This Privacy Policy explains how Studio Scaped ("we", "us", "our") processes personal data when you visit or use our website, create an Aquarium Tracker account at tracker.studioscaped.com, or use related services. We aim to handle personal data responsibly under applicable data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who is responsible for your data?
The data controller responsible for personal data processed through this website and Aquarium Tracker is Studio Scaped. We do not provide any contact channel for privacy-related enquiries or for submitting data subject requests.
2. What personal data do we collect?
Depending on how you use our services, we may process the following.
Studio Scaped website
- Technical and usage data — When you browse the site, our servers and service providers may automatically collect information such as your IP address, browser type and version, device type, operating system, referring URL, pages viewed, and approximate location derived from IP (e.g. country or region).
- Analytics data — We use Google Analytics to understand how visitors use the site (e.g. page views, session duration, traffic sources). Google may set cookies and collect data as described in their policies.
- Data you choose to provide — If you use features on the site that ask for or accept information (e.g. search or location fields), we process what you enter as needed to provide that functionality.
- Location-related queries — If you use tools that search for shops or stockists by location, we may process addresses, postcodes, or coordinates you enter, and related query data, to return results. We do not use this to build a personal profile unless clearly stated at the point of collection.
Aquarium Tracker accounts
When you register for and use Aquarium Tracker, we process customer account data in a dedicated Supabase project, separate from the stockist directory database used by this website.
- Account identifiers and sign-in data — Your email address, Supabase Auth user identifier, email verification and password-reset codes (handled by our auth provider; we do not store raw codes in your aquarium data), and linked sign-in methods (e.g. Apple or Google) when you connect them to your account.
- Profile preferences — Display name, timezone, and unit preferences (temperature and volume) stored in your profile.
- Aquarium data — Workspaces you own or belong to; tank names, water type, volume, timezone, and filter settings; parameter readings and reading-session notes; maintenance and tank events; lighting schedules; per-metric target overrides; fish and plant records (including names, quantities, and catalogue references); maintenance tasks and task completion history; and equipment/filter records linked to tanks.
- Private tank images — Photographs you upload of your aquarium. These are personal data stored in a private storage bucket; they are not public and are not used for marketing. Only workspace members can access images for tanks they belong to.
- Registered devices — Device identifier, platform (web, iOS, or Android), push notification token when you enable notifications, and last-seen timestamp.
- Notification preferences — Reminder settings, quiet hours, and timezone per workspace or tank.
- Entitlements — Records of product access or trial status when applicable (e.g. source platform and product identifier).
- Security audit events — A log of account actions (such as data export or deletion requests) with event type and non-sensitive metadata. Operational logging is designed to exclude measurement notes, image contents, OAuth tokens, and raw email verification codes.
We do not intentionally collect special category data (e.g. health information about you) through the website or Aquarium Tracker. Notes you add to readings, events, or tasks may contain information you choose to record about your tanks; please do not enter sensitive personal information there.
3. How and why we use your data (legal bases)
We process personal data only where we have a lawful basis under UK GDPR:
- Legitimate interests — Operating, securing, and improving the website and Aquarium Tracker; analysing aggregated usage; preventing abuse; and understanding how our content and features are used, where these interests are not overridden by your rights.
- Consent — Where we rely on cookies or similar technologies that require consent under the Privacy and Electronic Communications Regulations (PECR), we will obtain your consent where required (e.g. non-essential analytics). You may withdraw consent at any time.
- Contract — Processing necessary to provide Aquarium Tracker account features you sign up for, and to respond to pre-contract enquiries where applicable.
- Legal obligation — Where we must retain or disclose information to comply with law or regulatory requests.
4. Cookies and similar technologies
We use cookies and similar technologies that are strictly necessary for the site to function, and cookies used for analytics (Google Analytics). You can control cookies through your browser settings. Blocking some cookies may affect site functionality. For more on Google's use of data, see Google's Privacy Policy and How Google uses information from sites that use their services.
5. Subprocessors
We use the following processors to run our website and Aquarium Tracker. Customer account data is stored in a separate Supabase project from the stockist directory database used on this website.
| Processor | Purpose | Region |
|---|
| Supabase | Customer database, authentication, private image storage (Aquarium Tracker) | eu-central-1 (Frankfurt) |
| Supabase | Stockist directory (separate project; no Aquarium Tracker customer data) | eu-west-1 |
| Vercel | Application hosting (website and Aquarium Tracker) | — |
| Resend | Transactional email (verification, password reset) | eu-west-1 |
| Google LLC | Analytics (website only) | United States (see international transfers) |
We do not sell your personal data.
6. International transfers
Some processors may be located outside the UK. Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place as required by UK GDPR (e.g. adequacy regulations, Standard Contractual Clauses, or the UK extension to the Data Privacy Framework, as applicable).
7. How long we keep data
Retention depends on the service and the type of data.
Studio Scaped website
Server logs and analytics may be retained for periods defined by our providers. TODO(legal): confirm Google Analytics and Vercel log retention periods for publication.
Aquarium Tracker
- Active account data — Kept while your account exists and you use Aquarium Tracker.
- Account deletion — Deletion through Account Settings or the public deletion page removes your live account data immediately: owned workspaces, aquarium records, private tank images, registered devices, and the auth user record. If you are the sole owner of a workspace that still has other members, deletion is blocked until those members are removed or ownership is transferred.
- Data export download links — When you export your data, signed URLs for private tank images are valid for 3,600 seconds (one hour).
- Push tokens — Cleared when you remove a registered device. Device rows are tied to your user account and removed when the account is deleted.
- Security audit log — After account deletion, your user identifier in audit events is disassociated (set to null). TODO(legal): fixed retention period for audit events and schedule for anonymising remaining identifiers.
- Failed verification codes and abuse signals — TODO(legal): retention period for failed OTP attempts and abuse-related signals (currently described in engineering docs as the shortest period compatible with security investigations; no fixed period is enforced in published policy yet).
- Deleted records and offline sync — Soft-deleted records use a tombstone so offline devices can observe deletions. TODO(legal): offline-device recovery window after which tombstones are purged from live storage.
- Disaster-recovery backups — Encrypted backups may retain deleted data until they expire. Deleted data is not restored into the live service. TODO(legal): backup retention period for the customer Supabase project.
- Local device caches — The mobile app may retain an encrypted local cache on your device if you choose to keep offline data when signing out; clearing that cache is controlled on the device.
8. Your rights
Under UK data protection law you may have the right to:
- Access a copy of your personal data
- Rectify inaccurate data
- Erase data in certain circumstances
- Restrict processing in certain circumstances
- Data portability where processing is based on consent or contract and automated
- Object to processing based on legitimate interests
- Withdraw consent where processing is consent-based
- Lodge a complaint with the ICO (Information Commissioner's Office) at ico.org.uk
Aquarium Tracker: export and deletion
Aquarium Tracker implements both data export and account deletion for signed-in users:
- Export — Sign in, open Account Settings at tracker.studioscaped.com/account, and choose "Export my data". You receive a JSON file of your account records visible under row-level security, plus time-limited download URLs for private tank images. Export actions are recorded in the security audit log.
- Deletion — Sign in to Account Settings and confirm deletion by typing DELETE, or start from our public deletion page at tracker.studioscaped.com/delete-account, which explains the process and requires sign-in before deletion can complete. Deletion is immediate in the live service for account data, workspaces you solely own, private images, and registered devices.
We do not offer a way to submit access, erasure, or other data subject requests directly to us outside these Aquarium Tracker tools. If you are concerned about how we process personal data, you may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
9. Children
Our website is not directed at children under 13. Aquarium Tracker accounts are not intended for children under 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected such data, we will delete it where technically feasible.
10. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or alteration, including row-level security on customer database tables and private storage for tank images. No transmission over the internet is completely secure; you use our services at your own risk in that regard.
11. Third-party websites
Our site and Aquarium Tracker may link to third-party sites. This policy does not apply to them. Please read their privacy policies before providing personal data.
12. Changes
We may update this Privacy Policy from time to time. The "Last updated" date at the top will change when we do. Material changes may be highlighted on the site or communicated where appropriate. Continued use after changes constitutes acceptance of the updated policy where law allows.
This document is provided for general information and does not constitute legal advice. Studio Scaped may update practices; ensure this policy matches your actual data processing. Consider independent legal review for your jurisdiction and business model.
