Privacy Policy

This Privacy Policy explains how StoneWalker collects, uses, and protects your personal data. We process personal data in accordance with the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller responsible for data processing on this website is:
OM Intelligence GmbH (UID -401.251.021)
Schaufelberger Str, 8055 Zürich, Switzerland
Email Address: mail [at] stonewalker [dot] org

2. What data we collect

  • Account data: username, first and last name, email address, and password (stored only as a salted hash).
  • Profile data: an optional profile picture and optional links to your social media accounts.
  • Stone & location data: the stones you create, the photos you upload, and the geographic coordinates (latitude/longitude) where stones are found or placed. This location data is shown publicly on the map.
  • Technical log data: when a stone is scanned, we record your IP address and browser user-agent to enforce a one-week scan limit and to protect against abuse.
  • Payment data: if you buy a QR pack or a premium subscription, payment is handled by Stripe. We store only a payment reference, not your card details.

3. Why we process it and on what legal basis

  • To provide the service (create an account, manage stones, display the map) — performance of our agreement with you.
  • To send service emails (account activation, password reset, scan/move notifications) — performance of the agreement and your consent to notifications.
  • To keep the service secure (scan-limit enforcement, abuse prevention via IP/user-agent logging) — our legitimate interest.
  • To process payments — performance of the agreement and our legal obligations.

4. Cookies

We use only strictly necessary, first-party cookies: a session cookie to keep you logged in, a CSRF token for security, a cookie that remembers your chosen language, and a short-lived cookie for status messages. We do not use any analytics, advertising, or tracking cookies, which is why no cookie consent banner is shown.

5. Service providers and third parties

We share data with the following processors only as needed to run the service:

  • Stripe — payment processing.
  • Maileroo — sending transactional emails.
  • Google Fonts — web fonts (your IP is transmitted to Google when fonts load).
  • Stadia Maps — map tiles (watercolor and street maps, based on OpenStreetMap data); your IP is transmitted when the map loads.
  • unpkg (CDN) — map and QR-scanner libraries.
  • GeoJS — approximate location from your IP address, used only to centre the map near you on load.
  • Discourse — our community forum, if you choose to use it.

Some of these providers are based outside Switzerland and the EU (e.g. in the United States). Where data is transferred internationally, it is protected by appropriate safeguards such as the providers' standard contractual clauses.

6. How long we keep your data

We keep your account and stone data for as long as your account exists. Scan log data (IP address and user-agent) is retained only as long as needed for scan-limit enforcement and abuse prevention, and is then deleted or anonymised. If you delete your account, we delete or anonymise your personal data, except where we are legally required to retain certain records (for example, payment records).

7. Your rights

You have the right to access the personal data we hold about you, to have inaccurate data corrected, to have your data deleted, to restrict or object to processing, and to receive your data in a portable format. To exercise any of these rights, or to delete your account, contact us at mail [at] stonewalker [dot] org. You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or your local supervisory authority.

8. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on this page.