Privacy policy
In short: no adverts and no analytics. We process only what you give us yourself (your account if you create one, your finds and photos, a message, a comment, a flush report) and short-lived server logs. We do not sell your data or share it for marketing.
- Last updated:
Translation This English text is a translation; in case of doubt the Polish version prevails: Polityka prywatności.
Data controller
The controller of the personal data processed on Grzybolog (grzybolog.pl) is [NAZWA WYDAWCY], [ADRES]. For anything to do with personal data, write to kontakt@grzybolog.pl. This policy describes the processing in line with Regulation (EU) 2016/679 of the European Parliament and of the Council (the General Data Protection Regulation, GDPR; in Polish: RODO).
Server and logs
The website runs on a VPS from Contabo GmbH in the European Union (Germany). The application runs in a Docker container behind an nginx server. Like almost every web server, it keeps technical logs: IP address, browser information (user agent), the address of the page visited and the time of the visit. We use them only to keep the website secure and to detect faults, and we keep them for up to 14 days. Contabo processes these data on our behalf as a processor.
Contact form
When you send a message through the contact form, we receive your name, email address, topic and the text of your message. The message is delivered by email (through an SMTP server) to the editorial mailbox. We use these data only to reply, and keep them for as long as the correspondence requires, for a maximum of 2 years. You can also write directly to kontakt@grzybolog.pl.
Comments on the guides
You can leave a comment under the articles in our guides (Poradnik, in Polish only). We store the name or signature you give and the text of the comment in our database; the comment appears after moderation. To limit spam we also store a one-way hash of your IP address, from which the address itself cannot be read. We never publish IP addresses. We will delete a comment at your request.
Flush reports
On the mushroom forecast page you can report a flush: the district, a species from the list, the date, the amount and an optional note. We do not ask for your name or email. Together with the report we store a one-way SHA-256 hash of your IP address (with a secret salt added), which is used only to limit the number of reports from one address within 24 hours; the IP address cannot be recovered from this hash. Publicly we show only aggregated data: the number of reports, the species, the district and the date. We never publish the note. Do not put personal data in it.
Forager account and finds
If you create an account, we process: your name (shown publicly), your email address (we do not publish it), a hash of your password (scrypt algorithm; we never know the password itself), optionally your voivodeship (province), the dates your account was created and last active, and a one-way hash of your IP address at the time of registration (to limit the number of accounts created from one address). To keep you signed in we use a session cookie (see the cookie policy).
When you add a find, we store the photo, the species, the date and, optionally, the district, measurements, number of specimens and a note. We remove all metadata from photos, including GPS coordinates: the photo is re-encoded on the server before it is saved. Publicly we show the photo, species, date, measurements, note and the location at the level of detail you choose (voivodeship, district or nothing). Comments and congratulations are visible publicly together with your name. Your public profile shows your name, level, points, badges, species collection and finds.
We keep your account data until you delete the account. You can delete your account at any time in the account settings: we then delete the account data and all your finds, photos, comments, congratulations and badges. Database backups are overwritten after 14 days. The legal basis is the performance of the service you ask for (Art. 6(1)(b) GDPR) and, for security and moderation, our legitimate interest (Art. 6(1)(f) GDPR). You must be at least 16 years old to create an account.
What your browser stores
We save a few settings in your browser’s local storage (localStorage) so that the website remembers them. These are not cookies and are not sent to our server. The full list is in the cookie policy:
- light or dark theme,
- accessibility settings, such as text size,
- chapters of a guide series you have read,
- the name you gave with a comment, so you do not have to type it again,
- your consent choice, but only if we switch on analytics.
The editorial panel (Studio) sets a session cookie only for the administrator after signing in.
Analytics and adverts
At present the website does not use any analytics tools or adverts. The site code is prepared for Google Tag Manager and Google Analytics 4 in Consent Mode v2, but this feature is switched off. If we switch it on, visitors from the European Economic Area, the United Kingdom and Switzerland will first see a consent banner, and analytics cookies will be stored only after consent is given. Before switching it on, we will update this policy and the cookie policy.
Data and content from third parties
- Weather: we calculate the forecast on our server from Open-Meteo data (CC BY 4.0 licence), downloaded for fixed coordinates of each district. Your data and location are not sent to Open-Meteo.
- Photos: species photos come from Wikimedia Commons (the licence is given with each photo) and landscape photos from Pexels. We serve them all from our own server, so your browser does not connect to those services.
- Fonts are hosted locally, without Google Fonts.
- Boundaries on the map come from the national register of boundaries (PRG, GUGiK).
Affiliate links
At present there are no active affiliate links on the website. If we add links to Amazon.pl, once you go to the shop, Amazon applies its own privacy and cookie policy. Details are on the affiliate links page.
Legal bases
- Art. 6(1)(f) GDPR (legitimate interest): replying to messages, moderating comments and reports, protection against spam and the security of the website.
- Art. 6(1)(a) GDPR (consent): analytics, if it is switched on. You can withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
Recipients of data
Data may go only to providers that run the website on our behalf: the hosting company Contabo GmbH (Germany), whose servers in the EU run both the website and our own mail server, through which messages from the form pass. No outside email provider is involved. We do not sell data or share it for marketing.
Your rights
You have the right to:
- access your data and receive a copy of it,
- have your data corrected,
- have your data erased,
- restrict processing,
- object to processing based on legitimate interest,
- data portability,
- lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), the Polish supervisory authority.
To exercise these rights, write to kontakt@grzybolog.pl. We will reply without undue delay and within one month at the latest. Providing data is voluntary, but without an email address we cannot reply to your message. We do not make automated decisions and do not profile users.
Changes to this policy
When the way we process data changes (for example after analytics is switched on), we will update this page. The date of the last change is shown at the top.