Effective: May 2026 · Last updated: July 2026
Grumpycapy.com is operated by Data Sauna LLC, a single-member limited liability company formed in the State of Wyoming, United States, with a registered office at 30 N Gould St, Ste R, Sheridan, WY 82801, USA. For the purposes of this policy, Data Sauna LLC is the "business" under the CCPA/CPRA and the "data controller" under the EU and UK GDPR. Personal information is stored and processed in the United States; if you are outside the US, by using the site you understand your information is transferred to and processed there. This policy should be read together with our Cookie Policy, which lists every cookie and browser-storage entry and the legal basis for each.
What we collect
Grumpy Capy collects the personal information you choose to provide when you subscribe to the newsletter or contact us. This may include your email address, name or handle, contact topic, and the contents of your message. We also log IP addresses and related request metadata that help us prevent abuse, rate-limit form submissions, and protect the site.
How we use it
We use newsletter sign-up data to send editorial updates, product picks, and related site emails you requested. We use contact-form data to respond to your message, review corrections or pitches, and maintain basic records of site communications. We do not sell or rent personal information, and we do not share it with third parties for their own marketing purposes.
Retention
We keep newsletter subscriber data until you unsubscribe, ask us to delete it, or we decide it is no longer needed for operating the newsletter. We keep contact submissions for as long as reasonably necessary to respond, maintain records of correspondence, prevent abuse, and address legal or operational issues. IP logs and similar anti-abuse records are retained only for as long as reasonably necessary for security, fraud prevention, rate limiting, and troubleshooting.
Affiliate links
Some Amazon and Etsy product links are affiliate links. If you click through and buy something, Grumpy Capy may earn a commission at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.
These affiliate relationships do not control our editorial selections. Clicking an affiliate link may result in marketplace-side tracking, attribution, or cookie-based measurement handled by Amazon, Etsy, or their affiliate providers under their own policies.
Cookies and analytics
We use a small, layered set of measurement tools. When you first visit, a banner asks you to accept or reject non-essential cookies. Nothing in the consent-gated categories below runs until you press Accept, and you can change your mind at any time using the Cookie settings link in the footer. The Cookie Policy has the full table, including cookie names, durations, and legal bases.
Cookieless, for everyone (no consent required). Two tools run for every visitor and set no cookies, no localStorage, and no device identifier: Vercel Analytics and Cloudflare Web Analytics. They collect anonymized, aggregate page-view metadata (page URL, referrer, rough country, device type, browser) and never build individual profiles. Because nothing is stored on or read from your device, no consent prompt is required; the lawful basis is our legitimate interest.
Google Analytics 4 (consent mode). GA4 runs for every visitor, but by default — before you accept — it operates in Google Consent Mode v2 in a cookieless "consent denied" state: it sets no _ga cookie and uses no persistent identifier, sending only anonymized, aggregated pings (legitimate interest). It sets cookies and enables full measurement only after you accept (your consent). Rejecting, or later withdrawing consent, downgrades it back to the cookieless state for the rest of the session.
Consent-gated tools (load only after you accept). If you accept, we also load Microsoft Clarity — heatmaps and session replay, with typed input masked by default — and may load the Meta (Facebook) Pixel to measure whether our social posts and ads bring people to the site. These do not load at all unless you accept, and they set their own cookies only after that point. Their lawful basis is your consent, which is optional and withdrawable at any time.
Third-party marketplaces you visit after leaving this site (such as Amazon or Etsy) may use their own cookies, tracking technologies, or attribution tools under their own notices and controls.
Embedded Instagram content. A few pages embed public posts from Instagram (for example, a venue's Instagram in our capybara-encounters directory). These embeds load directly from Instagram, whose embed script can set Instagram's own cookies and read device storage on Instagram's domain when the embed loads. Because an embed is part of the content you chose to view, it can load before you make a cookie choice and is not part of our consent-gated analytics or advertising. It is governed by Meta/Instagram's own privacy notice; to prevent it, block third-party cookies or scripts in your browser.
Grumpy Capy also uses your browser's local and session storage for strictly functional things — remembering your cookie choice, whether you've already seen our newsletter popup, whether you're signed up, and how many pages you've viewed in the current session. This is not used for advertising, profiling, or cross-site tracking. You can clear it at any time via your browser's site-data settings.
Third-party services
We use service providers that help us run the site: hosting and infrastructure (Vercel, including Vercel Analytics and Speed Insights), a cookieless traffic counter (Cloudflare Web Analytics), analytics (Google Analytics 4, Microsoft Clarity), advertising measurement (Meta Pixel), embedded social content (Instagram, on pages that show an embedded post), and database/form storage (Supabase). These providers process personal information on our behalf, or as independent controllers for their own cookies once you consent, to host the site, store submissions, deliver functionality, measure traffic, maintain security, and support operations. See the Cookie Policy for links to each provider's own privacy notice.
International data transfers
Our service providers are based in the United States. When personal information is transferred from the EEA, UK, or Switzerland to the US, we rely on appropriate safeguards under GDPR Art. 46 — typically the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or the EU–US Data Privacy Framework where the provider is certified. Each provider's own privacy page (linked via the Cookie Policy) describes the transfer mechanism it offers.
Sale and sharing of personal information
We do not sell personal information for money. If you accept cookies and we are running the Meta (Facebook) Pixel, that use may qualify as a "sale" and/or "sharing" for cross-context behavioral advertising under the CCPA/CPRA. You can opt out at any time using the Cookie settings link in the footer to reject cookies, and we honor the Global Privacy Control (GPC) signal as a valid opt-out request consistent with applicable law. If you do not accept cookies, we do not sell or share your information for advertising and there is nothing to opt out of. We do not knowingly sell or share the personal information of consumers under 16.
Your rights
You have rights over the personal information we hold about you, and we honor these for everyone regardless of jurisdiction:
- Access — request a copy of, or details about, the information we hold about you.
- Correct — ask us to fix inaccurate information.
- Delete — ask us to delete your information.
- Portability — ask for your information in a structured, machine-readable format.
- Opt out of sale or sharing — via the Cookie settings footer link or a GPC signal, as described above.
- Non-discrimination — we will not penalize you for exercising any privacy right.
- For EU/UK visitors — the rights to restriction, objection, and to withdraw consent at any time (with no effect on the lawfulness of past processing).
To exercise any of these, use the contact page (or unsubscribe via the link in any newsletter email). We may need to verify a request before completing it, and we may keep limited information where reasonably necessary to document the request, comply with law, resolve disputes, or prevent abuse. You may also designate an authorized agent to make a request on your behalf where applicable law allows.
Right to lodge a complaint
If you believe we've mishandled your personal information, you can complain to the relevant authority: California residents — the California Privacy Protection Agency (cppa.ca.gov) or California Attorney General; other US state residents — your state Attorney General; EEA residents — your local Data Protection Authority (list at edpb.europa.eu); UK residents — the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to address concerns directly first, but you're under no obligation to come to us before contacting an authority.
Security
Information is transmitted over HTTPS. Newsletter and contact records are stored in our service provider's database (Postgres on Supabase) with access restricted to authenticated server requests. No system is perfectly secure, but we take reasonable steps to protect the small amount of information we hold. If we ever experience a security incident that affects your personal information, we will notify you and any relevant authority where required by law.
Children
The site is intended for a general audience and is not directed to children. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA) and applicable digital-consent rules elsewhere. If you believe a minor has provided us with personal information, contact us and we will delete it.