Privacy Policy
This policy explains what information Shrim collects, how it's used and protected, and how to delete it.
Who we are
Shrim (the website at shrim.app and the Shrim app) is operated by XeroOne+ ("we," "us"). This policy explains what information we collect, why, who processes it for us, and the choices you have. Questions: [contact email].
What we collect
| Information | Why we use it | Where it's kept |
|---|---|---|
| Email address | To create your account and send one-time sign-in codes and links. We don't send marketing email to app users unless you ask for it. | Our account service (Supabase) |
| Onboarding answers (experience level, tank stage, water source, shrimp color) | To tailor your plan, lessons and reminders | Your account (Supabase) |
| Tank details, water test results, colony counts, notes, care task history and feeding log | To provide the app's tracking, charts, checks and reminders | Your account (Supabase) |
| Photos you choose to add | To show your tank and colony history. Photos are resized on your device before upload. | Private storage in your account (Supabase) |
| Waitlist sign-ups (email, where you are with shrimp, early-feature opt-in) | To tell you when Shrim launches and, if you opted in, invite you to test new features | Our database (Supabase). The operator gets an email notice for each sign-up. |
| Basic technical data (IP address, browser type, request time) | Created automatically when any website is loaded. Used by our hosting and database providers to deliver the service, keep it secure and fix errors. | Provider logs (Vercel, Supabase) |
We do not collect your location, contacts, camera roll (only photos you pick), payment information, or health information, and we don't use cookies for advertising or cross-site tracking.
Stored on your device
To open quickly and work offline, the app keeps a copy of your data and photos in your browser's local storage on your device, along with your sign-in session. Signing out or deleting your account clears the app's copy on that device. You can also clear it through your browser settings.
How we use it
- To run Shrim: sign you in, save and sync your tanks across devices, and show your checks, charts and reminders.
- To keep Shrim secure and working, and to respond when you contact us.
- To send launch news to waitlist members who asked for it.
We don't sell or rent your personal information, share it for cross-context behavioral advertising, or use it to train AI models.
Who processes data for us
We use a small number of service providers who process data only to run Shrim for us:
- Supabase: database, sign-in and photo storage (United States).
- Vercel: website and app hosting.
- Resend: sending operator notification emails (for example, when someone joins the waitlist).
- Google Fonts: the website loads its typefaces from Google, which receives your IP address when fonts load.
We may disclose information if required by law, to protect the rights and safety of our users or others, or as part of a merger or sale of the business, in which case this policy will continue to apply to your information.
How long we keep it
- Account data and photos: until you delete them or delete your account.
- Waitlist sign-ups: until launch communications are complete or you ask us to remove you.
- Provider logs: kept for the provider's standard period, generally no longer than needed for security and troubleshooting.
Deleting your account
In the app, open Tank settings (the gear icon), choose Delete account, and confirm. This permanently deletes your account, tanks, tests, counts, notes and photos from our systems and clears the app's copy on that device. It can't be undone. Copies in backups are removed as those backups expire. To be removed from the waitlist, contact [contact email].
Your choices and rights
You can view, edit and delete your information in the app at any time. You can also ask us to access, correct, delete or export your information by contacting [contact email]. We'll respond within 30 days. Depending on where you live, including California (CCPA/CPRA) and the EEA or UK (GDPR), you may have additional rights, such as knowing what we collect and not being discriminated against for using your rights. We don't sell or share personal information as those laws define it. Where GDPR applies, we rely on performing our contract with you (running your account) and our legitimate interest in keeping the service secure. Where required, you may complain to your local data protection authority.
Security
Data travels over encrypted connections (HTTPS). Each account can only read its own records, enforced at the database level, and photos are kept in private storage. Sign-in uses one-time email codes instead of passwords. No system is perfectly secure, so please keep access to your email account safe.
Children
Shrim is not directed to children under 13, and you must be at least 13 to create an account. If you believe a child under 13 has given us personal information, contact [contact email] and we'll delete it.
International users
Shrim is operated from the United States, and your information is stored and processed in the United States.
Changes
If we change this policy, we'll update the effective date above. For significant changes, we'll let account holders know in the app or by email before they take effect.
Contact
XeroOne+, operator of Shrim · [contact email]