Documents
This English version is provided for your convenience; in case of any discrepancy the Polish version is legally binding.
Last updated: 26 July 2026.
The controller of your personal data is the publisher of the Stan Wody service – Karol Kwiatkowski. Contact regarding data: [email protected].
If you sign up for the newsletter, we process your email address in order to send you messages about water levels, routes and updates. The legal basis is your consent (Article 6(1)(a) GDPR), which you confirm by clicking the link in the activation email (double opt-in). You can withdraw your consent at any time by clicking “unsubscribe” in any email – this does not affect the lawfulness of processing carried out before the withdrawal.
We collect aggregate, anonymous information about the use of the service (page views, searched phrases, viewed rivers) in order to improve the site. It contains no personal data and does not allow you to be identified. For this purpose we use a random session identifier stored in the browser’s memory (localStorage, not a cookie), unconnected to your identity. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) – developing the service. We respect the “Do Not Track” signal.
Creating an account requires an email address – the Service sends a one-time login link to it and uses it to recognise the account afterwards. The email address is not visible to other users.
The profile (username, short description, profile photo) is filled in voluntarily. If no name is provided, the Service shows an automatic label (e.g. “Person A7F3”).
Photos are resized and converted in the browser before being uploaded, and EXIF data (including GPS location and camera model) is removed – only the photo itself is saved, with no hidden information.
The legal basis for processing is the performance of a service requested by the User (Article 6(1)(b) GDPR). An account is voluntary and free of charge, and the service works fully without logging in as well. The account together with its associated data can be deleted at any time – from the account settings or by writing to [email protected].
This is the most important thing to understand before creating an account:
A route’s track shows the place and time of a trip. Think twice before you publish a trip that starts outside your home.
A friend invitation and its acceptance are saved as a link between accounts. You can block another user – you then stop seeing each other’s content. The blocked person is not informed of this.
Private messages between Users are stored in the account database (content, sender, recipient, time) in order to deliver them to the recipient and display them in the conversation. They are seen only by the sender and the recipient; we do not moderate them automatically and we do not read them routinely. When someone reports a person or a conversation, we examine the matter on the basis of the description provided in the report. We notify the recipient of a new message by email (only the fact that someone has written – without the content of the message); email notifications can be turned off in the account settings, and who can write to you can be limited to friends. We keep messages until they are deleted or the account is deleted by either party. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) – enabling contact between Users and the security of the Service.
Reporting a post, trip, comment, private message or user saves its content, the reason and the account identifier of the reporting person – in order to examine the matter and to counter misuse of the reports themselves. The reported person does not learn who reported them. Reports are kept for 12 months from being examined. The legal basis is our legitimate interest (Article 6(1)(f) GDPR) – protecting users and the security of the Service.
Reporting a new place or a correction to a place already marked saves the content of the report, its location and the account identifier of the reporting person – in order to verify it. A report appears on the map only after it has been checked. After an account is deleted, accepted reports remain on the map but are no longer linked to the person – it is information about the terrain, not personal data.
Our hosting provider automatically processes technical data (including IP address and device information) in order to deliver and secure the site.
We use trusted providers who process data on our behalf:
Some of these services may process data outside the European Economic Area – in such cases this is done on the basis of standard contractual clauses approved by the European Commission.
When you use the map and live data, your browser connects to external services, to which it may pass, among other things, your IP address: the map base layer (CARTO, OpenStreetMap), water levels (IMGW-PIB), weather (Open-Meteo), place search (Nominatim/OpenStreetMap) and fonts (Google Fonts). This is done in order to display that content.
We keep the email address until you unsubscribe from the newsletter or withdraw your consent. We keep analytics data in aggregate form for as long as necessary to analyse the development of the service.
Account data is kept until the account is deleted by the User. Abuse reports – 12 months from being examined. Data of accounts blocked for breaching the Terms – for as long as necessary to defend against claims, no longer than 3 years.
You have the right to: access your data, rectify it, erase it, restrict its processing, object, data portability and to withdraw consent at any time. To exercise them, write to [email protected]. You also have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (uodo.gov.pl).
We do not use cookies for tracking or advertising. For the anonymous analytics to work we use only the browser’s memory (localStorage), which you can clear at any time in your browser settings.
Users who are not logged in receive no cookies at all. After logging in, a single technical session-maintenance mechanism is saved – essential for the account to work, it is not used for tracking or advertising and it disappears after logging out.
We may update the policy as the service develops. The current version is always available on this page, with the date of the last change at the top.
See also: Terms & conditions and the About the data page.