Effective: May 2026 · Last updated: September 2026
Grumpycapy.com is operated by Data Sauna LLC, a single-member limited liability company formed in the State of Wyoming, United States, with a registered office at 30 N Gould St, Ste R, Sheridan, WY 82801, USA. For the purposes of this policy, Data Sauna LLC is the "business" under the CCPA/CPRA and the "data controller" under the EU and UK GDPR. Personal information is stored and processed in the United States; if you are outside the US, by using the site you understand your information is transferred to and processed there. This policy should be read together with our Cookie Policy, which lists every cookie and browser-storage entry and the legal basis for each.
What we collect
Grumpy Capy collects the personal information you choose to provide when you contact us or send in a capybara sighting. From the contact form this may include your email address, name or handle, contact topic, and the contents of your message. From the sightings form it may include the photo or clip itself, the caption you write, the name, handle, or profile link you want credited, and an optional email address. We also log request metadata that helps us prevent abuse, rate-limit form submissions, and protect the site. For sightings and votes specifically, your IP address is never stored: it is converted immediately to a salted, irreversible hash used only for rate limiting and to spot automated activity. Separately, the analytics and advertising tools described under "Cookies and analytics" below collect information automatically when you browse — IP address, approximate location, device and browser details, pages viewed, referrer, and, for advertising, identifiers stored on your device. Google receives that information for ad serving on every page, whether or not you accept cookies.
How we use it
We use contact-form data to respond to your message, review corrections or pitches, and maintain basic records of site communications. We use submission data to review the sighting, publish it with the credit you chose if it is accepted, and contact you about it if we need to. We never sell or rent the information you give us directly: your email address, name, and the contents of your message are not passed to anyone for their own marketing. Advertising and analytics are separate — the tools described under "Cookies and analytics" below receive information about your visit, and if you accept cookies that may count as a "sale" or "sharing" of personal information under California law. See "Sale and sharing of personal information" for what that means and how to opt out.
Retention
We keep contact submissions for as long as reasonably necessary to respond, maintain records of correspondence, prevent abuse, and address legal or operational issues. A published sighting, with its caption and credit, is kept for as long as it remains on the site; ask us to take it down and we remove it. The file you uploaded is deleted once it has been reviewed, and within seven days in any case, whether it was accepted or rejected. Any email address attached to a submission is kept only while the sighting is live, or until the submission is rejected. We keep a separate moderation record of what was rejected and why — not the file, but a note and a short mathematical fingerprint of the image — so that the same material resubmitted is recognised without a person having to look at it twice. One exception overrides all of the above: if a submission is reported as unlawful, we preserve it rather than delete it, because destroying the subject of a report can destroy the only record of it. See "When we disclose information" below, and the Terms of Use, for what that means in practice. IP logs and similar anti-abuse records are retained only for as long as reasonably necessary for security, fraud prevention, rate limiting, and troubleshooting.
Affiliate links
Some Amazon and Etsy product links are affiliate links. If you click through and buy something, Grumpy Capy may earn a commission at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.
These affiliate relationships do not control our editorial selections. Clicking an affiliate link may result in marketplace-side tracking, attribution, or cookie-based measurement handled by Amazon, Etsy, or their affiliate providers under their own policies.
Sightings, submissions, and voting
The Spotted wall works without an account, which changes what we need to hold and what we deliberately do not.
What we publish. Only the picture, the caption, and the credit you chose. If you give a name or handle it is shown as you typed it; if you give a profile link it becomes a clickable credit. Leave the field empty and the sighting is published as anonymous. An email address, if you give one, is never published and never added to a list.
Location data is removed. Every file is re-encoded before it is published, which strips the EXIF metadata block including GPS coordinates, camera serial number, and timestamps. The published file carries none of it. The original you uploaded is held in a private, non-public store until a person has reviewed it, and is then deleted — within seven days at the latest, whether it was accepted or not. We publish what the picture shows; we do not publish, keep, or infer where you were standing when you took it.
Voting. Voting needs to know that one person does not vote twice, and it does that without knowing who you are. The first time you vote we set a first-party cookie, gc_v, containing a random identifier — no name, no email, nothing that identifies you and nothing that works on any other site. Alongside it we store a salted hash of your IP address purely to enforce the daily limit and to spot automated voting; we do not keep the address itself against a vote, and the hash is not reversible to one. Clearing your cookies gives you a new identifier and a fresh set of votes, which is a limitation of doing this without accounts rather than an invitation. Votes are not linked to contact records, submissions, or analytics profiles. Lawful basis: legitimate interest in running a usable, non-manipulated ranking; the cookie is strictly necessary for the feature you asked for by pressing the arrow.
Spam protection. The submission form is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. It loads on the submission page only — not on the wall and not anywhere else on the site — and Cloudflare states that it does not use the data it collects for behavioral advertising or cross-site tracking. Cloudflare processes your IP address, user agent, and browser signals for that check under its own privacy policy. We chose it over reCAPTCHA specifically because it does not feed an advertising profile. Lawful basis: legitimate interest in preventing abuse of a public upload form.
Moderation. A person reviews every submission before it appears. Submissions, including rejected ones, are visible to the site operator during that review and are stored in our database (Supabase) and file storage until published or deleted as described under "Retention".
Your rights still apply. You can ask us to remove a published sighting, correct a credit, or delete the submission record entirely, through the contact page. You do not need an account to make that request, but we may ask for something that shows the submission was yours.
Cookies and analytics
We use a small, layered set of measurement tools. When you first visit, a banner asks you to accept or reject non-essential cookies. Apart from Google AdSense — which serves ads for everyone, non-personalized until you accept — nothing in the consent-gated categories below runs until you press Accept, and you can change your mind at any time using the Cookie settings link in the footer. The Cookie Policy has the full table, including cookie names, durations, and legal bases.
Cookieless, for everyone (no consent required). Two tools run for every visitor and set no cookies, no localStorage, and no device identifier: Vercel Analytics and Cloudflare Web Analytics. They collect anonymized, aggregate page-view metadata (page URL, referrer, rough country, device type, browser) and never build individual profiles. Because nothing is stored on or read from your device, no consent prompt is required; the lawful basis is our legitimate interest.
Google Analytics 4 (consent mode). GA4 runs for every visitor, but by default — before you accept — it operates in Google Consent Mode v2 in a cookieless "consent denied" state: it sets no _ga cookie and uses no persistent identifier, sending only anonymized, aggregated pings (legitimate interest). It sets cookies and enables full measurement only after you accept (your consent). Rejecting, or later withdrawing consent, downgrades it back to the cookieless state for the rest of the session.
Consent-gated tools (load only after you accept). If you accept, we also load Microsoft Clarity — heatmaps and session replay, with typed input masked by default — and may load the Meta (Facebook) Pixel to measure whether our social posts and ads bring people to the site. These do not load at all unless you accept, and they set their own cookies only after that point. Their lawful basis is your consent, which is optional and withdrawable at any time.
Advertising (Google AdSense). Display ads on this site are served by Google AdSense, which pays for running the site, so its script loads for every visitor, before and regardless of your cookie choice. Until you accept, we ask Google for non-personalized ads — selected from general context such as the page and approximate location rather than a profile of your browsing history — and Google's Consent Mode v2 signals for ad storage, ad user data, and ad personalization are set to denied. Non-personalized still involves storage: Google may set cookies on grumpycapy.com (for example __gads and __gpi) and on its own domains, and read device storage, for frequency capping, ad measurement, and invalid-traffic detection. Accepting cookies upgrades AdSense to personalized ads from your next page view; rejecting keeps them non-personalized.
Google requires AdSense publishers to state the following, so to put it plainly: third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet. You can opt out of personalized advertising by visiting Google Ads Settings (My Ad Center), and you can opt out of some third-party vendors' use of cookies for personalized advertising at aboutads.info/choices, or at youronlinechoices.eu in Europe. Opting out this way stops the personalization, not the ads themselves.
Visitors in the EEA, the UK, and Switzerland see an additional consent message from Google before any ad personalization. Google requires a certified consent management platform in those regions, and we use Google's own, which records your choice under the IAB Transparency and Consent Framework (TCF v2.2). Our own cookie banner stays hidden there, so you get one prompt rather than two, and we read that same TCF signal to decide whether to run Google Analytics' cookie-based mode, Microsoft Clarity, and the Meta Pixel. In those regions Google's message is the consent record for everything on this page, not only for ads. An honest note on the limits: the AdSense script still runs before you make a choice, and ad serving involves device storage even in non-personalized mode, so a strict reading of the ePrivacy rules would require consent for that as well. See the Cookie Policy for how to block ad-related storage entirely.
Third-party marketplaces you visit after leaving this site (such as Amazon or Etsy) may use their own cookies, tracking technologies, or attribution tools under their own notices and controls.
Embedded Instagram content. A few pages embed public posts from Instagram (for example, a venue's Instagram in our capybara-encounters directory). Each embed is an iframe that loads directly from instagram.com; we run no Instagram script on our own pages. Instagram can set its own cookies and read or write device storage on its domain when the embed loads. Because an embed is part of the content you chose to view, it can load before you make a cookie choice and is not part of our consent-gated analytics or advertising. It is governed by Meta/Instagram's own privacy notice; to prevent it, block third-party cookies or third-party content in your browser.
Grumpy Capy also uses your browser's local and session storage, and one first-party cookie, for strictly functional things — remembering your cookie choice, whether you've already seen our quiz popup, and which sightings you have voted on. This is not used for advertising, profiling, or cross-site tracking. You can clear it at any time via your browser's site-data settings.
Third-party services
We use service providers that help us run the site: hosting and infrastructure (Vercel, including Vercel Analytics and Speed Insights), a cookieless traffic counter (Cloudflare Web Analytics), analytics (Google Analytics 4, Microsoft Clarity), advertising (Google AdSense) and advertising measurement (Meta Pixel), embedded social content (Instagram, on pages that show an embedded post), bot protection on the sightings form (Cloudflare Turnstile), and database, file, and form storage (Supabase). These providers process personal information on our behalf, or as independent controllers for their own cookies once you consent, to host the site, store submissions, deliver functionality, measure traffic, maintain security, and support operations. See the Cookie Policy for links to each provider's own privacy notice.
When we disclose information
Beyond the service providers named above, who process information on our behalf, there are four situations in which information you gave us may go somewhere else. We do not sell it, and none of these is advertising.
Legal process. We may disclose information where we are required to by law, or where we receive a subpoena, court order, or other binding legal demand. Where we are permitted to tell you that it happened, we will.
Unlawful material. If something submitted to us is reported as unlawful, we preserve it instead of deleting it, and we may pass it, together with the request metadata attached to it, to law enforcement or to a body designated by law to receive such reports. Where the law obliges us to make a report, we make it. This is the one case that overrides the retention schedule above, and it is set out in the Terms of Use.
Safety and enforcement. We may use and share what we hold where we reasonably believe it is necessary to investigate abuse of the site, enforce our Terms, or protect the rights and safety of a person.
A change of ownership. If Grumpy Capy or its assets were sold or transferred, information held about you could move with it. It would stay subject to this policy, or you would be told before a materially different one applied.
Grumpy Capy is operated by Data Sauna LLC, a Wyoming limited liability company, and the site is hosted in the United States. US legal process therefore applies to information held here regardless of where you are.
International data transfers
Our service providers are based in the United States. When personal information is transferred from the EEA, UK, or Switzerland to the US, we rely on appropriate safeguards under GDPR Art. 46 — typically the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or the EU–US Data Privacy Framework where the provider is certified. Each provider's own privacy page (linked via the Cookie Policy) describes the transfer mechanism it offers.
Sale and sharing of personal information
We do not sell personal information for money, and we do not disclose your email address, name, or message contents to anyone for their own marketing. Advertising works differently: if you accept cookies, personalized advertising through Google AdSense and the Meta (Facebook) Pixel, where we run it, involves disclosing online identifiers and browsing activity to those companies, and under the CCPA/CPRA that likely qualifies as a "sale" and/or "sharing" for cross-context behavioral advertising. You can opt out at any time using the Cookie settings link in the footer to reject cookies. We also treat a Global Privacy Control (GPC) signal from your browser as a valid opt-out that overrides a stored Accept: when GPC is present we keep advertising non-personalized and do not load the consent-gated tools, on every page load, without you having to do anything else. If you do not accept, ads stay non-personalized: Google still receives your IP address, user agent, and the page you are viewing in order to serve and measure an ad and detect invalid traffic, but that data is not used to build cross-context advertising profiles with our authorization, and we do not otherwise sell or share your information. We do not knowingly sell or share the personal information of consumers under 16.
Your rights
You have rights over the personal information we hold about you, and we honor these for everyone regardless of jurisdiction:
- Access — request a copy of, or details about, the information we hold about you.
- Correct — ask us to fix inaccurate information.
- Delete — ask us to delete your information.
- Portability — ask for your information in a structured, machine-readable format.
- Opt out of sale or sharing — via the Cookie settings footer link or a GPC signal, as described above.
- Non-discrimination — we will not penalize you for exercising any privacy right.
- For EU/UK visitors — the rights to restriction, objection, and to withdraw consent at any time (with no effect on the lawfulness of past processing).
To exercise any of these, use the contact page. We may need to verify a request before completing it, and we may keep limited information where reasonably necessary to document the request, comply with law, resolve disputes, or prevent abuse. You may also designate an authorized agent to make a request on your behalf where applicable law allows.
Right to lodge a complaint
If you believe we've mishandled your personal information, you can complain to the relevant authority: California residents — the California Privacy Protection Agency (cppa.ca.gov) or California Attorney General; other US state residents — your state Attorney General; EEA residents — your local Data Protection Authority (list at edpb.europa.eu); UK residents — the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to address concerns directly first, but you're under no obligation to come to us before contacting an authority.
Security
Information is transmitted over HTTPS. Contact records, submissions, and votes are stored in our service provider's database (Postgres on Supabase), with submitted files in its object storage, and access is restricted to authenticated server requests. Submitted files are re-encoded on receipt, which both strips metadata and removes anything that might be embedded in a file pretending to be an image. No system is perfectly secure, but we take reasonable steps to protect the small amount of information we hold. If we ever experience a security incident that affects your personal information, we will notify you and any relevant authority where required by law.
Children
The site is intended for a general audience and is not directed to children. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA) and applicable digital-consent rules elsewhere. Some of our content — memes and quizzes in particular — may still appeal to younger readers, so to be clear about advertising: we do not knowingly serve personalized ads to anyone we know to be under 13, we do not ask for age or build age-based audiences, and we do not use the contact form to collect information from children. Sightings may not be submitted by anyone under 13, and we ask submitters not to send photographs of identifiable children without a parent or guardian's consent; tell us and we will remove any that reach us. If you believe a minor has provided us with personal information, or has been shown an ad you consider inappropriate, contact us and we will delete the information and report the ad.