Privacy policy

PumpkinCarvingIdeas.com is operated by Palto Bay Holdings, LLC, a company based in New Jersey, United States. For the purposes of the EU and UK General Data Protection Regulation (GDPR), Palto Bay Holdings, LLC is the data controller of the personal information described on this page.

Contact us about anything privacy-related at [email protected] or by post at Palto Bay Holdings, LLC, 51 Maidenstone Dr, Ocean, NJ 07712, USA. We have not appointed a data protection officer because the size and nature of what we do does not require one.

• Account information. If you create an account: your email address, a password (stored as a hash by our authentication provider, never readable by us), your username, and anything you choose to add to your profile (display name, bio, location, website, social links, avatar, and a featured photo or video).
• Content you share. Pumpkin photos or videos you upload, plus their titles, descriptions, and tags; your likes, star ratings, comments, saves, and reports; and reviews you leave on stencils, with the display name you give.
• Email signups. If you give us your email address (to join the newsletter, follow the contest, unlock stencil downloads, use the AI stencil maker, submit a local contest, or apply to host a contest) we record the address, where on the site you signed up, the text you agreed to and when, how you first reached the site (the referring link or campaign details such as UTM tags), your IP address and browser user-agent, and the country our hosting provider derives from that IP address. For signups from the United States we also keep the region and city, and any ad click identifier your visit carried. For signups from anywhere else we keep neither, and we delete the IP address and browser user-agent after 30 days.
• Stencils you generate. If you use the AI stencil maker: your prompt, the images produced, your email, and your IP address.
• Usage data. Which pages are viewed and which stencils are downloaded, recorded against a pseudonymous identifier that changes every day and that we cannot turn back into you. To spot bulk scraping, each stencil download is also logged against the email address or account that unlocked it, and that log is deleted after 90 days; on-site searches (the search text, linked to your account if you are signed in); and, where analytics cookies are on for you (by default in the US outside California, with your consent elsewhere), the Google Analytics data described in our cookie policy.
• Technical basics. Standard server logs (IP address, request time, page requested) kept briefly for security and debugging, and short-lived rate-limiting records keyed to your IP address or account.

We do not buy personal data from other sources.

Under the GDPR we need a legal basis for each thing we do with your information. Here is each purpose with its basis.

• Running your account and showing your uploads in the gallery. Basis: performing our contract with you (the terms of use).
• Unlocking a stencil download or generating a stencil you asked for, and emailing it to you if you asked us to. Basis: performing our contract with you.
• Sending you newsletter and contest emails. Basis: your consent, which you can withdraw at any time by unsubscribing.
• Moderating content before it appears publicly, so the site stays family-friendly. Basis: our legitimate interest in running a safe site. See “Automated decisions” below.
• Keeping the site secure, rate-limiting abuse, preventing fake signups and contest votes, and debugging problems. Basis: our legitimate interest in protecting the site and its members.
• Understanding which pages and efforts bring people to the site, using the pseudonymous usage data above and the signup source. Basis: our legitimate interest in improving the site. Google Analytics cookies run by default for US visitors outside California (opt-out on the cookie page) and only with your consent everywhere else.
• Keeping a record of the consent you gave us and of moderation and administrative actions. Basis: our legal obligation to be able to demonstrate consent, and our legitimate interest in an accurate security record.
• Responding to legal requests if we are required to. Basis: legal obligation.

Where we rely on legitimate interest, we have checked that it is not outweighed by your rights, and you can object at any time (see “Your rights”).

When you upload a carving, set a profile photo or video, or write a stencil review, an AI model (provided by Anthropic) screens it first. Content that passes is published automatically; anything the model flags, and anything reported by other members, is held for a human moderator. The AI never bans accounts or removes content on its own. If something of yours was held or declined and you disagree, email [email protected] and a person will look at it.

We use essential cookies to keep you signed in and remember your choices, a first-party cookie that remembers how you first reached the site, and, only if you choose “Accept all” on the banner, Google Analytics. Google consent signals start denied. Full details, the list of cookies, and how to change your choice are in the cookie policy.

Approved uploads are public: the image or video, title, description, tags, and your username appear in the gallery and may be indexed by search engines. Your profile page shows whatever you put on it (display name, bio, location, links, featured media) and when you joined. Comments, ratings and stencil reviews are shown with your username or the display name you gave. Your email address is never public.

We use a small number of service providers to run the site. They process data on our behalf, under contracts that limit them to our instructions, and do not get to use it for their own purposes.

• Supabase (United States): database and account authentication.
• Vercel (United States): hosting and server logs. Vercel also tells us the approximate location of each request, which we store only with email signups.
• Cloudflare (United States, global network): content delivery, security filtering, and storage of uploaded images, videos and stencil files.
• Resend (United States): sending account, transactional and newsletter emails, and keeping the mailing list in sync with your subscription choice.
• Anthropic (United States): AI screening of uploads, profile media and reviews, as described above. The content is sent for the screening and is not used by Anthropic to train its models.
• Google (United States): Google Analytics and Tag Manager where analytics cookies are on for you, and the Gemini image model that draws stencils in the AI stencil maker (your prompt is sent; your email is not).
• Amazon and OpenStreetMap: tool pages show product images served from Amazon, and the contest directory map loads tiles from OpenStreetMap. Your browser requests those directly, so those services see your IP address like any website you visit.

We don’t sell or rent personal information and we don’t share it with advertisers. We would disclose information if legally required to, or if the site is ever sold, in which case this policy would continue to apply to it.

We are based in the United States and so are our providers, so if you are in the European Economic Area, the United Kingdom or Switzerland your information is transferred to the United States. Where our providers are certified under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) we rely on that certification; otherwise we rely on the European Commission’s Standard Contractual Clauses built into their data processing terms. You can ask us for details of the safeguards for any provider.

• Account data and uploads: while your account exists. Deleting your account removes them (see “Your rights”).
• Email signups: while you are subscribed. For signups from outside the United States, the IP address and browser details recorded with the signup are deleted after 30 days; the consent record (address, what you agreed to, when, and country) stays. If you unsubscribe we keep the address marked as unsubscribed so we never email you again by mistake; if you ask us to erase your data we delete the record entirely.
• Generated stencils: until you ask us to erase your data. If you chose to share one with the community it stays published, with your email and prompt removed.
• Stencil download log: 90 days, then deleted automatically. If you ask us to erase your data it is deleted at once.
• Server logs and rate-limiting records: a few days at most.
• Usage data: kept in aggregate. The daily pseudonymous identifier cannot be traced back to you after the day it was created, and we never store your IP address with it.
• Moderation and administrative records: kept as a security log. When you delete your account they are detached from you and keep only the action taken.

Wherever you live, you can edit or delete your own uploads from your account, change your profile, and unsubscribe from marketing email using the link in any email or the toggle in account settings.

You can also delete your account yourself from account settings. This permanently removes your profile, uploads, comments, votes, saves, reviews, contest entries, generated stencils, and your email from our lists. If you gave us your email without creating an account (for example to download a stencil) and want it erased, email [email protected] from that address.

If you are in the EEA, the UK or Switzerland, the GDPR also gives you the right to:

• Access the personal information we hold about you and get a copy of it in a portable format.
• Correct anything that is inaccurate.
• Erase your information (the “right to be forgotten”), which the account deletion above carries out.
• Restrict or object to processing that relies on our legitimate interests, including analytics.
• Withdraw consent at any time where we rely on it, for example by unsubscribing or changing your cookie choice. This does not affect what was done before you withdrew.
• Complain to your local data protection authority. In Sweden that is the Integritetsskyddsmyndigheten (IMY); in the UK it is the Information Commissioner’s Office. We would appreciate the chance to help first, but you do not have to ask us before complaining.

To exercise any right that is not self-service, email [email protected] from the address on your account or signup. We may ask you to confirm you control that address. We answer within one month, and never charge for it. We do not discriminate against anyone for exercising their rights.

The site is family-friendly, but it isn’t directed at children. You must be at least 13 to create an account or give us your email, or older where your country sets a higher age for consenting to online services (up to 16 in parts of the EEA). We don’t knowingly collect personal information from children below those ages. If you believe a child has created an account, contact us and we’ll remove it. Younger carvers can take part in the contest through a parent’s account, as the contest rules describe.

Data is stored with access controls, transferred over HTTPS, and passwords are hashed by our authentication provider. Only the site owner and a small moderation team can see non-public information, and every administrative action is logged. No internet service can promise perfect security, but we keep the surface area small. If we ever discover a breach that puts you at risk we will tell you and, where the law requires it, the relevant authority.

The CCPA/CPRA details, including the categories we collect and how to exercise your rights to know, correct, and delete, live in our California privacy notice. The short version applies to everyone though: we don’t sell or share personal information, and you can delete yours at any time.

If this policy changes in a meaningful way, we’ll update the date at the top and, for changes that affect how we use information you already gave us, tell account holders by email. Questions? Email [email protected] or write to us at Palto Bay Holdings, LLC, 51 Maidenstone Dr, Ocean, NJ 07712, USA.