Privacy

• Your account. Your email address, and your name if you give one. If you sign in with Google we receive the basic profile Google returns for that sign-in; we never see your Google password.
• Your collection. Everything you record: animals, pairings and offspring, genetics, feeding, health and cleaning records, housing, measurements, photos, documents and QR codes.
• Your business records. If you use the paid features: transactions and costs, customers and waiting lists, and the content of your public breeder site.
• Billing. Your subscription tier, its status and renewal date, and an identifier for you at Stripe. Card details are entered at Stripe and never reach us.
• Sign-in security. The IP address a sign-in code was requested from, and how many were requested. Sign-in has no password fallback, so without this a flood of code requests aimed at your address could lock you out of your own account.
• Technical logs. The ordinary server logs kept by our hosting provider, plus records of background jobs, email we queued for you, and webhooks we sent on your behalf.

There are no analytics scripts, advertising tags or third-party trackers anywhere in HerpSync. We do not build profiles of you, and we do not sell or rent any of this to anybody.

Animal photos are stored on a public file host and served straight from it. That is what makes them load quickly on your breeder site — but it also means a photo's address keeps working once anyone has it. Hiding an animal, or switching your public pages off, removes the pages; it cannot un-publish a picture. Deleting the photo is the only way to withdraw it.

Health screening panels, DNA results and vet certificates work the opposite way. They are never given a public address: every download is fetched through HerpSync, which re-checks who you are and whether that document is shared, on every single request. Switching sharing off takes effect immediately.

To run the service you asked for and to bill you for it; to keep accounts secure and stop abuse; to send the transactional email the product depends on (your sign-in code, alerts you switched on, invoices); and to meet our own record-keeping obligations. We do not send marketing email.

Only the companies that run parts of the service for us, and only for that purpose:

• Vercel — hosting, and the file store holding photos, documents and QR images.
• Neon — the database.
• Stripe — subscription payments to us.
• Resend — transactional email delivery.
• Square — only if you connect your own Square account, and only to read your sales and catalogue and to create payment links for you. Your Square access token is encrypted before it is stored.
• Google — only if you choose to sign in with Google.

We will also disclose data if we are legally required to, and we would tell you unless we were forbidden from doing so. If HerpSync is ever sold or transferred your data moves with it, and this policy travels with your data.

If you invite someone to your workspace they can see what their role allows, and you control that from Settings → Permissions. Chores, harvests and stock movements record which member carried them out, and that member's name is shown to the rest of the workspace. Nobody outside your workspace sees any of it.

• Sign-in codes expire ten minutes after they are sent.
• Sign-in rate-limit records last for the length of their window, and are cleared as soon as you sign in successfully.
• Everything in your workspace stays until you delete it. Deleting a record deletes it; deleting a photo deletes the file behind it.
• Closing your workspace removes its contents. Deleted data can still exist in database backups for up to 7 days afterwards, and is gone after that.
• Billing records are kept as long as tax and accounting rules require, whatever else is deleted.

• Export. Your animals download as a spreadsheet from the Animals page at any time, without asking us.
• Correct. Everything in the app is editable in the app.
• Control what is public. Settings → What visitors see governs every public page, down to individual animals and to whether feeding or health history appears at all.
• Delete. Ask us and we will delete your workspace. Read the note about photos above first — if a photo has been shared publicly, deleting it is what withdraws it.

Depending on where you live you may also have the right to a copy of your data in a portable form, to object to some processing, or to complain to a data protection regulator. Write to us and we will help.

HerpSync sets three cookies, and none of them advertise or track:

• a sign-in cookie, which is what keeps you signed in;
• one recording which workspace you are currently looking at;
• one set only by the Android app, so the app knows it is the app.

Your light/dark preference is stored in your browser and never sent to us. The app also keeps a small offline cache in your browser, so it can show a proper page rather than a browser error when you lose signal in a reptile room.

• Enquiries.If you use the contact form on a breeder's site, your name, email address and message are passed to them. We use your address to send them the enquiry with you as the reply-to, so their answer goes straight back to you.
• Customer records. A breeder may record your name, email address, phone number and their own notes about you. They type this in; we do not obtain it from anywhere else.
• Purchases.If you buy or reserve an animal, the payment itself happens at Square, on Square's pages. We hold the amount, what it was for, when it was paid and Square's reference for it. Your card details never reach us.

An enquiry form deliberately fills gaps and never overwrites: if a breeder already has your phone number, a later form submission cannot change it.

We do not market to you, we do not add you to any list of our own, we do not share you between breeders, and no breeder can see another breeder's customers. We use it to operate the service for the breeder you contacted, and for nothing else.

Ask the breeder first — the record is theirs, the app lets them edit and delete it, and they can act immediately. If you cannot reach them, or you do not know which breeder holds your details, write to us at privacy@herpsync.com and we will identify the account, pass the request on, and follow it up.