Privacy Policy

Scope

This policy covers the Shoal & Stem website at shoalandstem.com and the Shoal & Stem iOS and Android apps. We're a small team, our defaults are private, and we don't sell your data — ever.

What we collect

When you create an account we store:

• Email and name — required to identify your account. You can sign up with email + password, Sign in with Apple, or Sign in with Google.
• Profile information you choose to add — display name, bio, profile photo, and optional location (country / region / city). Location is manually entered by you; we do not access GPS or device location.
• Tank content — tanks you create, water parameters you log, journal entries, photos you upload, livestock and plant lists, and notes.
• Marketplace activity (if you sell or buy) — listings, orders, messages with buyers/sellers, and shipping addresses you enter for orders.
• Push notification token (mobile app only, if you opt in) — a per-device identifier issued by Apple or Google that lets us deliver notifications you've subscribed to.
• Standard server logs — IP address, browser/device type, and request timestamps, kept for security and debugging.

What we do NOT collect

• Precise location or GPS data
• Contacts, calendar, microphone, or health data
• Browsing history outside Shoal & Stem
• Behavioral analytics from third-party SDKs (no Mixpanel, Amplitude, Segment, Firebase, etc.)
• Crash reporting SDKs that profile your device
• Advertising identifiers — we don't serve targeted ads

How we use your data

Your data is used solely to operate Shoal & Stem. Specifically:

• Run your account, save your tanks and content, and sync them across web and mobile
• Send transactional email (sign-up confirmations, password resets, order receipts) and — if you opt in — periodic Finn updates about your tanks
• Send push notifications you've subscribed to (mobile only)
• Provide AI-assisted features (Finn chat, tank health scoring, test-kit photo recognition)
• Process payments and shipping for marketplace transactions
• Display public content (tank journals, forum posts) you've chosen to share

We do not sell your data, share it with advertisers, or use it for any purpose beyond running this service.

Third-party services we use

We rely on a small set of vetted services to operate the platform. Each has its own privacy policy and only receives the data needed to do its job:

• Anthropic — powers Finn (AI assistant) and the test-kit photo scanner. When you chat with Finn or scan a test kit, the relevant tank data and image are sent to Anthropic to generate a response. Anthropic does not use your data to train their models.
• Cloudinary — stores and serves the photos you upload (tank photos, profile pictures, journal images).
• Stripe — processes marketplace payments and seller payouts. We never see or store your full card number.
• Resend — delivers transactional and opt-in email.
• Expo Push Notifications — relays push notifications to Apple and Google's notification services (mobile app only).
• Apple, Google — handle authentication if you choose Sign in with Apple or Google. We receive only your name and verified email from these providers.
• Vercel, Neon — host the website and database. Standard server infrastructure providers.

Public content

Tank journals, forum posts, marketplace listings, and profile information you mark as public are visible to all visitors. You can set your tank visibility to private at any time from your tank settings, and you can delete forum posts and listings you've created.

Activity feed (Ripple)

Public activity (new photos, journal updates, forum posts) appears in the community Ripple feed. You can opt out of Ripple in your account settings, which keeps your public content visible on its own page but excludes it from the feed.

Mobile app permissions

The mobile app may ask for the following permissions. All are optional and the app works without them, with reduced functionality:

• Camera — to photograph your aquariums and test kits
• Photo Library — to attach existing photos to journal entries and listings
• Notifications — to send updates you've subscribed to (water-change reminders, marketplace messages, etc.)

We do not request access to your contacts, location, microphone, calendar, or health data.

Cookies and sessions

On the website we use a single session cookie to keep you signed in. The mobile app stores its authentication token in the operating system's secure storage (Keychain on iOS, Keystore on Android). No third-party tracking cookies, advertising pixels, or fingerprinting scripts are used.

Data retention

We keep your account data for as long as your account exists. When you delete your account, your tanks, journal entries, photos, and personal data are permanently removed within 30 days. Marketplace order records are retained as long as legally required for tax and dispute resolution. Anonymized server logs may be kept for up to 90 days for security purposes.

Deleting your account

You can delete your account and all associated data at any time from your account settings. If you need help, email us at hello@shoalandstem.com and we'll handle it manually.

Your rights

You can access, correct, export, or delete your data at any time from your account settings, or by emailing us at hello@shoalandstem.com. If you're in the EU, UK, or California, you have additional rights under GDPR and CCPA — contact us to exercise them. We respond to all requests within 30 days.

Children

Shoal & Stem is not directed at children under 13, and we don't knowingly collect data from anyone under 13. If you believe a child has created an account, contact us and we'll remove it.

Changes to this policy

We may update this policy as the product evolves. The "Last updated" date at the top reflects the most recent change. Material changes will be announced by email if you've opted in to product updates.

Contact

Questions, requests, or concerns? Email us at hello@shoalandstem.com. We read every message.