Privacy Policy

Last updated: 14 September 2026

1. Who we are

MyReefPal provides reef-keeping tools, including coral and marine species identification, coral reference browsing, store availability links, and tank tracking. For privacy questions, contact us at [email protected].

2. What we collect

Account data: Name, email address, and hashed password when you register.

Uploaded images: Photos you submit for identification or tank tracking, including any cropped versions created in the app.

Identification data: AI-generated embeddings, likely matches, explanations, confirmation choices, processing status, and related metadata.

Tank data: Tank names, livestock, parameter logs, maintenance notes, equipment notes, dates, and photos you choose to save.

Usage and security data: IP address, browser details, timestamps, session data, form submissions, and activity needed for security, rate limiting, analytics, troubleshooting, and abuse prevention.

Store and reference data: Public coral reference and store product information collected from third-party store pages, including product names, availability, prices, images, and source URLs.

3. How we use your data

  • To provide species identification, tank tracking, account, and support features
  • To show your identification history and saved tank information
  • To process uploaded images with AI systems and compare them with our reference database
  • To maintain, secure, troubleshoot, and improve MyReefPal
  • To enforce usage limits, prevent abuse, and protect the service
  • To understand feature usage and improve identification accuracy over time
  • To send account, verification, security, and service-related emails

4. Legal bases

Where privacy laws require a legal basis, we process your data to provide the service you request, with your consent where required, to comply with legal obligations, and for our legitimate interests in security, fraud prevention, product improvement, analytics, and running MyReefPal. You can object to processing based on legitimate interests by contacting us.

5. AI processing

MyReefPal uses automated systems to analyse uploaded images and generate likely species matches. These results are predictions, not definitive scientific, veterinary, legal, import/export, conservation, or animal-welfare advice. We may use uploaded images, embeddings, confirmed or rejected matches, and related metadata to test, monitor, and improve identification quality. We do not use your uploaded images to identify people.

6. Third-party services

We use the following third-party services to operate MyReefPal:

Cloudflare R2: Image storage. Images are stored securely and accessed via time-limited URLs.

Cloudflare Turnstile: Bot detection on forms. Cloudflare may process your IP address, browser and device data, and interaction signals to verify you are human.

Google Gemini: AI verification and explanation. Uploaded images and candidate match data may be sent to Google for processing.

Modal: Hosted AI model execution. Uploaded images and text may be sent to our Modal-hosted models for embedding generation and classification.

Resend: Email delivery for account, verification, security, and service messages.

Google Analytics: Usage analytics for understanding traffic and feature usage.

Store websites: Product and availability pages may be linked from MyReefPal. Their own privacy policies apply when you visit them.

These providers may process data in the United Kingdom, European Economic Area, United States, or other countries where they or their subprocessors operate. Where required, transfers are handled using lawful transfer mechanisms such as adequacy decisions, standard contractual clauses, or equivalent safeguards.

7. Data retention

Account data: Retained until you delete your account or request deletion.

Uploaded images and identification history: Retained while needed to provide your history, operate the identification service, improve accuracy, resolve errors, and protect against abuse, unless you delete your account or request deletion and we no longer need the data for legitimate operational or legal reasons.

Tank data: Retained while your account is active or until you delete your account or ask us to delete it.

Security, rate-limit, and log data: Retained only as long as reasonably needed for security, troubleshooting, legal, and operational purposes.

Backups: Deleted on a rolling schedule. Data removed from the live service may remain in backups for a limited period before expiry.

8. Cookies and analytics

We use essential cookies for session management, authentication, security, and form protection. We also use Google Analytics to understand how visitors use the service, including pages visited, approximate location, device/browser information, and session activity. You can limit cookies in your browser settings or use Google’s analytics opt-out tools where available.

9. Your rights

Depending on where you live, you may have rights to:

  • Request a copy of your personal data
  • Request correction of inaccurate data
  • Request deletion of your account and associated personal data
  • Object to or restrict certain processing
  • Request portability of data you provided
  • Withdraw consent where processing is based on consent
  • Opt out of sale, sharing, or targeted advertising where applicable
  • Appeal or complain to a privacy regulator where available

You can delete your account from the account page. For other rights requests, contact [email protected]. We do not sell personal information. We may need to verify your request before acting on it. You will not be treated differently for exercising privacy rights.

If you are in the UK or European Economic Area, you may also complain to your local supervisory authority. In the UK, that is the Information Commissioner’s Office.

10. Security

We use reasonable technical and organisational measures to protect personal data. Passwords are hashed, cloud-stored images are accessed through signed or limited URLs, and production traffic should be encrypted via HTTPS. No online service can guarantee absolute security.

11. Children

MyReefPal is not directed at children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided personal data, contact us and we will take appropriate steps to delete it.

12. Changes

We may update this policy from time to time. If changes are material, we will take reasonable steps to notify registered users, such as by email or a notice in the service. The updated date shows when the policy was last changed.

13. Contact

For privacy-related enquiries, contact us at [email protected].