Effective: May 2026 · Last updated: July 2026
Grumpycapy.com is operated by Data Sauna LLC, a single-member limited liability company formed in the State of Wyoming, United States, with a registered office at 30 N Gould St, Ste R, Sheridan, WY 82801, USA. For the purposes of this policy, Data Sauna LLC is the "business" under the CCPA/CPRA and the "data controller" under the EU and UK GDPR. Personal information is stored and processed in the United States; if you are outside the US, by using the site you understand your information is transferred to and processed there. This policy should be read together with our Cookie Policy, which lists every cookie and browser-storage entry and the legal basis for each.
What we collect
Grumpy Capy collects the personal information you choose to provide when you subscribe to the newsletter or contact us. This may include your email address, name or handle, contact topic, and the contents of your message. We also log IP addresses and related request metadata that help us prevent abuse, rate-limit form submissions, and protect the site. Separately, the analytics and advertising tools described under "Cookies and analytics" below collect information automatically when you browse — IP address, approximate location, device and browser details, pages viewed, referrer, and, for advertising, identifiers stored on your device. Google receives that information for ad serving on every page, whether or not you accept cookies.
How we use it
We use newsletter sign-up data to send editorial updates, product picks, and related site emails you requested. We use contact-form data to respond to your message, review corrections or pitches, and maintain basic records of site communications. We never sell or rent the information you give us directly: your email address, name, and the contents of your message are not passed to anyone for their own marketing. Advertising and analytics are separate — the tools described under "Cookies and analytics" below receive information about your visit, and if you accept cookies that may count as a "sale" or "sharing" of personal information under California law. See "Sale and sharing of personal information" for what that means and how to opt out.
Retention
We keep newsletter subscriber data until you unsubscribe, ask us to delete it, or we decide it is no longer needed for operating the newsletter. We keep contact submissions for as long as reasonably necessary to respond, maintain records of correspondence, prevent abuse, and address legal or operational issues. IP logs and similar anti-abuse records are retained only for as long as reasonably necessary for security, fraud prevention, rate limiting, and troubleshooting.
Affiliate links
Some Amazon and Etsy product links are affiliate links. If you click through and buy something, Grumpy Capy may earn a commission at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.
These affiliate relationships do not control our editorial selections. Clicking an affiliate link may result in marketplace-side tracking, attribution, or cookie-based measurement handled by Amazon, Etsy, or their affiliate providers under their own policies.
Cookies and analytics
We use a small, layered set of measurement tools. When you first visit, a banner asks you to accept or reject non-essential cookies. Apart from Google AdSense — which serves ads for everyone, non-personalized until you accept — nothing in the consent-gated categories below runs until you press Accept, and you can change your mind at any time using the Cookie settings link in the footer. The Cookie Policy has the full table, including cookie names, durations, and legal bases.
Cookieless, for everyone (no consent required). Two tools run for every visitor and set no cookies, no localStorage, and no device identifier: Vercel Analytics and Cloudflare Web Analytics. They collect anonymized, aggregate page-view metadata (page URL, referrer, rough country, device type, browser) and never build individual profiles. Because nothing is stored on or read from your device, no consent prompt is required; the lawful basis is our legitimate interest.
Google Analytics 4 (consent mode). GA4 runs for every visitor, but by default — before you accept — it operates in Google Consent Mode v2 in a cookieless "consent denied" state: it sets no _ga cookie and uses no persistent identifier, sending only anonymized, aggregated pings (legitimate interest). It sets cookies and enables full measurement only after you accept (your consent). Rejecting, or later withdrawing consent, downgrades it back to the cookieless state for the rest of the session.
Consent-gated tools (load only after you accept). If you accept, we also load Microsoft Clarity — heatmaps and session replay, with typed input masked by default — and may load the Meta (Facebook) Pixel to measure whether our social posts and ads bring people to the site. These do not load at all unless you accept, and they set their own cookies only after that point. Their lawful basis is your consent, which is optional and withdrawable at any time.
Advertising (Google AdSense). Display ads on this site are served by Google AdSense, which pays for running the site, so its script loads for every visitor, before and regardless of your cookie choice. Until you accept, we ask Google for non-personalized ads — selected from general context such as the page and approximate location rather than a profile of your browsing history — and Google's Consent Mode v2 signals for ad storage, ad user data, and ad personalization are set to denied. Non-personalized still involves storage: Google may set cookies on grumpycapy.com (for example __gads and __gpi) and on its own domains, and read device storage, for frequency capping, ad measurement, and invalid-traffic detection. Accepting cookies upgrades AdSense to personalized ads from your next page view; rejecting keeps them non-personalized.
Google requires AdSense publishers to state the following, so to put it plainly: third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or to other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the internet. You can opt out of personalized advertising by visiting Google Ads Settings (My Ad Center), and you can opt out of some third-party vendors' use of cookies for personalized advertising at aboutads.info/choices, or at youronlinechoices.eu in Europe. Opting out this way stops the personalization, not the ads themselves.
Visitors in the EEA, the UK, and Switzerland see an additional consent message from Google before any ad personalization. Google requires a certified consent management platform in those regions, and we use Google's own, which records your choice under the IAB Transparency and Consent Framework (TCF v2.2). Our own cookie banner stays hidden there, so you get one prompt rather than two, and we read that same TCF signal to decide whether to run Google Analytics' cookie-based mode, Microsoft Clarity, and the Meta Pixel. In those regions Google's message is the consent record for everything on this page, not only for ads. An honest note on the limits: the AdSense script still runs before you make a choice, and ad serving involves device storage even in non-personalized mode, so a strict reading of the ePrivacy rules would require consent for that as well. See the Cookie Policy for how to block ad-related storage entirely.
Third-party marketplaces you visit after leaving this site (such as Amazon or Etsy) may use their own cookies, tracking technologies, or attribution tools under their own notices and controls.
Embedded Instagram content. A few pages embed public posts from Instagram (for example, a venue's Instagram in our capybara-encounters directory). These embeds load directly from Instagram, whose embed script can set Instagram's own cookies and read device storage on Instagram's domain when the embed loads. Because an embed is part of the content you chose to view, it can load before you make a cookie choice and is not part of our consent-gated analytics or advertising. It is governed by Meta/Instagram's own privacy notice; to prevent it, block third-party cookies or scripts in your browser.
Grumpy Capy also uses your browser's local and session storage for strictly functional things — remembering your cookie choice, whether you've already seen our newsletter popup, whether you're signed up, and how many pages you've viewed in the current session. This is not used for advertising, profiling, or cross-site tracking. You can clear it at any time via your browser's site-data settings.
Third-party services
We use service providers that help us run the site: hosting and infrastructure (Vercel, including Vercel Analytics and Speed Insights), a cookieless traffic counter (Cloudflare Web Analytics), analytics (Google Analytics 4, Microsoft Clarity), advertising (Google AdSense) and advertising measurement (Meta Pixel), embedded social content (Instagram, on pages that show an embedded post), and database/form storage (Supabase). These providers process personal information on our behalf, or as independent controllers for their own cookies once you consent, to host the site, store submissions, deliver functionality, measure traffic, maintain security, and support operations. See the Cookie Policy for links to each provider's own privacy notice.
International data transfers
Our service providers are based in the United States. When personal information is transferred from the EEA, UK, or Switzerland to the US, we rely on appropriate safeguards under GDPR Art. 46 — typically the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, and/or the EU–US Data Privacy Framework where the provider is certified. Each provider's own privacy page (linked via the Cookie Policy) describes the transfer mechanism it offers.
Sale and sharing of personal information
We do not sell personal information for money, and we do not disclose your email address, name, or message contents to anyone for their own marketing. Advertising works differently: if you accept cookies, personalized advertising through Google AdSense and the Meta (Facebook) Pixel, where we run it, involves disclosing online identifiers and browsing activity to those companies, and under the CCPA/CPRA that likely qualifies as a "sale" and/or "sharing" for cross-context behavioral advertising. You can opt out at any time using the Cookie settings link in the footer to reject cookies. We also treat a Global Privacy Control (GPC) signal from your browser as a valid opt-out that overrides a stored Accept: when GPC is present we keep advertising non-personalized and do not load the consent-gated tools, on every page load, without you having to do anything else. If you do not accept, ads stay non-personalized: Google still receives your IP address, user agent, and the page you are viewing in order to serve and measure an ad and detect invalid traffic, but that data is not used to build cross-context advertising profiles with our authorization, and we do not otherwise sell or share your information. We do not knowingly sell or share the personal information of consumers under 16.
Your rights
You have rights over the personal information we hold about you, and we honor these for everyone regardless of jurisdiction:
- Access — request a copy of, or details about, the information we hold about you.
- Correct — ask us to fix inaccurate information.
- Delete — ask us to delete your information.
- Portability — ask for your information in a structured, machine-readable format.
- Opt out of sale or sharing — via the Cookie settings footer link or a GPC signal, as described above.
- Non-discrimination — we will not penalize you for exercising any privacy right.
- For EU/UK visitors — the rights to restriction, objection, and to withdraw consent at any time (with no effect on the lawfulness of past processing).
To exercise any of these, use the contact page (or unsubscribe via the link in any newsletter email). We may need to verify a request before completing it, and we may keep limited information where reasonably necessary to document the request, comply with law, resolve disputes, or prevent abuse. You may also designate an authorized agent to make a request on your behalf where applicable law allows.
Right to lodge a complaint
If you believe we've mishandled your personal information, you can complain to the relevant authority: California residents — the California Privacy Protection Agency (cppa.ca.gov) or California Attorney General; other US state residents — your state Attorney General; EEA residents — your local Data Protection Authority (list at edpb.europa.eu); UK residents — the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to address concerns directly first, but you're under no obligation to come to us before contacting an authority.
Security
Information is transmitted over HTTPS. Newsletter and contact records are stored in our service provider's database (Postgres on Supabase) with access restricted to authenticated server requests. No system is perfectly secure, but we take reasonable steps to protect the small amount of information we hold. If we ever experience a security incident that affects your personal information, we will notify you and any relevant authority where required by law.
Children
The site is intended for a general audience and is not directed to children. We do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA) and applicable digital-consent rules elsewhere. Some of our content — memes and quizzes in particular — may still appeal to younger readers, so to be clear about advertising: we do not knowingly serve personalized ads to anyone we know to be under 13, we do not ask for age or build age-based audiences, and we do not use the newsletter or contact form to collect information from children. If you believe a minor has provided us with personal information, or has been shown an ad you consider inappropriate, contact us and we will delete the information and report the ad.