Skip to content

Privacy Policy

Last updated

Name.Baby is a free reference site about baby names, published by Matrix Data LLC ("we"). This policy explains what the site collects when you visit it or create an account, why, who else receives it, how long it is kept and how to have it deleted. You can read every page without an account.

The short version

  • Reading the site needs no account, and while you only read, the site sets none of its own cookies.
  • If you create an account, we keep your name, your email address, your password in scrambled form and the names you save.
  • Our web server logs each request with your IP address and browser details. The logs are deleted after 12 to 13 months.
  • Google provides the site's visitor statistics (Google Analytics), its ads (Google AdSense) and the "Sign in with Google" button, and sets its own cookies for them. Visitors in Europe and the UK are asked first whether Google may use cookies for ads, and visitors in U.S. states with privacy laws get a "Do not sell or share" choice.
  • We never sell your personal information. To delete your account, write to info@name.baby.
  • The names, ranks and birth counts come from the public baby-name data of the U.S. Social Security Administration, not from anyone's personal records.

Where the name data comes from

The names, ranks and birth counts on Name.Baby come from the baby-name data that the U.S. Social Security Administration (SSA) publishes every year: for each year since 1880, how many babies of each sex were given each name in the whole country, in each state and in the U.S. territories. The SSA counts only names given to at least five babies of a sex in a year, and its files hold no birth dates, surnames or addresses, so they contain nothing about any one person.

We publish these figures as the SSA releases them, so we cannot remove a name or change its counts. Questions about this data, including a request to have a name removed from it, should go to the SSA: see ssa.gov/oact/babynames. The rest of a name page, its meaning, pronunciation and notable people, is our own work; to report a mistake in it, write to info@name.baby.

Your account

An account is optional. It lets you save names and see them again on any device. What we store depends on how you sign up:

  • With an email address: the name you enter, your email address and your password. The password is stored only as a bcrypt hash, a one-way scramble, so nobody here can read it.
  • With Google: Google sends us your Google account ID, your name, your email address and the web address of your Google profile picture, and confirms that the email address is verified. We store those four things and nothing else from your Google account, and we never see your Google password. If an account with the same email address already exists here, the two are joined, and each Google sign-in updates the name and picture from Google.

We also store the names you save (the heart on a name page) and when your account was created and last changed. We use this information only to run your account: to sign you in, to show you your saved names and to reply when you write to us. We do not send newsletters or marketing email, and other visitors never see your name or your saved names.

When you sign in, a cookie called auth_token keeps you signed in on that browser for 30 days. It holds a random code; our server stores only a hash of that code, with the times it was created and last used, and stops accepting it after the same 30 days. Signing out deletes the code from our server and the cookie from your browser.

While you are signed in, the top of each page shows your Google profile picture, which your browser loads from Google. An account without a Google picture shows your initials instead, as an image made by ui-avatars.com, an outside service: your browser sends it your initials to get that image.

Cookies and storage on your device

Cookies are small pieces of data a website keeps in your browser. Name.Baby sets its own cookies only on the sign-in and registration pages and while you are signed in; Google's services set theirs on most pages.

Cookies Name.Baby sets

  • auth_token keeps you signed in. It is set when you sign in and lasts 30 days.
  • nb_csrf protects the sign-in and registration forms against forged submissions. It is set on those pages and deleted when you close your browser.
  • nb_next and nb_fav remember the page you were on and the name you wanted to save, so that signing in takes you back and saves it. They last 10 minutes.

These cookies are sent only to Name.Baby, only over encrypted connections, and scripts on the page cannot read them. When you send the sign-in or registration form, your browser also keeps the name and email address you typed (never the password) in that tab until the next sign-in page opens or the tab is closed, so the form can be filled in again if it comes back with an error. That copy never leaves your device.

Cookies Google sets

  • Google Analytics sets _ga and _ga_CC339NR723 on every page.
  • Google AdSense sets __gads, __gpi and __eoi on pages with ads, may set cookies on Google's own domains such as doubleclick.net, and keeps some settings in your browser's local storage.
  • Google's consent messaging sets FCCDCF and FCNEC on pages with ads.
  • Sign in with Google sets g_state on the sign-in and registration pages, and g_csrf_token when you use the Google button.

Google decides what these cookies hold and how long they last; in our tests in Chrome, the Analytics, AdSense, consent and g_state cookies lasted between 6 and 13 months. Google describes them on How Google uses cookies.

You can block or delete cookies in your browser's settings. Reading the site works without cookies; signing in does not.

Google services on the site

These services are provided by Google LLC, which receives information directly from your browser and uses it under Google's Privacy Policy. Google explains how it uses information from sites like this one on How Google uses information from sites or apps that use our services.

  • Google Analytics (measurement ID G-CC339NR723) runs on every page and tells us how many people visit, which pages they read, which countries they visit from and what kinds of devices they use. It receives the address of each page you view (including any search you typed), the page that sent you here, your IP address and details about your browser and device. You can turn it off with Google's Analytics opt-out browser add-on.
  • Google AdSense (publisher ID ca-pub-5104878731229273) shows the ads on the site. Google, and other ad companies that Google works with, may use cookies to show you ads based on your earlier visits to this and other websites, and Google checks ad views and clicks for fraud. You can turn off personalized ads from Google in My Ad Center, and from many other ad companies at aboutads.info (U.S.) or youronlinechoices.eu (Europe). Google describes its ad cookies on How Google uses cookies in advertising.
  • Google's consent messaging (Funding Choices, from fundingchoicesmessages.google.com) loads together with the ads. Visitors in the European Economic Area, the United Kingdom and Switzerland see a consent message first, asking whether Google may use cookies and personal data for the ads; visitors in U.S. states with privacy laws get a "Do not sell or share my personal information" link (see We never sell your personal information). Your answer is stored in the FCCDCF and FCNEC cookies.
  • Google Identity Services ("Sign in with Google") loads only on the sign-in and registration pages. If you are signed in to Google, it may offer to sign you in with your Google account, and Google learns that you opened those pages. Google sends us your account details only when you choose to sign in with it.

Server logs

Like almost every website, our web server writes a line for each request it answers: your IP address, the date and time, the address requested (including anything you typed into the site search), the result, the page that linked you here and your browser's identification string (user agent). Errors are logged in the same way. We use these logs to keep the site working, to fix faults and to spot abuse. They are rotated every month and the last 12 monthly files are kept, so entries are deleted automatically after 12 to 13 months.

A second, server-wide copy of the request log, used to block attackers, is kept for about five weeks. For a few weeks at a time we may also log extra details that browsers send, such as their language setting, to tell real browsers from automated scrapers.

Security

Connections to Name.Baby are encrypted (HTTPS), and passwords and sign-in codes are stored only as hashes. When a sign-in with email and password fails, we log the IP address and the email address that was tried; these entries are kept on the same 12-to-13-month schedule as the server logs. After 10 failed sign-ins within 15 minutes from one IP address or for one email address, signing in is paused for up to 15 minutes.

Our server also blocks, for 7 days, IP addresses that scan it for security holes or pretend to be a search engine's crawler, using a tool called fail2ban, and keeps a record of past blocks for 30 days.

Where your data is kept

The site and its database run on a server we rent from OVHcloud in Oregon, in the United States. If you visit from another country, your information is sent to and stored in the United States. Google keeps what its services collect on its own servers, as its privacy policy describes.

How long we keep it

  • Your account and saved names: until you remove them or ask us to delete your account. Inactive accounts are not deleted automatically.
  • A name you remove from My names: deleted at once.
  • Sign-in codes: 30 days from when you sign in, or less if you sign out on that browser or your account is deleted. The auth_token cookie expires at the same time.
  • Server, error and failed sign-in logs: 12 to 13 months; the server-wide copy about five weeks.
  • Blocked IP addresses: 7 days, and the record of past blocks 30 days.
  • What Google collects: as set out in Google's own policies.

We never sell your personal information

We never sell or rent personal information, and we do not give your account details (your name, email address and saved names) to advertisers or to Google. Some U.S. state laws count personalized advertising as "selling" or "sharing" personal information even when no one is paid for it, so visitors from those states are offered a "Do not sell or share my personal information" link through Google's privacy messaging. Choosing it tells Google to restrict how it uses information from your visit, including for personalized ads.

Anyone can also turn off personalized ads in My Ad Center, use the opt-out pages above, or block third-party cookies in the browser.

Deleting your saved names or your account

You can remove a saved name yourself at any time: tap the heart on its page again, or press Remove next to it on My names. There is no button to delete the account itself. To delete it, write to info@name.baby and tell us the email address of the account. We delete the account, its saved names and its sign-in codes, and we answer account deletion requests within 30 days. Entries in the server logs are not edited; they are deleted on their normal schedule.

Names and birth counts are the SSA's public data, not information about you, so a request to remove a name from them goes to the SSA (see Where the name data comes from).

Children

Name.Baby is written for parents, parents-to-be and anyone curious about names. It is not directed at children, and we do not knowingly collect personal information from children under 13. If you believe a child has created an account, write to info@name.baby and we will delete it.

If you live outside the United States

Name.Baby's server is in the United States and its name data covers U.S. births, but anyone can use it. Depending on where you live, for example in the European Union, the United Kingdom or a U.S. state such as California, the law may give you rights over your personal information: to know what we hold about you and get a copy, to have it corrected or deleted, to object to or limit how it is used, and to complain to your data protection authority. To use any of these rights, write to info@name.baby.

Changes to this policy

When we change this policy, we will post the new version on this page and change the "Last updated" date at the top.

Contact

Questions about this policy or about your information: info@name.baby. Name.Baby is published by Matrix Data LLC.