what kind of page it is, for example a postcode page or a district page;
• for a postcode, sector, district, area or place page, which one;
• the name of the website you came from, if you came from another site, for example “google.co.uk”. Never the page on that site.

It does not send the address of the page or anything you typed.

What you type

What you type into a search box or a question box is sent to this site, as part of the address of the page that answers, so that the site can find the answer. The site does not keep what you typed. If it is a postcode, district or place we hold, you are taken to its page, and that page is counted like any other: one more view of that postcode, district or place for the day, not linked to you. If it is not something we hold, we count only that a search page was opened or, for a postcode we do not hold, its district. On a question page, such as “What council am I in?”, the postcode you type stays in the address of the answer and nothing about it is counted.

Like every request to every website, this one arrives with your network address (your IP address) and a description of your browser. We use both for a moment, as set out below. We do not store either: only the code described next is written down.

What a visitor is

To count visitors and not just pages, the site passes your network address and your browser’s description to its database, which makes a one-way code from three things: your network address, the kind of browser you use (for example “Chrome on Windows”), and a secret that is replaced every day. Only the code is kept. For the newer, longer kind of network address, the code is made from the half of the address that names your connection, so that one home or office counts once.

So in our figures a visitor is one connection, using one kind of browser, on one day, UK time. Two people who share a connection and use the same kind of browser count as one visitor. One person who visits on two days, or from two connections, counts as two.

The secret is replaced the first time anything is counted after midnight, UK time, and the old one is overwritten. From then on the earlier day’s codes cannot be made again. A code cannot be matched to another day, and cannot be turned back into a network address. Until the secret is replaced, the same address and browser would give the same code, so until then the code counts in law as information about you. That is why this page gives you rights over it. The site has no page or function that looks one up.

The code itself is erased at the same moment: the first time anything is counted on a later day, UK time. A code made on a Monday is gone when the first thing is counted on the Tuesday. If nothing at all is counted that day, it goes when the next thing is.

What is kept

One row for each visitor on each day, holding:

• the day, and the code until it is erased;
• the kind of device: phone, tablet, computer or unknown;
• how you arrived: from a search engine, directly, from one of our own sites or from another site, and that site’s name;
• the kind of page you arrived on;
• how many pages you opened, how many of them were postcode pages, and how many counted links you pressed;
• until 18 October 2026, how many of our own adverts were in the pages sent to you that day, and how many you pressed (see below);
• the time of the first of those, and the time of the latest page you opened or link you pressed;
• whether the visit looked like a robot, judged from the browser’s description, and whether it came from our own team.

These rows are kept. Once the code has been erased, a row is a count with nothing in it that we could use to find you.

We also keep, for each day, how many times each page was opened. Those totals are not linked to any visitor. On a day with very few visitors a total can still point to one visit: if one person opened postcode pages that day, the postcodes counted that day are theirs.

Links we count

Some links are counted: links to official sites such as GOV.UK, and to OpenStreetMap. When you press one, the page tells this site which link it was and where on the page it sat. We add one to that link’s total for the day, and one to the number of links pressed in your visitor row. We do not record which visitor pressed which link.

Our own adverts, until 18 October 2026

Until 18 October 2026 this site also showed adverts for Towpath Digital Ltd’s own products. It no longer does. While they ran, we counted on our server how many times each was sent out in a page and how many times each was pressed. None of this was counted if you had switched our counting off or your browser sent Global Privacy Control, and robots were left out.

The totals from those days are kept: for each day, by advert, kind of page and the kind of space the advert sat in. They hold nothing about a visitor. The visitor rows of those days also hold how many of our adverts were in the pages sent and how many were pressed, and a number counted by the very first version of the site, which used a script in the browser to count an advert once half of it had been on screen; the codes in those rows are erased like any other. Nothing new is added to any of them.

Keeping our own visits out

To leave our own visits out of the figures, the database makes a second one-way code from the first part of each visitor’s network address, the part that names the network, and compares it with a short list of our own networks. It is used for that comparison only and is not kept.

Why the law lets us

We rely on our legitimate interests: we need to know how much the site is used and which pages are useful, and we have built the counting to learn as little about you as that needs. We make no decision about you from it and build no profile.

A second set of rules, the Privacy and Electronic Communications Regulations, covers a script that reads anything from your device, as the one that tells us about a page view does. Those rules let a site count visits for statistics about how it is used, in order to improve it, without asking first, as long as it tells you and gives you a simple, free way to say no. The Information Commissioner’s Office sets this out in its guidance on the exceptions. This section is the telling, and the switch below is the way to say no.

The server also records how long pages take to make, and when it starts and stops. Those figures are about the server and hold nothing about visitors. The site’s own server keeps no log of visits.

You can tell this site not to count your visits. It costs nothing and you do not have to say why.

Your choice

Our counting is on in this browser. You have not switched it off.

To remember a no, pressing “Do not count my visits” puts one cookie in this browser. It holds the word “off” and nothing else.

Count my visits Do not count my visits

What switching it off does

When you press “Do not count my visits”, this site puts one cookie in this browser, called cap_count, holding the word “off”. It holds nothing else, and nothing about you. Your browser sends it back with each request, which is how the site knows. While it is there:

• the pages you open send nothing to our counting: no page view and no pressed link;
• the server does not count the adverts in the pages it sends you, or a press on one;
• nothing is added to any visitor row, and no visitor code is made for you.

What was counted before you switched it off stays counted: we have no way to tell which counts were yours.

The cookie asks to be kept for 400 days. Your browser may keep it for less, and it goes if you clear this site’s data. Once it has gone the counting starts again, until you switch it off again. Pressing “Count my visits” removes the cookie.

If your browser sends Global Privacy Control, we treat that as “do not count my visits” on every request, with no cookie and for as long as your browser sends it.

Switching this off does not change your answer about Google Analytics, which is a separate choice. It does not change what happens if you choose to send an error report either.

We also use Google Analytics, to see how people find the site and move around it. We use it only if you say yes. Until you do, nothing on this site asks anything of Google, and nothing is put on your device for it.

What happens if you say yes

Your answer is remembered in this browser. This site’s script then loads Google’s script from www.googletagmanager.com, on that page and on each page you open afterwards. Google’s script sets the two cookies listed below, which let Google recognise this browser on later visits, and tells Google about each page you open:

• the address of the page, without anything after a question mark. So what you type into a search box or a question box on this site is not sent. The address of a postcode page does contain that postcode;
• if the page does not exist, /404 instead of the address that was typed;
• the title of the page, or only the site’s name where the title could repeat something you typed;
• the address of the website you came from, without the page;
• what your browser sends with every request: your network address and the kind of browser and device. Google says it does not log or store the network addresses of UK users.

Google’s script can also record how you use a page, such as scrolling to the end of it or pressing a link to another site.

In Google Analytics we have switched off Google’s advertising features and refuse consent for advertising on your behalf, so Analytics adds nothing to advertising. Google’s adverts on this site are separate and ask for their own answer: see Google’s adverts. Google’s cookies are limited to this site’s own name. Google explains how it uses information from sites that use its services.

The cookies Google sets

Names and times are from Google’s list of the cookies Google Analytics uses, read on 7 October 2026. They are set only after a yes.

They are cookies for this site’s name, so your browser also sends them to this site with every request. This site does not use them or keep them.

How long Google keeps it

Google keeps the records of individual visits that it holds for us for 14 months at most, and then deletes them. Google explains the period, and that the totals in its reports, which have no visitor in them, are not affected by it.

Changing your mind, and how long an answer lasts

You can change your answer above at any time. If you change a yes to a no, we stop Google’s script sending anything, remove the two cookies and load this page again without Google’s script. Any other page of this site that you have open in this browser is loaded again without it too. It is not loaded again unless you say yes. What Google was sent before that is not removed by saying no.

A yes lasts 6 months. Then we remove Google’s two cookies, stop using Google Analytics for you and ask again. That is the time the Information Commissioner’s Office suggests. A no lasts 12 months before we ask again. A yes you give here applies to this site only.

If your browser sends the Global Privacy Control signal, we take that as a no and do not ask you. You can still say yes above.

If you are under 13, please answer no, or ask a parent or guardian.

Why the law lets us

We rely on your consent, and on nothing else. No is the answer until you say yes, and saying no is as easy as saying yes.

If you report an error, we keep:

• the postcode or page you named, and what you wrote;
• your email address;
• the date and time it arrived, and the reference we gave it;
• a one-way code made from your network (the first part of your network address) and that day’s secret. It is there to stop one network flooding the form: we take 5 reports a day from one network and 300 a day in all. It is erased the next day, in the same way as the visitor code above.

Your network address and your browser’s description are not stored with a report.

For ten minutes after a report is saved, the server remembers a one-way code made from it, in memory only, so that the same report sent twice by mistake is saved once.

What we do with it

We check what you told us against the source the fact came from, and reply to you by email. Your address is used for that reply and for nothing else. The site sends no email itself: a person replies from our own mailbox, so your address and our reply are then in that mailbox too.

Reports can be read only by staff of Towpath Digital Ltd who are signed in to the site’s admin pages. When a report is closed we add what we found, whether we replied, a note, when it was closed and who closed it.

How long it is kept

• Your email address is deleted once the report has been closed for 90 days. The site deletes it in a daily tidy-up, which runs the first time anything is counted each day. If a report is opened again, the 90 days start again when it is next closed.
• Whatever has happened to the report, your email address and what you wrote are both removed 12 months after the report arrived, by the same daily tidy-up.
• The rest is kept, so that we have a record of what was wrong and what we did: the postcode or page, the reference, the dates, what we found and our note. Please leave personal details out of what you write.
• These times are about the site. If we replied, the reply in our mailbox is not removed by the site. A person deletes it when you ask us to delete your report.

You can ask us to delete a report, or only your address, sooner, to send you a copy, or to correct it. Email us with the reference, or from the address you sent it from. Staff can find a report by either, and do each of those things from the admin pages.

Why the law lets us

We rely on our legitimate interests: keeping the facts on this site right, and answering the person who told us about a mistake. You can object: see your rights.

Each postcode page in England and Wales lists the homes sold in that postcode in the three latest years Land Registry has published, usually this year and the two before: the address, the price, the day of the sale, the type of home, whether it was freehold or leasehold, and whether it was newly built. It comes from HM Land Registry’s Price Paid Data, which Land Registry publishes for anyone to use under the Open Government Licence. Each sale links to Land Registry’s own record of it.

We add nothing to it. There are no names in it, and nothing about who bought or who sold. The site checks each day for Land Registry’s new files, which it publishes once a month, and copies them again, so a sale that Land Registry corrects or takes out is corrected or taken out here too.

A home’s address and what it sold for can be information about the people who live there. The addresses in Price Paid Data come from Royal Mail and Ordnance Survey, whose terms, as Land Registry publishes them, allow them to be shown to give information about house prices. We show them only in these lists.

Why the law lets us

We rely on our legitimate interests, and those of the people who read the site: honest, sourced information about what homes sell for, where someone lives or is thinking of moving. Land Registry already publishes the same sales for anyone to read. We have weighed that against what it means for the people who live in those homes, and we take a sale off whenever someone who owns or lives in the home asks.

If it is your home

If you own or live in a home and would rather its sale were not listed here, tell us through the error-report form, or email privacy@towpath.digital, with the address. We take it off this site’s pages, usually within a few days, and tell you when it is done. We cannot take it out of Land Registry’s own records: Land Registry publishes those.

Since 17 October 2026 Google AdSense chooses and shows adverts on this site’s content pages. Other companies pay Google for them, and we do not pick each one. Google may also show an advert along the bottom of a phone screen, at the sides of a wide screen, and a full-screen advert between pages that you can close. None of them is placed above the answer to what you asked, and nobody’s payment changes what this site says about any postcode.

When a page with Google’s adverts loads, your browser fetches Google’s script and Google receives what any website receives: your network address, your browser’s description, and the address of the page, which on a postcode page contains that postcode. Google uses it to choose and count the adverts and to stop fraud.

Before Google sets any advertising cookie or shows you adverts chosen from what it knows about you, Google’s own message on this site asks. If you say no, Google can still show adverts chosen from the page you are on. You can change your answer at any time with “Your advert choices” at the foot of every page. For its adverts Google is a separate controller, not a company acting for us. Google explains how it uses information from sites that use its services and lists the cookies it uses. You can change how Google personalises adverts anywhere in My Ad Center.

We rely on your consent for advertising cookies, and for adverts chosen from what Google knows about you: Google’s message asks for it. Showing an advert chosen from the page alone is part of how this site pays for itself.

We do not receive anything about you from Google’s adverts. Google tells us totals: how many adverts were shown and pressed, and what they earned.

The site never asks for your location by itself. On the “What is my postcode” page there is a button, “Use my location”. Only if you press it does your browser ask whether this site may know where you are.

If you agree, your position is sent to this site once. The site finds the postcodes nearest to it and sends them back. The position is rounded to about 10 metres before it is used. This site does not store it, does not write it to a log, and never puts it in an address. No cookie is set.

We rely on your consent: you press the button, and your browser asks you. You can take the permission back in your browser’s settings at any time.

Nothing, until you make one of the choices on this page. Then only what remembers your choice:

• cap_count, a cookie, only if you press “Do not count my visits”. It holds the word “off” and nothing else. Your browser sends it to this site with each request, so that the site and its server know not to count you. It asks to be kept for 400 days, and goes sooner if you press “Count my visits” or clear this site’s data.
• cap-consent, in this browser’s storage for this site, only once you answer the Google Analytics question. It holds your answer, “yes” or “no”, and the day you gave it, and nothing else. It is how the site knows not to ask again until 6 months after a yes or 12 months after a no. It is never sent to us.
• If your answer is yes, Google’s two cookies. They are removed if you change your answer to no, and when a yes runs out.

If your browser answers for you with Global Privacy Control, nothing of ours is kept at all.

Google’s adverts are Google’s: Google’s message keeps your answer about them in this browser, and Google sets advertising cookies only if that answer is yes. They are listed in Google’s list of the cookies it uses. See Google’s adverts.

Our counting and the error-report form set no cookie and keep nothing in your browser.

The only other cookies this site sets itself are for our own staff: they sign staff in to the admin pages and mark a staff browser so that its visits are left out of the figures. Visitors are never given them.

We do not sell information about you. These companies handle it for us, to run the site. Each publishes the terms on which it handles information for a customer, and we use it on those terms.

• Cloudflare, Inc., an American company, carries every request to the site. It sees your network address, your browser’s description, the addresses of the pages you open (which include a postcode typed into a search box or a question box) and anything sent with them, such as an error report, or a position you choose to send. Cloudflare’s terms.
• Krystal Hosting Ltd, a British company, provides the server the site runs on, in London. Krystal’s terms.
• Supabase Pte. Ltd, a company in Singapore, runs the database, which is kept in London. The counts and the error reports described on this page are stored there. To make the one-way codes, the site passes your network address and your browser’s description to the database, which uses them for that moment and does not store them. Supabase’s terms.
• Google Workspace, Google’s email service for businesses, holds our mailbox. If we reply to an error report, or you email us, your address and the messages are kept there. Google’s terms for it.
• Google, only if you say yes to Google Analytics. In the UK Google Analytics is provided by Google Ireland Limited. Google’s terms for it.

Google is not on this list for its adverts: there it is a separate controller, described under Google’s adverts.

Links on this site lead to other websites, such as official sites and the sources of our figures. Once you are there, that site’s own privacy page applies.

The site’s server and its database are in London. Cloudflare, Supabase and Google are based outside the UK and work across many countries, so information they handle for us can be handled in, or reached from, other countries, including the United States. The safeguards are the ones each company publishes in the terms linked above:

• Cloudflare says it is certified under the UK Extension to the EU-U.S. Data Privacy Framework, which the UK government has approved for sending personal information to certified American companies. Its terms also include the UK’s addendum to the standard contract terms for sending information abroad.
• Supabase’s terms include the same UK addendum, and say that a database a customer places in one region is stored and mainly handled there. Ours is placed in London.
• Google’s terms say it may handle information in any country where it or its suppliers have facilities, and provide for the standard contract terms where the law asks for them.

You can ask us about any of these at privacy@towpath.digital.

Data protection law gives you the right to:

• ask what we hold about you and have a copy of it;
• have something that is wrong put right;
• have it deleted;
• ask us to stop using it, or to use it less, including where we rely on our legitimate interests;
• in some cases, be given what you gave us in a form you can pass to someone else;
• take back a consent you gave. For Google Analytics, use your choice on this page;
• complain to the Information Commissioner’s Office.

To use any of them, email privacy@towpath.digital or write to Towpath Digital Ltd at the registered office above. It costs nothing. The law gives us one month to answer.

What we can do depends on what we hold:

• An error report: tell us its reference, or the email address you sent it from, and we can send you a copy, correct it or delete it.
• A sale of your home in a postcode’s list: tell us the address and we take it off this site. See Homes sold in a postcode.
• The visit counts and the advert counts: we hold nothing that says which counts are yours. The one-way code cannot be turned back into you, and is erased the next day. So we usually cannot find, copy or delete your part of them. You can stop any more being counted with the switch under Switching our counting off.
• Google Analytics: saying no stops it and removes its cookies from this browser.

To complain about how we have used your information, email privacy@towpath.digital or write to the registered office. We will tell you that we have your complaint within 30 days, look into it without delay, tell you how it is going, and tell you what we found. The Information Commissioner’s Office sets out what we must do.

You can also complain to the Information Commissioner’s Office, which enforces data protection law in the UK. Its page Make a complaint about how an organisation has used your personal information explains how. Its helpline is 0303 123 1113.