Privacy Policy

This Privacy Policy explains how Things With Wings ("https://thingswithwings.uk") collects, uses, and protects your personal information when you use our website. By using Things With Wings, you agree to the practices described in this policy.

1. Information We Collect

Account Information

When you register, we collect your name, email address, username, and password (stored as a secure hash).

Photos and EXIF Data

When you upload photos, we store the image files and any embedded EXIF metadata, which may include camera make and model, lens information, exposure settings, date and time taken, and GPS coordinates. You can control whether your GPS location is shown publicly using the privacy toggle on each photo.

Usage Data

We collect standard server logs including IP addresses, browser type, pages visited, and timestamps to help us operate and improve the service.

Payment Information

If you subscribe to Pro membership, payment is processed by Stripe. We do not store your card details — Stripe handles all payment data in accordance with PCI-DSS standards.

2. How We Use Your Information

• To create and manage your account
• To display your photos, profile, and sightings on the platform
• To process Pro membership payments via Stripe
• To send transactional emails (account confirmations, password resets) via Resend
• To show your wildlife sightings on the community map (if you opt in)
• To improve the platform through aggregated, anonymised analytics

3. Advertising

We use Google AdSense to display advertisements on our website. Google AdSense uses cookies and similar technologies to serve ads based on your prior visits to this website and other websites on the internet. Google's use of advertising cookies enables it and its partners to serve ads based on your visit to our site and/or other sites on the internet.

You may opt out of personalised advertising by visiting Google Ads Settings or by visiting aboutads.info.

4. Cookies

We use the following types of cookies:

• Essential cookies — required for login sessions and security (NextAuth session cookie)
• Advertising cookies — set by Google AdSense to show relevant ads

By continuing to use the site you consent to these cookies being set.

5. Third-Party Services

• Stripe — payment processing (privacy policy)
• Google AdSense — advertising (privacy policy)
• Resend — transactional email delivery
• Wikipedia — species thumbnail images (no personal data shared)

6. Data Retention

We retain your account data and uploaded photos for as long as your account is active. If you delete your account, your personal data and photos will be removed within 30 days. Server logs are retained for up to 90 days.

7. Your Rights (UK GDPR)

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data
• Object to processing of your data
• Data portability

To exercise any of these rights, contact us at [email protected].

8. Contact

If you have questions about this Privacy Policy, please contact us at [email protected].