Privacy Policy
Wishing Stone Cairn (the "Service") is designed to work without sign-up, so we collect only what we need. Below is what we collect, why, and for how long.
1. What we collect and why
| Information | When | Why |
|---|---|---|
| Stone names, wishes, comments | When you place a stone or comment | To display them on the cairn. They are visible to all users. |
Browser identification cookie (dt_sid) | Automatically on first visit | To recognise your stones without login (up to 400 days) |
| ID and PIN (stored hashed) | If you sign up (optional) | To let you use your stones on other devices |
| IP address | When placing stones, gifting, reporting or commenting | Daily limits, preventing spam and abuse, usage statistics |
| Report reasons | When you report a stone or comment | Reviewing reports and hiding content |
Analytics cookies (_ga etc.), device and browser type, pages viewed, buttons clicked | Automatically while you browse (Google Analytics) | Understanding which features are used and how visitors find us, to improve the Service. Not used to identify individuals. |
| Advertising cookies and identifiers | Automatically on pages that show ads (Google AdSense) | Showing ads, limiting how often the same ad appears, and measuring ad performance. The operator does not use this to identify individuals. |
| ID and PIN of a gift stone's recipient | When you make a gift stone | Creating a login for the recipient and letting the giver look it up again |
We do not collect names, phone numbers or email addresses. Please don't write them in wishes or comments; the operator may hide them if found.
2. Information shared with third parties
- Google Gemini API: to write encouraging comments on new stones, the stone name and wish are sent to Google's generative AI service. IP addresses and IDs are not sent. Google processes this under the Gemini API Terms.
- Google Fonts: loading fonts sends your IP address to Google.
- Google Analytics (via Google Tag Manager): for visitor statistics, your IP address (partly removed by Google on collection), device and browser type, pages viewed, buttons clicked and referral source are sent to Google and analytics cookies are stored. Wishes, stone names and IDs are not sent. You can block this with your browser's cookie settings or the Google Analytics opt-out add-on.
- Google AdSense (advertising): this site shows Google AdSense ads.
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
- You may opt out of personalised advertising in Google Ads Settings, and opt out of third-party vendors' cookies for personalised advertising at www.aboutads.info.
- See How Google uses information from sites that use its services.
- Visitors from the European Economic Area, the UK and Switzerland are asked for consent before advertising cookies are used.
- Wishes, stone names and IDs are never sent to advertisers.
- We do not sell or hand over any other information, except when required by law.
3. How long we keep it
- Stones and comments: while the Service operates. Removed stones and deleted comments disappear from view and are kept marked as deleted; we erase them completely on request.
- IP addresses: those used for daily limits are no longer used after that day; IPs attached to stones or comments and usage logs are kept with the stone.
- Login sessions: 400 days after your last visit.
- Analytics: data in Google Analytics follows its retention setting (up to 14 months); analytics cookies last up to 2 years after your last visit.
- Advertising cookies: governed by Google's and third-party vendors' settings; you can delete or disable them at any time using the links above.
- Backups: once a day. On-server copies are kept for 14 days and off-server copies (Google Cloud Storage) for 60 days, then deleted automatically.
4. Deleting your data and your rights
- Remove your own stone via My stones → Remove this stone, and delete your comments with the delete button next to them.
- Send requests for account deletion, permanent erasure or access to your data to the contact above. We respond within 10 days.
- Stones placed without login can't be found again once you clear your browser cookies, and the operator can't restore them.
5. Children under 14
Children under 14 need the consent of a parent or legal guardian to sign up. Accounts found to have been created without consent will be deleted.
6. Security
PINs are stored with a one-way hash, and only the operator has server access. The PIN of a gift-stone account is kept so the giver can look it up again; recipients can ask the operator to change it after logging in.
7. Changes
If this policy changes, we will post the new version on this page with its effective date.