Privacy Policy

This Privacy Policy describes how Penguin Stones (the “Site”, “Penguin Stones”, “we”, “us”, or “our”) collects, uses, and discloses your personal information when you visit or use https://penguinstones.com (the “Site”), submit a penguin stone, or otherwise communicate with us (collectively, the “Services”). For the purposes of this Privacy Policy, “you” and “your” mean you as a user of the Services, whether you are a website visitor, someone who submits a stone, or another individual whose information we have collected pursuant to this Privacy Policy.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you agree to the collection, use, and disclosure of your information as described in this Privacy Policy. By submitting a stone or sending us a request, you confirm that you have read and agree to this Privacy Policy. If you do not agree to this Privacy Policy, please do not use or access any of the Services.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on the Site, update the “Last updated” date, and take any other steps required by applicable law.

How We Collect and Use Your Personal Information

To provide the Services, we collect personal information about you from various sources, as set out below. The information that we collect and use varies depending on how you interact with us. In addition to the specific uses set out below, we may use information we collect about you to communicate with you, provide the Services, comply with any applicable legal obligations, enforce any relevant terms, and to protect or defend the Services, our rights, and the rights of our users or others.

What Personal Information We Collect

The types of personal information we obtain about you depend on how you interact with our Site and use our Services. When we use the term “personal information”, we refer to information that identifies, relates to, describes, or is associated with you.

Contact Forms. When you contact us through a form on our Site, we collect the information you provide (such as your name, email address, and message) solely for the purpose of responding to your inquiry and, where relevant, arranging a penguin stone. By submitting a contact form, you consent to our processing of your personal data in accordance with this Privacy Policy.

Stone Submissions. When you submit a penguin stone to be featured on the Site, we collect the information you choose to provide, which may include: photographs of the stone and its surroundings; the name and description of the location where the stone was placed; the geographic location of the stone (see “Location Data” below); a social media handle (for example, an Instagram username) for attribution; and any accompanying message or notes. Information you submit for a stone is published publicly on the Site, including on the stone’s page and on our map (see “Public Content” below).

Location Data. As part of stone submissions, we collect and publish the geographic location where a stone was placed, including place names and precise GPS coordinates. Photos are resized in your browser before upload, which removes embedded metadata (EXIF data such as original GPS coordinates, date, and device). The location published for a stone comes from the pin you place on the map, not from hidden data in your photo file.

Precise geolocation may be considered sensitive personal information under some data protection laws. Because submitted locations and coordinates are displayed publicly on the Site, please only submit a location you are comfortable sharing with the world, and avoid submitting locations (such as a private home) that you do not wish to make public. If you would like a published location or photo removed, please contact us at [email protected].

Information We Collect Automatically

We do not run any tracking pixels, web beacons, or third-party scripts on this Site, and the JavaScript libraries we use (such as the mapping library) are served from our own domain rather than an external network, so no third party learns of your visit merely because a page loaded.

What is collected automatically is the ordinary record any web server keeps. Our hosting and content-delivery providers (see the list of service providers below) log requests to the Site, and those logs include your IP address, the page requested, the time, and your browser’s user-agent string. We use them to keep the Site available and secure and to investigate abuse.

Beyond those provider logs, this Site itself stores nothing about a visit on which you only read pages — see “Cookies” and “What We Store When You Open a Form” below for the complete picture.

Information We Obtain from Third Parties

We may obtain information about you from the vendors and service providers who operate parts of the Site on our behalf — our hosting, content-delivery, anti-bot, email-delivery and analytics providers, each listed under “How We Disclose Personal Information” below. We do not buy personal data, and we do not receive information about you from social networks, advertising networks, or data brokers.

Any information we obtain from third parties will be treated in accordance with this Privacy Policy. We are not responsible or liable for the accuracy of information provided to us by third parties, nor for any third party’s policies or practices.

How We Use Your Personal Information

Providing the Services. We use your personal information to operate the Site, respond to your inquiries, arrange and feature penguin stones, publish stone pages and the map, and manage and improve the Services.

Stone Notifications. Where you submit a stone, we use your email address solely to notify you when your stone has been placed or published, and to reply if you contacted us. These are service-related messages about your submission — we do not send marketing, newsletters, or promotional emails, and we never sell your data. You can ask us to stop emailing you or to delete your details at any time by contacting us.

Security and Fraud Prevention. We use your personal information to detect, investigate, and take action regarding possible fraudulent, illegal, or malicious activity, and to keep the Site secure.

Communicating with You. We use your personal information to respond to you and to improve the Services. It is in our legitimate interests to be responsive and to maintain the project.

Cookies

We keep cookies to the minimum. If you only read pages on this Site — browsing stones, the map, the country and contributor lists, or these policies — we set no cookies at all and store nothing about your visit. There is nothing to opt out of, because nothing has been set.

Two cookies exist, both strictly necessary, and this is the complete list:

Both are strictly necessary for a security feature of the forms themselves, so they do not require consent — and they are only ever set if you actually open one of those pages. We set no analytics, advertising or tracking cookies of any kind, so there is no cookie banner and no consent to give or withdraw.

You can set your browser to remove or reject cookies through its own controls. Blocking these two will prevent the submission forms from working; there is nothing else to block.

What the Site Keeps on Your Device

Separately from cookies, the Site keeps things in your browser’s own storage so that it works offline out in the field. None of it is sent to us — it exists only on your device:

• Stones you save for offline, together with their photos and a few map tiles around each one.
• Pages you have looked at recently, kept automatically so the Site opens without a signal. This is normally the largest part.
• Your preferences — light or dark, and how you prefer lists to be shown.
• Stones you have marked as found, so the button remembers on that device. The count — and any country you chose to add — is stored by us; the marker is not.
• The name, e-mail and Instagram handle you last submitted a stone with, so you do not have to type them again next time on that device. It is written only after a submission goes through, and the form shows whose details it filled in with a one-click “Not you? Clear it” next to them.

You can see exactly how much space this is using, item by item, and delete all of it in one click, on the Saved for offline page. Clearing your browser’s site data removes it too.

What We Store When You Open a Form

To protect the public forms and the “I found this stone” button from automated abuse we keep, for a short time and for that purpose only:

• a form session record holding a random identifier and the time you opened the form — it expires after 120 minutes of inactivity and expired records are deleted daily. It does not record your IP address or your browser.
• a short-lived count of submissions per IP address, held in a temporary cache for one hour, so that a single source cannot flood the Site. It is a counter, not a log: no history is kept.
• the anti-bot check itself is performed by Cloudflare Turnstile, which receives your IP address and browser signals at the moment you submit (see the list of service providers below).

Our hosting and content-delivery providers keep their own server logs, which by their nature include IP addresses; that is described under “Information We Collect Automatically”.

Marking a Stone as Found

Tapping “I found this stone” records one anonymous find: the stone, and the moment. We do not record who you are — no name, no account, no IP address and no device fingerprint is stored with it.

You may also, entirely optionally, say which country you found it in and add a town or place name, so the stone’s travels can be shown on its page. We never ask for your exact position and store no coordinates: only the country is displayed publicly, and it is attached to the stone, not to you. Leaving it blank changes nothing about the find being counted.

Reporting a Stone as Lost

If you use the form to tell us a stone has gone missing, we store your report together with the IP address you sent it from. We keep it for one reason only: so that we can tell a genuine report apart from someone repeatedly filing false ones. It is never published, never shown on the Site, and never used to build any profile of you. The note you write is read by us and is not published either.

We forget the IP address automatically after 30 days, whether or not we have finished dealing with the report — a scheduled job clears it every day. The report itself is kept, because a stone going missing is part of that stone’s history, but from then on it is no longer linked to you in any way. You can ask us to delete a report you sent at any time using the contact address below.

Analytics and Tracking Technologies

We use Cloudflare Web Analytics, and it sets no cookies. It tells us how many people visit and which pages are read, so we can see what is worth improving. It stores nothing on your device — no cookie, no identifier in your browser’s storage, nothing to opt out of — and it does not follow you to other websites or build any profile of you. Because it stores nothing on your device and cannot identify you, it needs no consent and there is no banner to click.

Doing this loads one small script from static.cloudflareinsights.com and sends the page-view measurement to cloudflareinsights.com. Both are Cloudflare — already the provider that delivers this Site and stores its photos. They are the only addresses outside penguinstones.com that this Site contacts while you read it, and contacting them means Cloudflare sees your IP address and browser type, exactly as it already does for every other request to this Site. Measurement is based on the page view itself rather than on recognising you, which is why there is nothing stored and nothing to withdraw.

There is no Google Analytics on this Site, no tag manager, no advertising pixel, and no third-party tracker beyond the one script described above. Google Analytics was removed on 23 August 2026 and is not coming back.

Embedded Maps. Our Site displays an interactive map using Leaflet with map tiles from OpenStreetMap. When the map loads, the tile provider (OpenStreetMap) receives your IP address in accordance with its own privacy policy. We do not use Google Maps.

Legal Bases for Processing

We process your personal information only where we have a lawful basis to do so, in accordance with the General Data Protection Regulation (GDPR), including:

• Consent — for example, to publish a stone submission you send us.
• Legitimate interests — for example, operating, improving, and securing the Site, preventing fraud, conducting analytics, and sending you a notification about your stone, provided your data protection rights do not override those interests.
• Legal obligations — for example, complying with applicable legal requirements.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances may include:

• With vendors and service providers who perform services on our behalf, including hosting, cloud storage, content delivery, and analytics. These include OVHcloud (hosting — the server is in Gravelines, France, inside the EU), Cloudflare (content delivery, R2 object storage where our photos and media are stored and served, and the Turnstile anti-bot widget on our forms, which processes your IP address and browser signals, and Cloudflare Web Analytics, which counts page views without cookies), Brevo (email delivery — receives your email address to send submission notifications and replies), OpenStreetMap (map tiles and, via its Nominatim service, reverse-geocoding of submitted coordinates into place names), Anthropic (which drafts suggested descriptions for stone pages from a place name, city and country — it never receives your photos, name, email address or any other personal information).
• When you direct, request, or otherwise consent to disclosure, such as when you submit a stone for public display.
• In connection with a business transaction, to comply with legal obligations (including responding to lawful requests from public authorities), to enforce any applicable terms, and to protect or defend the Services, our rights, and the rights of our users or others.

We never sell your personal information. Your name and email address are kept private — they are never published on the Site, displayed publicly, or shared with anyone except the service providers above who help us operate. Public attribution on a stone uses only the Instagram handle or nickname you choose to provide; if you provide neither, your submission is credited anonymously.

Public Content

The Services allow you to submit penguin stones, including photos, locations, descriptions, and social media handles. If you choose to submit this content, it will be published publicly on the Site — including on the relevant stone page and on our map — and will be accessible to anyone, including search engines.

We cannot control who will access information you choose to make public, and we cannot ensure that parties who access it will respect your privacy or keep it secure. We are not responsible for the privacy or security of information you make publicly available, or for the accuracy, use, or misuse of any information you disclose. If you would like content you submitted removed, contact us at [email protected] and we will take reasonable steps to remove it from the Site.

Licence to Display Your Content

When you submit a stone, you keep full ownership of the photographs and other content you provide. By submitting, you grant Penguin Stones a non-exclusive, royalty-free, worldwide licence to host, store, resize, and publicly display that content on the Site and to promote the Site. This licence lasts only while your content remains published; you may withdraw it at any time by asking us to remove your submission at [email protected], and we will take reasonable steps to delete it promptly.

Data Retention

We retain personal information for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. In particular:

• Stone submissions (photos, locations, descriptions, attribution) are retained indefinitely while they remain published on the Site, until you ask us to delete them.
• Contact-form messages and email addresses are retained indefinitely, until you ask us to delete them.
• Form session records (see “What We Store When You Open a Form”) expire after 120 minutes of inactivity and expired records are deleted daily.
• Anti-abuse submission counters are held for one hour and then expire automatically.
• Lost-stone reports are kept as part of a stone’s history, but the reporter’s IP address is deleted automatically after 30 days by a daily job. You can ask us to delete a report at any time.
• Usage Data and analytics are retained in line with our analytics providers’ default retention settings, and our providers’ server logs in line with their own retention periods.

You can ask us to delete your personal information at any time by contacting [email protected]. When personal information is no longer needed, we will delete it or anonymise it.

Your Rights

Depending on where you live, you may have some or all of the following rights in relation to your personal information:

• Access — to request a copy of the personal information we hold about you.
• Rectification — to request that inaccurate or incomplete information be corrected.
• Erasure — to request that we delete your personal information.
• Restriction — to request that we limit how we process your information.
• Portability — to receive your information in a portable format.
• Objection — to object to processing based on our legitimate interests.
• Withdraw consent — where we rely on consent, to withdraw it at any time (this does not affect processing already carried out).

To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with your local data protection authority. In Slovakia, this is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky, dataprotection.gov.sk).

Third Party Websites and Links

Our Site may link to websites or online platforms operated by third parties, including social media platforms. If you follow links to sites we do not operate, you should review their privacy and security policies. We do not guarantee, and are not responsible for, the privacy or security of such sites. Our inclusion of such links does not imply endorsement.

Children’s Data

Children are welcome to hunt for and hide penguin stones together with a parent or guardian — that part of the project involves no data collection at all. However, submitting personal information through the Site (such as a name, email address, or social media handle, for example when registering a stone or contacting us) requires being at least 16 years old. If a child under 16 has found or hidden a stone, a parent or guardian should submit it on their behalf using their own details. We do not knowingly collect personal information from children under 16. If you are the parent or guardian of a child who has provided us with their personal information, contact us at [email protected] and we will take reasonable steps to delete it.

Contact Us

The data controller responsible for your personal information is Filip Ponik, Bratislava, Slovakia (operating the Penguin Stones project). If you have any questions about this Privacy Policy or how we handle your personal information, or if you wish to exercise any of your rights, please contact us at [email protected].