Privacy policy

• Anonymous use: your saved tanks live in your browser's localStorage. Never leaves your device unless you sign in.
• If you sign in: your email address, a hashed password (handled by Supabase, never seen by me in plaintext), and your saved tanks. Tanks sync between your devices.
• If you submit feedback: whatever you typed in the form, plus the page URL you were on and your browser's user-agent string for debugging. Optional contact email if you want a reply.
• If you apply as a partner store: the store details you submit (name, address, phone, hours), tied to your account.
• If you publish a tank to the community feed: a snapshot of the tank's name, stocking list, and the tagline/description you wrote becomes public, attached to a handle derived from the part of your email before the @ sign (e.g. leah from leah@example.com). Comments you leave are public under the same handle.
• Analytics (opt-in): Vercel Analytics records page views and a few interaction events (which preset got loaded, etc.). Speed Insights collects Core Web Vitals (LCP/INP/CLS) so the site stays fast. Sentry collects JavaScript errors so we can fix bugs. None of these load until you click “Accept” in the cookie banner.

• Me (the maintainer). I can see your account email and any feedback or partner-store submissions you make.
• Supabase hosts the auth + database. They see whatever's stored.
• Resend sends signup verification + password emails. They see your email address and the email body.
• Vercel hosts the site and the analytics. They see anonymized request logs.
• Sentry (only if you accept analytics) sees the JavaScript stack traces of any error your browser hits, with PII stripped.
• The public sees anything you choose to publish to the community feed or post as a comment, under your handle.

Nobody else. No advertisers, no data brokers, no third-party tracking scripts, no Google Analytics, no Facebook Pixel.

Essential cookies: Supabase Auth sets a small set of session cookies (access + refresh tokens) when you sign in. These keep you logged in across page loads and are required for the signed-in features to work. Signing out removes them.

Non-essential: Vercel Analytics, Speed Insights, and Sentry don't load at all until you click “Accept” in the cookie banner. Your choice is remembered in localStorage. To change it, clear the site's storage in your browser settings and reload — the banner will reappear.

No marketing cookies. No cross-site tracking. No fingerprinting.

Under GDPR (EU/UK), CCPA (California), and similar laws elsewhere, you can ask for: a copy of the data tied to your account, correction of inaccurate data, deletion of your account, a portable export of your tanks, or withdrawal of analytics consent. Email the address below and we'll respond within 30 days. You're also free to complain to your local data-protection authority.

There's no self-serve delete button yet. Email lr103724@gmail.com from the address tied to your account and I'll remove the account, all your saved tanks, any feedback you've submitted, and any tanks you've published to the community feed within a few days. Anonymous use stores data in your browser only; clearing your browser's site data removes it instantly.

If this policy changes meaningfully (e.g. a new third-party service added), the change goes here and the "Last updated" date at the bottom moves. No emails about it unless the change affects what you already submitted.