Privacy Policy

Who is responsible for your data

ReefPicker is run by Martin Onsholm, based in Sweden, who is the data controller for everything described on this page. If you have a question about your data, or want to exercise any of the rights below, write to hello@reefpicker.com and you will reach a person, not a ticket queue. A postal address is available on request.

What we collect

If you create an account (optional): your email address and name, handled by our authentication provider, Clerk. You can use most of ReefPicker — building, pricing, pre-flighting — without an account.

Your build: the parts you add are stored in your browser and in a shareable link. Saved builds are stored against your account (or an anonymous token) so you can return to them.

Affiliate clicks: when you click a retailer link, we log the event with a one-way hashed (not stored raw) IP for fraud/dedup purposes and basic referral data. We also record which page you clicked from, and the same date-based hash our analytics uses — that lets us see what share of people who run a compatibility check go on to a retailer. Because the hash changes daily, it answers that question without following you over time.

Analytics

None of this happens unless you accept it in the cookie banner — reject, or close the banner without answering, and nothing below is recorded. If you do accept, we use privacy-friendly, aggregate analytics to understand which pages are used and how the site performs. It measures traffic in aggregate and does not build an advertising profile of you. Two systems are involved: Vercel Analytics, and our own first-party measurement stored in our database in the EU.

Our own measurement is cookieless. Instead of an identifier that follows you, each visit is tagged with a one-way hash of your IP address and browser, combined with the date — so the tag changes every midnight and cannot be used to recognise you from one day to the next. Your raw IP address is never stored.

We record the page you visited, a coarse country and city from your connection, your device and screen-size category, and — if you arrived from another site — that site’s address and page, so we can tell which forum thread or article sent you. We remove the query string from that address before storing it, because it can contain things that are none of our business, such as what you searched for on another site.

We also record what you do on ReefPicker itself: the terms you search here (kept in lowercase, up to 80 characters), whether you were signed in, and the outcome of the things you use the site for — which compatibility warnings a build produced, which reef type you chose, which species you opened, and how long you spent reading. If you arrived from a campaign link we keep its source, medium and campaign name. All of it is tied to the daily hash above, never to your account or your IP address.

Advertising & measurement

To measure our advertising and show relevant ads, we use the Meta Pixel and the TikTok Pixel. When enabled, these share limited event data (such as page views or that a build was started) with Meta and with TikTok (ByteDance) so we can measure campaigns and reach people who’ve shown interest. TikTok processes this data outside the EEA. These advertising tools are only loaded after you give consent — see our Cookie Policy. You can change or withdraw consent at any time.

Search visibility

We also load Google’s Preferred Sources button, which lets you mark reefpicker.com as a source you’d like Google Search to show you more of. It runs inside a frame hosted by Google and communicates with Google the moment it loads. It is only loaded after you accept analytics — see our Cookie Policy.

Why we process it (legal basis)

To provide the service you ask for (your account, saved builds) and our legitimate interest in running and protecting the site — fraud prevention on affiliate clicks, and the ranking signals that decide which products are shown as popular, which describe the product rather than you. Everything that measures you relies on your consent: our own first-party analytics, Vercel Analytics, the Meta and TikTok pixels, and Google’s Preferred Sources button alike.

Where your data lives

Account data is processed by Clerk; build and catalog data is stored in Supabase (EU region); analytics by Vercel; advertising and measurement by Meta and by TikTok (ByteDance), which processes data outside the EEA; the Preferred Sources button by Google. These providers process data under their own terms.

Your rights

Under the GDPR you can request access to, correction of, or deletion of your personal data, object to certain processing, and withdraw your consent at any time. To do any of these, contact us.

Retention

Account data is kept while your account exists. Anonymous saved builds expire automatically. Affiliate-click logs are kept only as long as needed for fraud prevention and reporting.