Scope
This Privacy Policy explains how Reef Warden (“Reef Warden,” “we,” “us,” or “our”) collects, uses, and discloses information through this website, optional public-site product analytics, tag management, and session replay, contact and support forms, partner applications and directory, private account authentication, connected-equipment telemetry and saved AI-assisted reviews, and Reef Warden email operations.
Connected products, customer accounts, monitoring services, or mobile applications may be governed by additional product-specific notices presented before the relevant information is collected.
Information we collect
We collect information you choose to provide, such as your name, email address, optional telephone number, organization, service area, aquarium or equipment details, support descriptions, partner application details, applicant-reported business operating metrics such as active aquariums serviced and approximate average system volume, messages, correspondents, feedback, and communication preferences.
If you check a separate SMS box, we also record the normalized number, selected region, exact consent text and version, server timestamp and form identifier, security hashes, verification or suppression status, and later messaging or carrier events. Contact-inquiry consent and support-ticket consent are stored as distinct grants linked to the applicable submission. A populated phone field without that checked box is not SMS consent.
If you check the separate email-updates box on the contact form or message widget, we record the normalized email address, exact marketing consent text and version, server timestamp and server-selected form identifier, security hashes, current requested or suppression status, and later unsubscribe, complaint, or delivery events. Submitting an inquiry or widget message without that checked box authorizes the requested reply, not recurring marketing email.
Approved staff, partner, and customer accounts generate authentication, MFA enrollment and recovery, session, role, account membership, failed-attempt, invitation-delivery, and audit records. Customer records may also include aquarium names, timezones, approximate volumes, connected installation identifiers, data freshness, observations, controller-configured alarm bounds and flags, outlet states and health, telemetry history, and saved AI-assisted review evidence and suggestions linked to the customer’s authorized tanks. Reef Warden email operations may process sender and recipient addresses, subject lines, message bodies, headers, and delivery events.
We also collect limited technical and security information, which may include an IP-derived security hash, browser or device information, request time, requested page, and form anti-abuse signals. When a browser connects to our infrastructure or an authorized analytics provider, its network address may be processed to transmit and protect the request. Do not submit passwords, authentication codes, payment details, government identifiers, health information, or other sensitive personal information through public forms.
How we use information
- Respond to questions, consultations, support tickets, and email correspondence.
- Review product, professional, equipment, integration, and partner applications.
- Provision and secure approved staff and partner accounts.
- Operate the opted-in partner directory and connect visitors with listed providers when that directory launches.
- Manage optional SMS opt-in requests and, only after verification and activation, provide recurring automated updates within the separate inquiry-specific or ticket-specific consent given.
- Manage optional recurring email-update requests and, only after activation with working unsubscribe controls, send the product, requested-availability, educational, partnership, and company-news categories disclosed at opt-in.
- Display authorized connected-equipment telemetry and prepare at most one stored morning and one stored evening AI-assisted review per aquarium-local day from bounded normalized evidence.
- Understand consented use of approved public pages and improve navigation, educational resources, and interactive planning tools.
- Operate, secure, maintain, and improve the website and private portals.
- Detect spam, fraud, abuse, or security incidents and maintain operational, consent, suppression, audit, and legal records.
Product analytics, tag management, and session replay
On approved public pages, Google Analytics and PostHog run by default, and you can opt out at any time. We automatically honor your browser’s Global Privacy Control signal: when it is present, analytics do not run regardless of any prior choice. Google Analytics (gtag.js) loads first-party, with no tag-management container. Reef Warden supplies it only a sanitized approved-public-page path without query parameters or fragments, page-view events, and content-free conversion events such as completing a public-form lifecycle stage. Analytics storage only is used; advertising storage, advertising user data, advertising personalization, functionality storage, and personalization storage remain denied, and we do not load a third-party advertising pixel in your browser.
After consent, approved public pages may send PostHog a sanitized page path, event time, general browser and device characteristics, an anonymous browser identifier, and content-free actions such as opening a public tool, adjusting a catalog component, changing an anatomy view, or completing a public-form lifecycle stage. We do not use PostHog to identify you and do not send names, email addresses, phone numbers, message text, form values, aquarium identifiers, or customer identifiers.
Public-page session replay creates a privacy-masked reconstruction so we can understand layout and interaction problems. All text and input values are masked. Contact, support, partner, message-widget, Turnstile, and Apex response-workbook regions are blocked. Staff, customer, partner, invitation, authentication, MFA, and recovery routes are excluded from analytics and replay. Console logs, captured exceptions, network request or response bodies, headers, cross-origin frames, and canvas contents are not recorded.
PostHog uses first-party cookie and local-storage entries for anonymous analytics and replay session state. Reef Warden stores your opt-out preference in local storage and a first-party cookie so it persists across visits. We do not use this data for advertising or sell it.
Service providers
We use service providers to operate the website and process submissions. Cloudflare may provide Workers infrastructure, D1 data storage, private R2 object storage, queues, and Turnstile abuse prevention. Resend may transmit email notifications and messages, receive inbound email when configured, and provide delivery events. Anthropic processes a bounded copy of normalized telemetry evidence to prepare scheduled Claude reviews. That model request excludes the customer’s identity, email address, account and aquarium identifiers, controller serial, mobile access credential, and raw webhook payload. With analytics consent, Google provides tag-container delivery and PostHog provides public-site product analytics and privacy-masked session replay. These providers process information under their own contractual and legal obligations.
Cloudflare Turnstile may collect technical signals needed to determine whether a request is legitimate. Anthropic, Google, and PostHog may process applicable service or consented analytics information in the United States and other locations where they or their subprocessors operate. Reef Warden does not place advertising trackers in this website build.
When we disclose information
We may disclose information to service providers working on our behalf; when required by law or valid legal process; when reasonably necessary to protect security, rights, or safety; or in connection with a financing, merger, acquisition, reorganization, or transfer of the business subject to applicable law.
We do not sell personal information. We do not sell, rent, or share mobile numbers, email addresses, SMS or email opt-in data, or consent records with third parties or affiliates for their own marketing.
Retention and security
We retain information only as long as reasonably necessary to respond to requests, operate support and partner relationships, manage correspondence, display connected-equipment history and saved review evidence, improve approved public experiences, maintain consent, authentication, security, and audit records, resolve disputes, and meet legal obligations. The period varies according to the information and its purpose. Analytics and replay are subject to Reef Warden’s configured PostHog retention and provider operational retention; private message bodies, raw files, telemetry, or AI-assisted reviews may be subject to separate schedules.
We use reasonable administrative, technical, and organizational safeguards, including role restrictions, MFA, password hashing, rate limits, private storage, session revocation, audit records, route exclusion, content masking, and data-minimized event schemas where applicable. No transmission or storage system can be guaranteed completely secure.
Your choices
You may ask to access, correct, or delete information you submitted, or withdraw a communication preference, by contacting us through the website. Applicable law may provide additional rights, and we may need to verify a request before acting.
Use Cookie preferences at any time to opt out (or opt back in). Opting out sends a denied consent update, disables and removes the Google Analytics loader, stops PostHog capture and session replay, and clears recognized first-party analytics state from this browser; it does not retract analytics already received. We also honor your browser’s Global Privacy Control signal automatically. You may contact us about applicable access or deletion rights.
When recurring email updates are active, each marketing message will provide an unsubscribe method. Unsubscribing does not prevent an operational response to a separate request you submit. SMS-specific choices are described in our SMS Privacy Policy.
Children, links, and international processing
The website is not directed to children under 13, and we do not knowingly collect their personal information. Third-party links and manufacturers have their own privacy practices. Service providers may process information in countries other than your own, subject to protections required by applicable law.
Changes and contact
We may update this policy as the website and Reef Warden services evolve. We will post the revised policy with a new effective date and provide additional notice where required.
For privacy questions or requests, use the Reef Warden contact form.