Privacy Policy

This Privacy Policy describes how Penguinstones (the “Site”, “Penguinstones”, “we”, “us”, or “our”) collects, uses, and discloses your personal information when you visit or use https://penguinstones.com (the “Site”), submit a penguin stone, or otherwise communicate with us (collectively, the “Services”). For the purposes of this Privacy Policy, “you” and “your” mean you as a user of the Services, whether you are a website visitor, someone who submits a stone, or another individual whose information we have collected pursuant to this Privacy Policy.

Please read this Privacy Policy carefully. It explains what we do with your personal information and the rights you have over it. It is information for you, not an agreement you are asked to accept: where something we do relies on your consent, we will ask for that consent separately and you can withdraw it at any time.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Site, update the “Last updated” date, and take any other steps required by applicable law.

How We Collect and Use Your Personal Information

To provide the Services, we collect personal information about you from various sources, as set out below. The information that we collect and use varies depending on how you interact with us. In addition to the specific uses set out below, we may use information we collect about you to communicate with you, provide the Services, comply with any applicable legal obligations, enforce any relevant terms, and to protect or defend the Services, our rights, and the rights of our users or others.

What Personal Information We Collect

The types of personal information we obtain about you depend on how you interact with our Site and use our Services. When we use the term “personal information”, we refer to information that identifies, relates to, describes, or is associated with you.

Contact Forms. When you contact us through a form on our Site, we collect the information you provide (such as your name, email address, and message) solely for the purpose of responding to your inquiry and, where relevant, arranging a penguin stone. By submitting a contact form, you consent to our processing of your personal data in accordance with this Privacy Policy.

Stone Submissions. When you submit a penguin stone to be featured on the Site, we collect the information you choose to provide, which may include: photographs of the stone and its surroundings; the name and description of the location where the stone was placed; the geographic location of the stone (see “Location Data” below); a social media handle (for example, an Instagram username) for attribution; and any accompanying message or notes. Information you submit for a stone is published publicly on the Site, including on the stone’s page and on our map (see “Public Content” below).

Newsletter. If you sign up for our newsletter, we collect your email address and, if you give it, your first name. See “The Waddle With Us Newsletter” below.

Account. If you choose to open a Penguinstones account, we collect your email address, and whatever you add to it: your name, Instagram handle, nickname and picture. See “Penguinstones Accounts” below.

Location Data. As part of stone submissions, we collect and publish the geographic location where a stone was placed, including place names and precise GPS coordinates. Photos are resized in your browser before upload, which removes embedded metadata (EXIF data such as original GPS coordinates, date, and device). The location published for a stone comes from the pin you place on the map, not from hidden data in your photo file.

Precise geolocation may be considered sensitive personal information under some data protection laws. Because submitted locations and coordinates are displayed publicly on the Site, please only submit a location you are comfortable sharing with the world, and avoid submitting locations (such as a private home) that you do not wish to make public. If you would like a published location or photo removed, please contact us at [email protected].

People We Give Stones To. When we hand over penguin stones or a starter pack — in person, by post or at an event — we may note the recipient’s name and a way to reach them (such as an email address, a social media handle or a phone number) in our private stone inventory, so we know where each stone went and can arrange the handover. This is never published, and it is cleared automatically 12 months after the stones were given (see “Data Retention” below).

Information We Collect Automatically

We do not run any tracking pixels, web beacons, or third-party scripts on this Site, and the JavaScript libraries we use (such as the mapping library) are served from our own domain rather than an external network, so no third party learns of your visit merely because a page loaded. Our emails are a separate matter — see “Our emails” below.

What is collected automatically is the ordinary record any web server keeps. Our own web server logs every request it receives — your IP address, the date and time, the page requested, the response status and size, the address of the page that linked to it, your browser’s user-agent string, and how long the request took — and our content-delivery provider, Cloudflare, keeps its own logs. We use them to keep the Site available and secure and to investigate abuse and faults; we do not combine them with anything else or build any profile from them. Our own server’s log is deleted automatically after 14 days.

Beyond those provider logs, this Site itself stores nothing about a visit on which you only read pages — see “Cookies” and “What We Store When You Open a Form” below for the complete picture.

Information We Obtain from Third Parties

We may obtain information about you from the vendors and service providers who operate parts of the Site on our behalf — our hosting, content-delivery, anti-bot, email-delivery and analytics providers, each listed under “How We Disclose Personal Information” below. We do not buy personal data, and we do not receive information about you from social networks, advertising networks, or data brokers.

Any information we obtain from third parties will be treated in accordance with this Privacy Policy. We are not responsible or liable for the accuracy of information provided to us by third parties, nor for any third party’s policies or practices.

How We Use Your Personal Information

Providing the Services. We use your personal information to operate the Site, respond to your inquiries, arrange and feature penguin stones, publish stone pages and the map, and manage and improve the Services.

Emails to Contributors. Where you submit a stone, we use your email address to tell you when your stone, or a stone you re-hid, has been published; to reply if you contacted us; and to send you a short note when your contributions unlock a new badge on your profile. We never send a badge email for your first stone, and never more than once for the same badge. Submitting a stone never signs you up for our newsletter — that is a separate choice you make yourself (see “The Waddle With Us Newsletter”) — and we never sell your data. Every email we send you has a link to your email preferences, where you can stop badge emails or stop all emails from us. You can also ask us to stop emailing you, or to delete your details, at any time by contacting us.

Accounts. If you open one, we use what it holds to sign you in, to fill in the stone form for you, to let you manage your contributor profile, to show your name and your scores on the leaderboard (today’s, this week’s and all-time, and last week’s winner), and to keep your best scores on every device you sign in on. Because of it we email you the sign-in and confirmation codes you ask for, a note to your old address if the account moves to a new one, and a short note when we receive a stone from you, unless your phone tells you instead. If you turn notifications on for a phone, we use its push address to tell you about your stones.

Showing the Site in Slovak. The site is also available in Slovak. The stone stories that were on the Site in October 2026 have been machine-translated into Slovak, once, by Google’s Gemini API (see “How We Disclose Personal Information”). Only the text of each published story was sent, and nothing else — no stone number, name, email address or photo. The Slovak pages label each translation as machine-made and show the author’s original one tap away. Stories added or edited since are shown there as their authors wrote them.

Security and Fraud Prevention. We use your personal information to detect, investigate, and take action regarding possible fraudulent, illegal, or malicious activity, and to keep the Site secure.

Communicating with You. We use your personal information to respond to you and to improve the Services. It is in our legitimate interests to be responsive and to maintain the project.

Cookies

We keep cookies to the minimum. If you only read pages on this Site — browsing stones, the map, the country and contributor lists, or these policies — we set no cookies at all and store nothing about your visit. There is nothing to opt out of, because nothing has been set. If you have signed in to an account, your browser sends its sign-in cookie along with each page; it was set when you signed in, not by reading.

Three cookies exist, all strictly necessary, and this is the complete list:

The two form cookies are strictly necessary for a security feature of the forms themselves, so they do not require consent — and they are only ever set if you actually open one of those pages. The account cookie is strictly necessary for the account you asked for, so it does not require consent either — and it is only ever set if you sign in. We set no analytics, advertising or tracking cookies of any kind, so there is no cookie banner and no consent to give or withdraw.

You can set your browser to remove or reject cookies through its own controls. Blocking the two form cookies will prevent the submission forms from working, and blocking the account cookie will stop you staying signed in; there is nothing else to block.

What the Site Keeps on Your Device

Separately from cookies, the Site keeps things in your browser’s own storage so that it works offline out in the field. None of it is sent to us — it exists only on your device:

• Stones you save for offline, together with their photos and a few map tiles around each one.
• Pages you have looked at recently, kept automatically so the Site opens without a signal. This is normally the largest part.
• Your preferences — light or dark, and how you prefer lists to be shown.
• Stones you have marked as found, so the button remembers on that device. The count — and any country you chose to add — is stored by us; the marker is not.
• Your games — in Where’s Miško?, your guesses and points for the last two weeks and your day streak; in Miško’s Waddle, your best run and your best on the bonus level; and, once you have answered it, the fact that a game asked you “Did you like it?”, so you are not asked again that day. They let the games remember where you got to. Without an account we never receive any of that, and no score is sent anywhere. With one, the score of each game you finish — in Miško’s Waddle, of every run — is sent to us so that it can count on the leaderboard (see “Penguinstones Accounts”). Whether or not you have an account, a game sends us a count and that answer: that a game was started or finished, added to a total for the day, and your yes or no with the game and the puzzle. Neither carries anything about you or about how you did.
• A seasonal hunt — while a seasonal theme is on (Halloween, Christmas, Easter or New Year), which of the hidden pumpkins, presents, painted eggs or lucky clovers you have found, so your count carries on from page to page. It is never sent to us.
• The name, e-mail and Instagram handle you last submitted a stone with, so you do not have to type them again next time on that device. It is written only after a submission goes through, and the form shows whose details it filled in with a one-click “Not you? Clear it” next to them.

You can see exactly how much space this is using, item by item, and delete all of it in one click, on the Saved for offline page. Clearing your browser’s site data removes it too.

What We Store When You Open a Form

To protect the public forms and the “I found this stone” button from automated abuse we keep, for a short time and for that purpose only:

• a form session record holding a random identifier and the time you opened the form — it expires after 120 minutes of inactivity and expired records are deleted daily. It does not record your IP address or your browser.
• a short-lived count of submissions per IP address, held in a temporary cache for one hour, so that a single source cannot flood the Site. It is a counter, not a log: no history is kept.
• the anti-bot check itself is performed by Cloudflare Turnstile, which receives your IP address and browser signals at the moment you submit (see the list of service providers below).

Our hosting and content-delivery providers keep their own server logs, which by their nature include IP addresses; that is described under “Information We Collect Automatically”.

Marking a Stone as Found

Tapping “I found this stone” records one anonymous find: the stone, and the moment. We do not record who you are — no name, no account, no IP address and no device fingerprint is stored with it.

You may also, entirely optionally, say which country you found it in and add a town or place name, so the stone’s travels can be shown on its page. We never ask for your exact position and store no coordinates: only the country is displayed publicly, and it is attached to the stone, not to you. Leaving it blank changes nothing about the find being counted.

Some stones come with a small card carrying a QR code. If you opened the stone’s page by scanning it, the find is also marked “from a QR card”, so we can tell whether the cards are worth printing. That label is the same for every card and every finder and is attached to the find, not to you; nothing about your phone or your visit is kept with it. After a find you can also save or share an “I found” picture of the stone: it shows only what the stone’s page already shows, is the same picture for everyone, and making it records nothing.

Reporting a Stone as Lost

If you use the form to tell us a stone has gone missing, we store your report together with the IP address you sent it from. We keep it for one reason only: so that we can tell a genuine report apart from someone repeatedly filing false ones. It is never published, never shown on the Site, and never used to build any profile of you. The note you write is read by us and is not published either.

We forget the IP address automatically after 30 days, whether or not we have finished dealing with the report — a scheduled job clears it every day. The report itself is kept, because a stone going missing is part of that stone’s history, but from then on it is no longer linked to you in any way. You can ask us to delete a report you sent at any time using the contact address below.

The “Waddle With Us” Newsletter

What it is. Waddle With Us is Miško’s monthly email: new penguin stones, travel stories from Lifeguin and news from Stackguin. It is one newsletter shared by penguinstones.com, lifeguin.com and stackguin.com, which are run by the same person (see “Contact Us”), and it is sent from “Miško <[email protected]>”.

How you join. Only if you ask to. The sign-up box opens when you press “Sign me up”, never on its own, and nothing else on this Site signs you up — submitting a stone or requesting a starter pack does not. After you enter your email address we send you one email with a confirmation link, and you are added only when you click it (“double opt-in”). If you do not click it, you are not added.

What we keep. Your email address; your first name, if you give it; which of our sites and which page you signed up from (if that was the page a stone’s QR card opens, only that — never which stone); the language; which version of the sign-up wording you were shown; and the date and time you confirmed. This is held by our email provider, Brevo, in the European Union. It is never published, never sold, and used for nothing but the newsletter. We do not send your IP address to Brevo. Our own server logs the sign-up request like any other request (deleted after 14 days), and, to stop the form being misused to email someone over and over, it keeps a scrambled (hashed) form of your email address for one day to count the confirmation emails sent to it.

Opens and clicks. The newsletter is delivered by Brevo like the rest of our email, and is counted the same way — see “Our emails”.

Leaving. Every newsletter has an unsubscribe link at the bottom: one click and you get no more. You can also write to [email protected]. We send the newsletter because you consented to it (Article 6(1)(a) GDPR), and you can withdraw that consent at any time.

Penguinstones Accounts

What it is. An account is entirely optional: you can play the games, find stones and add stones to the map without one. An account adds a few things: your name on the game leaderboard, your best scores on every phone or computer you sign in on, a quicker stone form (it fills in your name, email address and Instagram handle), your stones and where each one stands, a note when we receive a stone from you, notifications on your phone if you want them, a bonus level in Miško’s Waddle while one of our seasonal themes is on, your public name and your own picture.

Signing in. There is no password. You type your email address and we email you a 6-digit code and a link, which work once, for 15 minutes: type the code on the page where you asked for it, or open the link on the device you want to sign in. The email is sent by our email provider, Brevo, as plain text. The first time, a new account asks you once to confirm that you are 16 or older, or that you are a parent or guardian setting the account up for your child. Signing in sets one cookie (see “Cookies”).

Face ID or fingerprint. If you like, you can add Face ID, a fingerprint or your device’s screen lock to your account (a “passkey”), and then sign in with one tap instead of a code. Your face or fingerprint never leaves your device and never reaches us. We keep the passkey’s public key — which can only check that your device said yes, and cannot sign in to anything by itself — with a name for the device it was added on (for example “iPhone”), when it was added and when it was last used. You can remove it on your account page at any time.

What we keep. Your email address; the name you are shown under on the leaderboard (see below); when you opened the account and answered the age question; when you last used it; for each game you finish while signed in, your score for that day — in Where’s Miško? your total for the day, in Miško’s Waddle your best run of the day, in stones and kilometres; for each device you are signed in on, a scrambled form of its sign-in key and when it was signed in and last used; any passkeys, as above; which kinds of notification you switched off; for each phone you turned notifications on for, the address of its push service and the keys messages to it are encrypted with, a device name and when it was turned on and last used; and, until you add your first stone, the name, Instagram handle, nickname and picture you chose for your account. We store no IP address, no device details and no location with any of it. Runs of the bonus level are not sent to us.

Your name and your picture. The name you give us is shown only to you — at the top of the Site and on your account page, instead of the made-up penguin name. It never appears on the leaderboard or anywhere public. A picture you upload before your first stone is kept privately: only your own signed-in browser can open it. With your first stone it becomes your contributor picture, which appears publicly only after we have checked it (see below). If you pick one of our penguins instead, we delete your picture.

Emails and notifications about your stones. With an account we also tell you each time we receive a stone or a re-hide from you, so you know it arrived: on your phone if you turned notifications on for that, otherwise with a short email. A phone with notifications on also tells you when a stone of yours is on the map, when a re-hide of yours is approved, and when someone taps “I found it” on one of your stones (at most once every few hours per stone). Notifications reach your phone through its own push service — Apple’s on an iPhone or a Mac, Google’s in Chrome and on Android, Mozilla’s in Firefox, Microsoft’s in Edge on Windows. Each message is encrypted for your phone, so the push service cannot read it; it does learn that a message went to that address, and when (see “International Transfers”). You can turn notifications off on your account page or in your phone’s settings at any time.

Your account page. It shows your stones and where each one stands (on the map, waiting for our check, or reported lost), and lets you change your details and picture; choose which notifications your phone gets; move the account to a new email address, confirmed with a code we send to that address — your contributor profile moves with it; download everything the account and your contributor profile hold, as a file; sign out on this device, or on every device at once; and delete the account.

Keeping your account yours. Moving the account to a new address, adding Face ID or a fingerprint, and deleting the account first ask you to confirm it is you — with Face ID or a fingerprint, or a code we email to the account’s address — unless you signed in a few minutes before. When the address changes, we email the old address to say so. If the new address already belongs to an account or a contributor profile, we do not send it a code: we send it a short note that someone asked and that nothing was changed, and the person asking is not told either way.

Your account and your contributor profile. If you have added stones with the same email address, your account is linked to your contributor profile automatically — the code or link we emailed proves the address is yours. From then on you manage your profile from the account page: your private name changes at once, and so does a penguin picture you pick from ours; a change to your public name, or a picture of your own, appears only after we have checked it. A picture of your own that we have already checked stays available, so you can switch back to it. Until we have checked it, a picture you upload is kept privately, never at a public address, and if we turn it down we delete it. We change your details ourselves only when you ask us to, or to take down something that breaks our rules.

Your public name. You have one public name, whether or not you have added a stone: the Instagram handle you give us or, without one, your nickname. It appears on the leaderboard — and on your stones and your contributor page, if you have any — once we have checked it; an Instagram handle or nickname that someone else on the Site already uses cannot be chosen. Without either, it is a name we make up for you from a friendly word, a kind of penguin and a number, for example “Chilly Gentoo 88” — on your stones too, instead of “Anonymous”. Changing or removing it also waits for our check. Your private name and your email address never appear.

Keeping it from being misused. The sign-in form is protected by Cloudflare Turnstile. To stop it being used to email someone over and over, we count the sign-in emails sent to an address for one day, holding the address only in scrambled form, and we count requests per IP address for up to one hour. A code stops working after 5 wrong tries, and we keep it only in a scrambled form that cannot be turned back into the code. Our server logs these requests like any other (deleted after 14 days).

Deleting it. “Delete my account” on your account page closes your account at once: every device is signed out, your scores leave the leaderboard, we stop sending you notifications, and we email you the date. 30 days later — or sooner, when we confirm it — we delete it for good. Until then you can sign in and keep it. Deleting removes your sign-in, your scores, every device’s sign-in key, your passkeys, your phones’ notification addresses, a private picture and any unused sign-in code or link. If your account is linked to a contributor profile, that profile is anonymised when the account is deleted: your name, email address, Instagram handle, nickname, description and picture are removed, and your stones stay on the map, credited to “Anonymous” and a number. If you would rather have your stones removed too, write to [email protected]. Copies in our backups are handled as described under “Data Retention”.

Accounts nobody uses. We forget them on our own: a sign-in code or link after one day, used or not — together with the email address it was sent to, which we keep that long even if nobody ever signs in with it (a backup taken that night keeps it as described under “Data Retention”) — an account that never answered the age question after one day, a sign-in on a device after 90 days without a visit, a score after 400 days, and the whole account after 2 years without use. A contributor profile linked to a forgotten account stays as it is — it existed before the account.

Why we may do this. You asked for the account, and we keep what it needs in order to provide it (Article 6(1)(b) GDPR). The account has nothing to do with our newsletter: opening one never signs you up.

Analytics and Tracking Technologies

We use Cloudflare Web Analytics, and it sets no cookies. It tells us how many people visit and which pages are read, so we can see what is worth improving. It stores nothing on your device — no cookie, no identifier in your browser’s storage, nothing to opt out of — and it does not follow you to other websites or build any profile of you. Because it stores nothing on your device and cannot identify you, it needs no consent and there is no banner to click.

Doing this loads one small script from static.cloudflareinsights.com and sends the page-view measurement to cloudflareinsights.com. Both are Cloudflare — already the provider that delivers this Site and stores its photos. Together with stats.lifeguin.com, our own statistics server described below, they are the only addresses outside penguinstones.com that this Site contacts while you read it, and contacting them means Cloudflare sees your IP address and browser type, exactly as it already does for every other request to this Site. Measurement is based on the page view itself rather than on recognising you, which is why there is nothing stored and nothing to withdraw.

We also count visits with Matomo, on our own server. Matomo is an open-source statistics tool. Ours runs on our own server in France (stats.lifeguin.com, the same OVH server as this Site), so this data never goes to another company. It is cookieless too. Before a visit is stored, your IP address is shortened (for example 213.34.51.91 becomes 213.34.0.0); an approximate place (country, region, city) is looked up from the IP address in the free DB-IP database kept on that server. Matomo records which pages are viewed and how fast they load, how visitors arrived (for example from a search engine or Pinterest), which links are clicked, and general device details such as browser, operating system and screen size. We keep the detailed visit records for 13 months and only the summary statistics after that, and we share them with no one. Visits by the Site’s own editors, while signed in to its admin, are not counted. Because it stores nothing on your device and does not identify you, it needs no consent — but you can still switch it off: open any page with ?lg-count=off added to its address (for example penguinstones.com/?lg-count=off) and this browser is no longer counted by Matomo; ?lg-count=on turns it back on. The choice is kept in your browser only and never sent to us.

There is no Google Analytics on this Site, no tag manager, no advertising pixel, and no third-party tracker beyond what is described above. Google Analytics was removed on 23 August 2026 and is not coming back.

Our emails. Every email we send — the notices about your stones, milestone emails and the newsletter alike — is delivered by Brevo, which adds a hidden one-pixel image and rewrites the links in them so that opens and clicks can be counted, and shows the pictures in them from its own servers. We have set Brevo not to track anyone individually without consent, and we never ask for it, so these are counted only as totals and are not linked to you. Blocking remote images in your email app stops the pixel and those pictures; the plain-text version of our emails has none of it.

Embedded Maps. Our Site displays an interactive map using Leaflet with map tiles from OpenStreetMap. When the map loads, the tile provider (OpenStreetMap) receives your IP address in accordance with its own privacy policy. We do not use Google Maps.

Legal Bases for Processing

We process your personal information only where we have a lawful basis to do so, in accordance with the General Data Protection Regulation (GDPR), including:

• Consent — for example, to publish a stone submission you send us, and to send you our newsletter if you sign up for it.
• Legitimate interests — for example, operating, improving, and securing the Site, preventing fraud, conducting analytics, and sending you a notification about your stone and a short email when you unlock a new badge (which you can switch off at any time from any of our emails), provided your data protection rights do not override those interests.
• Providing what you asked for — your Penguinstones account, if you open one, including your name and scores on the leaderboard (Article 6(1)(b) GDPR).
• Legal obligations — for example, complying with applicable legal requirements.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

• With vendors and service providers who perform services on our behalf, including hosting, cloud storage, content delivery, and analytics. These include OVHcloud (hosting — the server is in Gravelines, France, inside the EU; our own Matomo visit statistics run on it too), Cloudflare (content delivery, R2 object storage where our photos and media are stored and served and where encrypted backups of our database are kept, and the Turnstile anti-bot widget on our forms, which processes your IP address and browser signals, and Cloudflare Web Analytics, which counts page views without cookies), Brevo (email delivery — receives your email address to send stone notifications, badge emails, replies and, if you ask for one, the sign-in code for an account, and, if you sign up, keeps your newsletter subscription and sends you the newsletter), OpenStreetMap (map tiles and, via its Nominatim service, reverse-geocoding of submitted coordinates into place names), Google (whose Gemini API drafts suggested descriptions for stone pages from a place name, city and country — it never receives your photos, name, email address or any other personal information — and, once in October 2026, translated the published stone stories into Slovak: it received the text of each story and nothing else).
• With your phone’s push service (Apple, Google, Microsoft or Mozilla, depending on your phone and browser) — only if you turn on notifications in your account: it delivers our notifications to your phone. They are encrypted for your phone, so the push service cannot read them.
• When you direct, request, or otherwise consent to disclosure, such as when you submit a stone for public display.
• In connection with a business transaction, to comply with legal obligations (including responding to lawful requests from public authorities), to enforce any applicable terms, and to protect or defend the Services, our rights, and the rights of our users or others.

We never sell your personal information. Your name and email address are kept private — they are never published on the Site, displayed publicly, or shared with anyone except the service providers above who help us operate. Public attribution on a stone uses only the Instagram handle or nickname you choose to provide; if you provide neither, your submission is credited anonymously — or, if you have an account, under its made-up penguin name, the same name the leaderboard shows.

International Transfers

We keep your information in the European Union wherever we can. Our server is in Gravelines, France (OVHcloud); our photos and our database backups are stored in Cloudflare’s EU-jurisdiction storage; and our email provider, Brevo, is based in the EU.

Cloudflare, Inc. is based in the United States, and its network — which delivers this Site, runs the Turnstile anti-bot check on our forms and counts page views — can process your IP address and browser information outside the European Economic Area. That transfer is protected by the safeguards in Chapter V of the GDPR: the European Commission’s Standard Contractual Clauses, which form part of Cloudflare’s data processing agreement with us. You can ask us for a copy at [email protected].

The OpenStreetMap Foundation, which provides our map tiles and place-name look-ups, is based in the United Kingdom, which the European Commission recognises as providing an adequate level of data protection. Google, a US company, drafts suggested stone descriptions through its paid Gemini API from a place name, city and country only; for those drafts it receives no personal information from us. On that paid service, Google states that it does not use what it receives to improve its products. In October 2026 Google also translated the stone stories published on this Site into Slovak through its paid Gemini API. It received the text of each story — text that is already public on the Site — and nothing else: no name, email address or photo. Google processes what it receives through that paid service under its data processing terms, which include the European Commission’s Standard Contractual Clauses.

If you turn on notifications for a phone, each notification travels through that phone’s own push service — Apple, Google, Microsoft or Mozilla, depending on your phone and browser. Apple, Google and Microsoft are US companies, so a notification may be handled in the United States. That happens only because you turned notifications on, and you can turn them off at any time. The message is encrypted for your phone, so the push service cannot read it; it sees only that a message went to your phone’s address, and when.

Public Content

The Services allow you to submit penguin stones, including photos, locations, descriptions, and social media handles. If you choose to submit this content, it will be published publicly on the Site — including on the relevant stone page and on our map — and will be accessible to anyone, including search engines.

We cannot control who will access information you choose to make public, and we cannot ensure that parties who access it will respect your privacy or keep it secure. We are not responsible for the privacy or security of information you make publicly available, or for the accuracy, use, or misuse of any information you disclose. If you would like content you submitted removed, contact us at [email protected] and we will take reasonable steps to remove it from the Site.

If you open an account, your name on the leaderboard and your scores — for today, this week and all time, and as last week’s winner — are shown publicly: your public name — your Instagram handle or nickname, once we have checked it — otherwise a made-up penguin name. It is the same name your stones and your contributor page show. Your private name and email address are never shown.

Licence to Display Your Content

When you submit a stone, you keep full ownership of the photographs and other content you provide. By submitting, you grant Penguin Stones a non-exclusive, royalty-free, worldwide licence to host, store, resize, and publicly display that content on the Site and to promote the Site. This licence lasts only while your content remains published; you may withdraw it at any time by asking us to remove your submission at [email protected], and we will take reasonable steps to delete it promptly.

Data Retention — How Long We Keep Your Data

We retain personal information for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. In particular:

• Stone submissions (photos, locations, descriptions, attribution) are retained indefinitely while they remain published on the Site, until you ask us to delete them.
• Contact-form messages and email addresses are retained indefinitely, until you ask us to delete them.
• Badge email records — which badges we have emailed you about, so you never get the same one twice — are kept with your contributor record and deleted together with it.
• Your email preferences. If you stop some or all emails from us, we keep your email address on a do-not-email list so we can keep honouring that choice, including if you submit another stone later or ask us to delete your other details. Tell us if you want that removed too.
• Newsletter. You stay subscribed until you unsubscribe. When you do, Brevo keeps your email address on its do-not-email list so that you are not emailed again; tell us if you want it removed from that list too. If you never click the confirmation link, you are not added at all.
• Emails that could not be sent are kept for troubleshooting, with your address, for up to 30 days and then deleted automatically.
• Backups. We make an encrypted copy of our database every night and keep the most recent 7 — on our server and in our EU cloud storage — deleting older copies automatically. We also keep an offline copy of the database (encrypted) and of the photos published on the Site, used only to recover the Site after a disaster. That offline copy is not deleted automatically, so information you have asked us to delete can remain in it; it is never used for anything else.
• Server logs. Our own web server’s record of requests (see “Information We Collect Automatically”) is deleted automatically after 14 days.
• People we give stones to. The name and contact details we note when we give someone stones are cleared automatically 12 months after the stones were given, by a daily job. The record that the stones were given — when and how — is kept, without them.
• Form session records (see “What We Store When You Open a Form”) expire after 120 minutes of inactivity and expired records are deleted daily.
• Penguinstones accounts. Kept until you delete the account, or for 2 years after you last use it. A sign-in code or link is deleted after one day, as is an account that never answered the age question; a device’s sign-in key after 90 days without use; a passkey when you remove it; a phone’s notification address when you turn notifications off or its push service tells us it is no longer used; a private picture when you replace it; and a score after 400 days. A picture you upload is deleted if we turn it down. Deleting your account removes it at once and anonymises a linked contributor profile.
• Anti-abuse submission counters are held for one hour and then expire automatically. The newsletter and account sign-in counters of emails sent to an address hold that address only in scrambled (hashed) form, for one day.
• Lost-stone reports are kept as part of a stone’s history, but the reporter’s IP address is deleted automatically after 30 days by a daily job. You can ask us to delete a report at any time.
• Usage Data and analytics are retained in line with our analytics providers’ default retention settings (our own Matomo statistics keep the detailed visit records for 13 months, then only summary figures), and our providers’ server logs in line with their own retention periods.

You can ask us to delete your personal information at any time by contacting [email protected]. When personal information is no longer needed, we will delete it or anonymise it.

Your Rights

Depending on where you live, you may have some or all of the following rights in relation to your personal information:

• Access — to request a copy of the personal information we hold about you.
• Rectification — to request that inaccurate or incomplete information be corrected.
• Erasure — to request that we delete your personal information.
• Restriction — to request that we limit how we process your information.
• Portability — to receive your information in a portable format.
• Objection — to object to processing based on our legitimate interests.
• Withdraw consent — where we rely on consent, to withdraw it at any time (this does not affect processing already carried out).

If you have an account, you can see and correct your details, download a copy of everything it holds, and delete the account, yourself, at once, from the account page.

To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with your local data protection authority. In Slovakia, this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, dataprotection.gov.sk).

Third Party Websites and Links

Our Site may link to websites or online platforms operated by third parties, including social media platforms. If you follow links to sites we do not operate, you should review their privacy and security policies. We do not guarantee, and are not responsible for, the privacy or security of such sites. Our inclusion of such links does not imply endorsement.

Children’s Data

Children are welcome to hunt for and hide penguin stones together with a parent or guardian — that part of the project involves no data collection at all. However, submitting personal information through the Site (such as a name, email address, or social media handle, for example when registering a stone or contacting us) requires being at least 16 years old. If a child under 16 has found or hidden a stone, a parent or guardian should submit it on their behalf using their own details. We do not knowingly collect personal information from children under 16. If you are the parent or guardian of a child who has provided us with their personal information, contact us at [email protected] and we will take reasonable steps to delete it.

Accounts follow the same rule: an account is for people aged 16 or over, or set up by a parent or guardian for their child, using the parent’s own email address.

Contact Us

The data controller responsible for your personal information is Filip Ponik, Bratislava, Slovakia (operating the Penguin Stones project). If you have any questions about this Privacy Policy or how we handle your personal information, or if you wish to exercise any of your rights, please contact us at [email protected].