Privacy

Paddenstoel publishes small websites. We need as little from you as possible to do that: an email address to confirm the site is yours, and your IP address briefly to prevent abuse. No account, essentially no cookies for visitors (only on a site with a password), no ads, and we don't track you: we only count visits as totals. Questions? Email privacy@paddenstoel.app.

In brief, for children too

We keep your email address for as long as your site exists, so we can email you about it. After that, it remains in our backups for up to 12 months, which we only use for recovery.
We briefly see the address of your internet connection (IP address). We delete it after no more than three days, except from our backups.
We count how many people view a site, but not who they are.
Almost never cookies for visitors (only on a site with a password), no ads, and we don't sell data about you.
Everyone can see what you put on your site. So don't put your surname, address, school or photos of yourself on it.
Want us to remove something? You can remove your site yourself at Remove your site. For anything else, email privacy@paddenstoel.app, or ask a parent or teacher to help.

Who is responsible

Paddenstoel is an initiative by Jeroen Dee and Jeroen Gordijn. Send questions about your data to privacy@paddenstoel.app.

What data, why and for how long

Your email address: To send you the confirmation link, enforce the limit of three sites per email address and contact you about your site. It never appears on your site or in our API. If you don't confirm within 12 hours (or within 12 hours of a new link we send you), we delete the site and your email address. If you do confirm, we keep it for as long as the site exists, along with when you confirmed and which version of the terms you agreed to. A site stays online for 6 months; we email you 14 days before it ends, and once more afterwards. We delete the site and your email address 30 days after it ends (see the terms). If we remove a site, for example after an abuse report, we delete the site, your email address and linked domains 30 days later, unless we restore the site during that time; in cases of serious abuse, such as phishing or malware, we delete them immediately. If you remove your site yourself, we delete the site, your email address and linked domains 7 days later; until then, we only restore it if you ask us to. If you ask us by email to delete it, we delete your site and email address immediately; the web address reservation code is kept as described below. If we take a site offline or remove it, we email you to explain why. We keep a copy of that email, with your email address, for 12 months, in case you object or an authority asks about it. If an authority asks us to delay that email, we keep it until we are allowed to send it. If we send you a one-time email asking you to do something to your site, such as change your DNS, we keep a record that we sent it for 12 months, along with your email address, your sites and the email itself, so you don't receive it twice. If we restore a site you removed yourself at your request, we keep that decision for 12 months, with your email address and the site's address. We also do this if we don't email you about it. If your own domain can point to another site of yours, we ask for your permission by email. We keep the domain, the sites and your response until 30 days after you respond or the link expires.
Your IP address: When you create a site, to prevent someone from flooding the platform or using it to send spam. We delete it from your site's records after 24 hours. It stays in our sending log, together with the email address and site, for 72 hours.
Logging in to My mushrooms: If you log in at My mushrooms, we keep the email address you enter and a hash of the code for 10 minutes, so you can enter the code. If there are sites associated with that address (or with the site you specify), we email the code to those sites' email address. The email stays in our sending log for 72 hours, with the email address but without your IP address. We record an incorrect code as a hash of the address until no later than two days afterwards, to limit the number of attempts per day. Once you're logged in, we keep your email address and a hash of your session until you log out, are inactive for an hour, or 8 hours have passed since you logged in. For this, your browser sets two functional cookies: one for the code request (10 minutes) and one for the session. They are only for My mushrooms, not for advertising or statistics.
Remove your site: If you request at Remove your site a link, we compare the email address you enter with the site's email address. We don't store it for that comparison. If it matches, we email a link to the site's email address. We keep your network (your IPv4 address, or your IPv6 address shortened to /48) and, if we send an email, a hash of the site and mailbox for 72 hours to limit the number of requests. The email itself stays in our sending log for 72 hours, with the email address we sent it to but without your IP address.
A new version: If you request a new version of your site, we compare the email address you enter with the site's email address. We keep a hash of the entered address, along with the site and your network (your IPv4 address, or your IPv6 address shortened to /48), for 72 hours to limit the number of requests, even if the address doesn't match. If it matches, we email a code to the site's email address. After a new version, we keep the previous one for 7 days, hidden from view, so we can investigate abuse; it may also be in a backup. Accidentally published something that needs removing? Email privacy@paddenstoel.app, and we'll delete that version immediately.
“This wasn't me”: If you choose this on the confirmation page, we keep an irreversible code (hash) of your email address so we never email you again. We keep it until you ask us to delete it.
A blocked address: If we block an address after serious abuse, we only keep an irreversible code (hash) of that address, so it can no longer create sites or receive email from us, except for the email explaining why and our reply if you object. We keep it until we lift the block.
Your chosen web address: The words in your web address are public once your site is online. So don't choose private information. To prevent someone else from getting the same address later, we permanently keep codes (hashes) of new web addresses and their word portion, even after the site is deleted. For that reservation, we don't keep the words themselves, your email address or your IP address. This way, old links and browser data don't lead to a new owner.
Your website: The files you upload become public as soon as you confirm. So don't include anything that must not be public.
Visitors: We count visits to paddenstoel.app and the sites hosted on it to see how Paddenstoel is used. We only keep daily totals per site: how many pages were viewed and by how many distinct visitors, which pages, which website or app visitors came from (only its name), what type of browser, operating system and device they used, such as “Safari”, “iOS” and “mobile”, which country they came from, and how often a search engine or other program visited. On paddenstoel.app itself, a small script sends us your screen width in four broad groups. Only then do you count as a visitor there: this keeps programs pretending to be browsers out of the count. To avoid counting you twice in one day, we create a code from your IP address, browser details and the site that changes every day. That code is only held in our server's working memory, including during a restart, is gone at the end of the day and never goes into a backup. We don't store your IP address or full browser details for this; we otherwise only use your IP address briefly in memory to look up the country and prevent someone from flooding the counts. We look up the country in a list on our own server (IP to Country Lite by DB-IP); your IP address isn't sent anywhere for this. We keep the totals for 25 months; a site's totals are removed as soon as we delete the site. We don't set cookies, except on a site with password protection (see below); even then, we never track you from day to day or from site to site. Beyond that, only My mushrooms and our own administration use a login cookie, for whoever logs in there. Scripts that a site owner adds to their own site are that owner's responsibility.
Feedback: If you click a face, we only count that this face was chosen one more time that day, and where: after confirming, after updating or on the feedback page. We don't store a site, email address, IP address or timestamp with your click. If you also send a message, we keep it for 12 months, together with the face you chose and, if you send it after confirming or updating, the site it concerns. We email the message to our own address feedback@paddenstoel.app. If you tick the box allowing us to email you, we also keep your email address with the message and only use it to reply to that message. That reply comes from support@paddenstoel.app; we keep it with your message, and it is deleted along with your message. Without that tick, we won't email you about it. If we act on your message, we add the text and the face as a task on our task board in Basecamp, without your email address or the site. The text stays there for as long as we need the task. We only use your IP address briefly in memory to prevent someone from flooding the form.
Email to us: Email to abuse@paddenstoel.app, privacy@paddenstoel.app, feedback@paddenstoel.app or support@paddenstoel.app we keep for as long as we need it to handle your report or question.
Custom domains: If a custom domain becomes free, because you unlink it or your website is deleted, we remember the domain, the date and a code we calculate from your email address. That way another address cannot link the domain by itself afterwards. The code cannot be turned back into your address, but someone who knows your address can check it. We keep this until the domain is linked to a website again. We count how often you link a domain in a day for 2 days.
Modules: If we give your email address extra features, such as statistics, custom domains or password protection, we keep that address with those modules and a short note for as long as you have them. We keep each change for 2 years, so we know what you had and when; after that we delete it. If you set a password on a site yourself, there is also a cookie for that site's visitors: see below.
A site with password protection: If you turn on password protection for a site yourself, we only keep a one-way hash of that password (no readable copy, and no way to read it back). When a visitor enters the correct password, that one site sets one signed cookie in that visitor's browser, to remember the password was already entered — without us keeping track of who they are. That cookie only works for that one site, nowhere else. To slow down guessing, we only use your IP address briefly in memory, to count per site how often a password was tried; that never goes into our database or a backup. The cookie itself can stay in the browser for up to 30 days, but it stops working immediately once you change the password or turn protection off again, without us needing to clear anything from that browser.
API keys: If you make an API key or link an AI agent, we keep with your email address the name of the key, when it was made and when it was last used. Of the key itself we only keep an irreversible check value. We keep an agent's link request for at most a day, without your IP address. A key stops after 6 months without use; we delete revoked and expired keys after 90 days.
Your language choice: When you choose Dutch or English, your browser remembers that choice in local storage (localStorage), without an extra cookie. You can change it with NL/EN or clear it in your browser settings. Without JavaScript, the language choice is only in the link. We store your email language with your websites after you verify your email address or log in. Only websites with the exact same email address share that choice; addresses with + tags or dots are not treated as the same address. The choice is removed with the last website, following the retention periods above. Choosing a language on a public page does not automatically change someone else’s email language.
Our log: What happens to a site, such as putting it online, updating it, taking it offline or removing it, and what goes wrong on our side, we keep for 30 days in a log for running Paddenstoel. It includes the site's web address, but not your email address or your IP address. After that, it may still be in a backup.

Our legal basis

We use your email address to provide the service you request (Article 6(1)(b) GDPR). If there is no valid agreement, for example because you are young, we use it because we have a legitimate interest in being able to contact you about your own site; we give extra weight to children's interests when balancing these interests (point (f)). We use your IP address and sending data because we have a legitimate interest in preventing abuse (Article 6(1)(f) GDPR). If we take a site offline or remove it, we email you the reason because the European Digital Services Act requires this (Article 6(1)(c) GDPR). We keep a copy of that email because we have a legitimate interest in being able to handle your appeal (point (f)). We use feedback because we have a legitimate interest in improving Paddenstoel (also point (f)); we use your email address with it only because you ask us to reply. We count visits because we have a legitimate interest in understanding how Paddenstoel is used and improving it (also point (f)).

Who helps us

OVHcloud (France): the server in Gravelines and the encrypted backups in Paris.
Scaleway (France): sends our emails, such as confirmation emails to you and your feedback to us, and records their recipients and subjects.
TransIP (Netherlands): domain name and DNS.
Fastmail, an Australian company: receives email to abuse@paddenstoel.app, privacy@paddenstoel.app, feedback@paddenstoel.app and support@paddenstoel.app, including your feedback. Even if the email itself is stored in the EU, Fastmail keeps a copy, backups and logs in the United States. This transfer outside the EU is covered by the European Commission's standard contractual clauses.
Basecamp, from the US company 37signals: our task board. If we act on your feedback, the text of your message is stored there, without your email address or site. This transfer outside the EU is covered by the European Commission's standard contractual clauses.

We do not sell your data, use it for advertising or to train AI, or create profiles.

Backups

We make a backup every day so we can restore data. These stay on the server for 7 days; the encrypted copy in Paris is kept for up to 12 months. Deleted data may therefore remain in a backup for that long. We only use it to restore the platform.

Your rights

You can ask what data we hold about you, have it corrected or deleted, and object to its use. You can also remove your site yourself at Remove your site, or ask us to take it offline. Email privacy@paddenstoel.app from the address you used to create the site; we will respond within one month. If you disagree with us, you can file a complaint with the Dutch Data Protection Authority.

Abuse

Have you seen a site with phishing, malware or illegal content? Email abuse@paddenstoel.app with the site's address.