Privacy Policy
Last updated: April 2026
What data we collect
WingsNBeaks collects as little data as possible:
- Contact form submissions: if you fill in the contact form, we store your name, email address, selected subject, and message text. This is used solely to reply to you.
- Account information: if you create an account, we store your email address and a hashed password (or a link to your Google account if you use Google sign-in). We do not store your Google password.
- Quiz progress: if you are logged in, we store which questions you answered, whether your answer was correct, and the difficulty level. This is used to display your progress and award achievements.
- Anonymous analytics: we use Umami, a privacy-friendly analytics tool that does not use cookies and does not track you across sites. It records page views, session duration, country (from IP, not stored), and device type. No personal data is retained by Umami.
How your data is used
- Contact form data is used only to reply to your message. It is not shared with third parties.
- Account data is used only to authenticate you and to save your quiz progress.
- We do not sell, rent, or share your personal data with any third party for marketing purposes.
Data storage
All data is stored on a self-hosted server. Contact form submissions and quiz content are stored in a SQLite database. User accounts and progress are stored in PocketBase, also self-hosted. No data is sent to external cloud storage providers.
Third-party services
- iNaturalist API — used to fetch species observation data. Images are loaded directly from iNaturalist's CDN. See iNaturalist's privacy policy.
- Google Gemini AI — used to generate quiz questions from species names. Species names (not user data) are sent to the Gemini API. See Google's privacy policy.
- Google OAuth — if you choose to sign in with Google, your Google account information is used for authentication only. See Google's privacy policy.
Your rights
You can request deletion of your account and all associated data at any time by contacting us. We will process deletion requests within 7 days.
Contact
Questions about this policy? Get in touch.