Privacy Policy

Effective from 2 July 2026

Čtyřlístkotéka is a non-commercial showcase of a private four-leaf clover collection. We collect as little about you as possible — the site uses no advertising and no third-party tracking. Below is an overview of what is nonetheless processed.

1. Who is the controller

The data controller is the operator of Čtyřlístkotéka. For any data-protection matter, contact us at safronus@gmail.com.

2. What data we process, and why

Visitor statistics

We measure traffic with our own GoatCounter instance running on our server (stats.ctyrlistkoteka.cz). It uses no cookies and does not profile you; your IP address is processed only transiently, as a hashed fingerprint to distinguish unique visits, and then discarded. No data is shared with any third party. Purpose: a basic overview of traffic. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Server security and operation

The web server records request IP addresses in operational logs; the fail2ban tool uses them to block attacks. Purpose: protecting the site from abuse. Legal basis: legitimate interest. Logs are rotated and deleted regularly.

“Like” voting

When you vote on a find, we store a functional cookie with a random identifier and a fingerprint derived from your IP address, browser and language (a one-way hash with a server-side secret). It serves only to stop you voting on the same find more than once. We do not store your actual IP address — you cannot be identified from a database dump. Legal basis: legitimate interest (protection against vote manipulation).

Map (OpenStreetMap)

On the Map page, map tiles are loaded from the OpenStreetMap Foundation's servers, which sends them your IP address and browser details needed to deliver the tiles. This processing is governed by the OpenStreetMap Foundation privacy policy. If you would rather avoid it, do not open the Map page.

3. Cookies and browser storage

The site stores nothing on your device for advertising or cross-site tracking. It uses only:

  • vote_voter_uuid — a functional cookie (1-year lifetime), set only when you vote, preventing double voting.
  • theme — your appearance choice (light/dark/clover) stored in the browser's localStorage; it is never sent to the server.

Because we use no tracking or advertising cookies, the site does not require a consent (“cookie”) banner under § 89 of Czech Act No. 127/2005 Coll.

4. How long we keep data

Visitor statistics are kept in aggregate form. Operational logs and fail2ban records are rotated and deleted regularly. Vote records are kept while the voting feature is active, or until an erasure request is handled.

5. Recipients and transfers outside the EU

The site and its database run on a server provided by OVH in a data centre in France (EU), acting as a processor. Apart from OpenStreetMap map tiles (see above), we pass data to no other third party. No personal data is transferred outside the EU/EEA.

6. Your rights

You have the right to access your data, to rectify or erase it, to restrict processing, to data portability, and to object to processing based on legitimate interest. To exercise a request, write to safronus@gmail.com. You also have the right to lodge a complaint with the supervisory authority — the Czech Data Protection Authority (Úřad pro ochranu osobních údajů).

7. Data within the collection

Notes on finds may occasionally mention other people. For finds marked as anonymized, the site shows no notes, no precise location and no names, and such finds are excluded from search engines.

8. Changes to this policy

We may update this policy as the site evolves. The current version is always on this page, with the effective date shown at the top.