Privacy & photo notes

Your cleanup, rock passport and diary are separate choices. Passports and approved diary entries are public only with explicit submission consent. Secret links manage a rock or an author's entry without a personal account; never put those links in public posts. You can still log a cleanup without a rock or public photograph.

Manual cleanup reports

When you save a cleanup, its item counts, cleanup date, time zone and any optional alias, city, country or measured weight are stored in Cloudflare D1. Public progress shows aggregate totals, not your individual manual report. Keep your private management link to correct or delete the report. Manual reports have no automatic expiration configured; deleting a report removes its contribution from public totals and revokes private access, while a restricted deletion/audit record can remain. Cloudflare Turnstile checks submissions for abuse. Rate-limit records use a secret-keyed IP hash rather than storing your raw IP address in the application database.

Your account and your rocks

Firebase Authentication (Google) handles email/password and Google sign-in. Your password is not sent to or stored by Traveling Rock. Firebase manages sign-in persistence on your device; sign out on a shared device. Your account email, display name and Firebase user ID are private profile data used to manage your rocks in Cloudflare D1, not public passport information. A public rock link never grants editing access. Existing rock creators can link a passport using its private management credential; knowing a rock's name is not proof of ownership. Cleanup logging and adding moderated travel stories remain available without creating an account. Contact us to request account-data deletion or help with verified ownership recovery.

Rock passports and travel diaries

A rock's name, introduction, launch date and optional town/country are public when its creator consents. Diary text, dates, people mentioned and approximate places become public only after publication consent and moderation. Use aliases and only include people with permission; do not post addresses, contact details or sensitive personal information. Rock and diary records are stored in Cloudflare D1 and do not have automatic text expiration configured. Private links let a creator or author edit, remove or revoke access. A restricted deletion/audit record can remain after removal. Deleting a rock hides its diary, not unrelated cleanup reports. A journey entry never adds litter items or cleanups to public totals. Optional photos require separate storage and publication consent, and become public only after the rock's creator or a site moderator approves the diary entry. Photo access expires after 365 days and physical deletion is queued, including photos displayed on published profiles or diaries. Diary photos are never sent to litter-recognition AI.

Local rock-picture lookup

Your chosen photo stays on your device: it is not uploaded, stored by the site or sent to server AI. Only after your first explicit search with usable public pictures, this browser downloads a visual-feature model (approximately 5.35 MB) plus lazy-loaded comparison code from this website. Searches download only current, consented public reference pictures and compare 512-dimensional visual features locally, without sending cookies with reference-picture requests. Results are possible matches, not an identity confirmation. The rock’s QR code or public passport link remains the reliable fallback.

Optional, consent-based site analytics

Optional first-party analytics is off until you allow it. It records allowlisted public-page categories and fixed action names, not form contents, photos, names, email addresses, account details, private links, rock IDs or full URLs. A temporary random browser-tab session is counted separately each UTC day; it is not a unique-person identifier and is not used across sites. Reports include broad referral/campaign source categories (not raw UTM values or full referrers), coarse device/browser categories and approximate country from the network provider, not GPS. No advertising cookies or cross-site tracking are used. Reports cover up to 30 days. Older records are removed in limited batches when collection or reports run; inactive sites or backlogs can delay physical deletion. Your preference is saved locally for up to 180 days and can be changed in Analytics preferences in the footer; declining does not affect participation. Withdrawing consent stops future collection, but does not erase events already received. Browser privacy signals are respected. Private, account and owner pages have no page-view or ordinary action tracking; development pages are excluded entirely. The sole account-flow exception is one anonymous signup-completion event after successful new email registration or a genuinely new Google signup, only with active opt-in. It uses the fixed signup purpose marker, a separate one-use random session and no URL-derived attribution, never the actual account path, URL, account identifier, email, token or form contents. It does not add a traffic visitor or session. Sign-in, linking and failed attempts are not counted. Expiry, withdrawal, Global Privacy Control and Do Not Track disable this event too. Opt-in client events can be blocked, missed or spoofed, so reports are approximate, not audited participation or payment records. Donation events count clicks to the donation page only, never payments.

Private photos and public stories

Photos are optional and are stored in private R2 storage only after per-upload storage consent. Counting, story and rock-diary photos — including a photo displayed on a published story or rock profile — expire and are deleted after 365 days. Images stay private unless their creator gives separate public-sharing permission and a site moderator approves publication. Never upload other people’s faces, children or personal details without permission. Precise coordinates and EXIF metadata are removed before storage and public display.

Photo suggestions

Photo suggestions are optional. A counting photo is sent to the configured AI provider only after you choose the separate AI-processing checkbox and explicitly ask for suggestions. Suggestions never count automatically; check and edit the manual counts before saving. Story and diary photos are never used for litter recognition. Provider training, retention and deletion practices follow the provider’s own terms; this site does not make promises about them.

Your private management link

Keep your private management link secret. It allows you to correct or delete your submission and withdraw a story’s public consent. Public sharing links never contain this secret. If it is lost, your name alone cannot restore editing access; contact the site owners.

Live photo-saving status

Checking live photo-saving status…

AI photo suggestions

Checking live AI photo-suggestion status…

Approved photo retention

365 days

Deletion and privacy contact

tat.tokareva@gmail.com

The painted-rock hero is generated editorial artwork, not a real participant photo or evidence of a cleanup. Community stories are not seeded with fictional activity.