Privacy Policy — ScalyPal

This Privacy Policy explains how ScalyPal Media LLC ("ScalyPal", "we", "us", or "our") collects, uses, and shares information when you visit scalypal.com (the "Site"), create an account, or interact with our community features.

We built ScalyPal to be a free, ad-light husbandry reference. We do not sell your personal information, and we do not run third-party behavioural advertising networks on this Site.

1. Information We Collect

Information you give us

Account information. If you register, we collect your email address, a display name, and a password. Passwords are stored only as a salted bcrypt hash — we never store or can recover your plaintext password.
Profile information. Optional bio text and an avatar image URL, if you provide them.
Community content. Comments, questions and answers, enclosure ("setup") photos, captions, and equipment reviews that you choose to post. This content is public by default.
Guest questions. Our Q&A area allows posting without an account. In that case we collect the display name you type, your question text, and a salted hash of your IP address used solely for spam and rate-limiting. We do not store the raw IP address for guest questions.
Correspondence. If you email us, we keep the message and your email address so we can reply.
Product research and launch updates. If you submit the climate-controller survey or a "notify me" form, we store your email address and whatever optional answers you chose to give — how you currently manage heat and humidity, the species you keep, which features matter to you, a free-text note, and the four price expectations you enter. We also store a salted hash of your IP address to rate-limit abuse, and your browser's User-Agent string. Supplying your email is your consent to be contacted about this product; you can withdraw it at any time (see §7). We never sell or rent these addresses, and they are used for nothing except this product.

Information collected automatically

First-party analytics. We operate our own analytics system rather than relying solely on third parties. For each page view we record the page path, the referring page, coarse device type (desktop / mobile / tablet), your browser's User-Agent string, a timestamp, and a randomly generated visitor identifier stored in a cookie (see §3).
Server and security logs. Our hosting and CDN providers record standard request metadata (IP address, timestamp, requested URL, response code) as part of normal operation, abuse prevention, and DDoS mitigation.
Third-party analytics. We use Google Analytics 4 (measurement ID G-DYN7Z951EF) to understand aggregate traffic patterns. Google may set its own cookies and receives your IP address and interaction data.

We do not collect payment card details. ScalyPal content is free and we do not process payments on this Site.

2. How We Use Information

To operate, maintain, and secure the Site;
To render your account, profile, and community contributions;
To moderate content and prevent spam, abuse, and automated traffic;
To understand which care guides are useful so we can improve and update them;
To respond to your questions and correction requests;
To decide whether to build a product we have described, and to email you about it if you asked us to — including to tell you if we decide not to build it;
To detect, prevent, and investigate security incidents and violations of our Terms of Service.

We do not use your information to build advertising profiles, and we do not sell or rent personal information to anyone.

3. Cookies and Similar Technologies

Name	Purpose	Lifetime
`sp_uid` (first-party cookie)	Random visitor identifier used to measure unique readers and returning visits. `HttpOnly`, `SameSite=Lax`. Contains no personal data.	Up to 12 months
`scalypal_token`, `scalypal_user` (first-party local storage)	Stores your login session token and display name so you stay signed in. Written only after you log in.	Until logout or expiry
`_ga`, `_ga_*` (third-party, Google)	Google Analytics 4 — aggregate traffic measurement. Set by Google.	Up to 24 months

You can block or delete cookies in your browser settings. Blocking the first-party visitor cookie does not prevent you from reading any content on the Site. Blocking analytics cookies does not affect functionality.

4. When We Share Information

We share information only with service providers who help us run the Site, and only as needed:

Google Analytics (Google LLC) — traffic measurement. See Google's Privacy Policy.
Cloudflare, Inc. — CDN, TLS, and DDoS protection; processes request metadata in transit.
Our hosting provider — serves the Site and stores the database.
Affiliate networks — if you click an outbound product link, the destination merchant or network may set cookies and see that you came from ScalyPal. See our Affiliate Disclosure for details.

We may also disclose information if required by law, subpoena, or valid legal process, or when we believe disclosure is necessary to protect the rights, property, or safety of ScalyPal, our users, or the public.

If ScalyPal is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction. We will post notice on this page before your information becomes subject to a different privacy policy.

5. International Data Transfers

ScalyPal is operated from the United States, and information is processed and stored on servers located in the United States. If you access the Site from the European Economic Area, the United Kingdom, or elsewhere, you understand that your information will be transferred to and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where required, we rely on appropriate safeguards such as standard contractual clauses.

6. Data Retention

Account data is retained while your account is active. You may request deletion at any time (see §7).
Community content you post may remain visible after account deletion, but will no longer be attributed to your account. To have public content removed, ask us (see §10) or delete it from your account before closing it.
Analytics data is retained in aggregate; raw page-view records are pruned periodically. Visitor identifiers are pseudonymous and are not linked to your account.
Server logs are retained for a limited period for security and troubleshooting.
Product research responses are kept while we are deciding whether to build the product and, if we build it, until launch communications are finished. If we decide not to build it, we will delete the addresses rather than keep them indefinitely — and we will tell you that is what happened. You can ask us to delete yours sooner at any time.

7. Your Rights

Depending on where you live, you may have some or all of the following rights:

Access — request a copy of the personal information we hold about you;
Correction — have inaccurate information corrected (most profile data is editable directly in your account);
Deletion — request erasure of your personal information;
Restriction / objection — object to or request that we restrict certain processing;
Portability — receive your data in a structured, machine-readable format;
Withdraw consent — where processing is based on consent, withdraw it at any time;
Non-discrimination — we will not degrade your experience for exercising these rights.

To exercise any of these rights, email us at [email protected]. We will respond within the timeframe required by applicable law (generally 30 days under the GDPR and 45 days under the CCPA/CPRA). We may need to verify your identity before acting on a request.

If you are in the EEA or UK, you also have the right to lodge a complaint with your local supervisory authority. If you are a California resident, note that we do not sell or share personal information for cross-context behavioural advertising as those terms are defined by the CPRA, and we do not knowingly collect information from consumers under 16.

8. Children's Privacy

ScalyPal is intended for a general audience aged 13 and older. We do not knowingly collect personal information from children under 13 (or under the applicable age threshold in your jurisdiction). If you believe a child under that age has provided us personal information, contact us and we will delete it promptly.

9. Security

We use industry-standard measures to protect your information, including TLS encryption in transit, bcrypt password hashing, and access controls on our systems. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use a unique password and notify us immediately if you suspect unauthorised access to your account.

Do not post personally identifying information — your address, phone number, workplace, or location — in public comments, questions, or setup captions. Anything you post publicly can be read and copied by anyone.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. Material changes will be announced on the Site. Continued use of ScalyPal after a change takes effect means you accept the updated policy.

11. Contact Us

Questions about this policy or how we handle your information?

Email: [email protected]
Post: ScalyPal Media LLC, 2847 Keeper's Trail, Suite 200, Austin, TX 78704, United States