Privacy

Privacy policy

This page explains what Penpal International currently does with information when you visit the site or create an account.

Last updated: 10 September 2026

Who operates the site?

Penpal International operates this website. For privacy questions or requests, contact hello@penpalinternational.net.

Information you provide

When you create an account, we process the information needed to provide the service:

your name and email address;
your password, stored only as a one-way password hash;
your gender, date of birth, country, city, state or province, and languages;
your hobbies and introduction; and
information needed to verify your email address and protect your account.

Information in your public profile is visible to other visitors. Your email address and password are not displayed publicly.

Google sign-in

If you choose Google sign-in, Google provides us with your verified name, email address, Google account identifier, and—when available—profile picture. We use these details to create or sign you into your Penpal International account.

Google sign-in also uses Google’s own services and privacy rules. You can stop using Google sign-in by removing the connection from your Google account. We periodically check the connection while you are signed in.

Why we process information

to create and operate your account;
to show public member profiles and enable communication;
to send verification, password-reset, and important account emails;
to prevent abuse, spam, and unauthorized access; and
to maintain and secure the service.

Security and activity logs

Security and account events may be recorded with a timestamp, event name, account identifier, and IP address. These logs are used for troubleshooting, abuse prevention, and account security. They are not displayed publicly.

Cookies

The application currently uses only necessary cookies:

ci_session keeps your session, login state, and account flows working.
csrf_cookie_name protects forms and account actions against cross-site request forgery.

No advertising, analytics, or marketing cookies are currently enabled. More information is available through the “Cookies” link in the footer.

Service providers

Some features use external providers:

Cloudflare Turnstile helps protect registration and login forms from automated abuse.
Google provides Google sign-in and profile image hosting when you choose that option.
Bootstrap files are currently loaded from jsDelivr to provide the site’s interface components.
Email is delivered through the configured mail service.

These providers receive only the requests needed for the relevant feature and operate under their own privacy policies.

Retention and deletion

We keep account information while your account is active and for as long as needed to provide security and fulfill legitimate operational obligations. You can request deletion of your account from the account page. Deletion removes the account from the application database; security records may be retained for a limited period where needed for abuse prevention or legal obligations.

Your rights

Depending on applicable law, you may ask for access to, correction of, or deletion of your personal information, or object to or restrict certain processing. Contact hello@penpalinternational.net and include enough information for us to identify your account. You may also complain to your local data protection authority.

Changes to this policy

We may update this page when the service or its data practices change. The date at the top shows when it was last revised.