Privacy Policy

Cookies we set

We set the analytics cookies below on your first visit, unless your browser sends a Global Privacy Control or Do Not Track signal (see "Your choices"). They hold randomly generated identifiers only — no name, email address, or anything else that identifies you by itself.

• _reef_labs_visitor_uuid — 1 year

  A random visitor ID, so repeat visits can be counted as one visitor rather than many.

• _reef_labs_session_uuid — 30 minutes

  A random session ID that groups the pages of a single visit. It is refreshed as you browse, so it expires 30 minutes after you stop.

• announcement_seen_<id> — 30 days

  Remembers that you dismissed a site announcement so we do not show you the same notice again.

We also use a standard session cookie required for the site to function securely (for example, cross-site request forgery protection and, if you have one, your signed-in session). If you tick "stay logged in" when signing in to an account on this site, a _reef_labs_website_web_user_remember_me cookie keeps you signed in for up to 14 days.

What we record as you browse

For each page you open we store:

• the page address and title, and the time of the visit;
• the referring URL, if you arrived from a link;
• any campaign parameters in that link (utm_source, utm_medium, utm_campaign, utm_term, utm_content);
• your browser's user-agent string, and the browser, operating system and device type we read from it;
• a keyed HMAC-SHA256 hash of your IP address. We do not store raw IP addresses. The hash lets us spot duplicate or abusive traffic without keeping the address itself;
• if you are signed in to an account on this site, which account it was.

Engagement measurements

Our own script also measures how a page is used, so we can tell which pages are actually helpful. Per page, it records:

• time spent on the page and how far down you scrolled;
• counts of clicks, mouse movements and key presses — a running total only. We never record which keys you press or anything you type;
• which buttons and links you clicked — recorded as the control's visible text, its HTML id and class names, and for links the destination, including the address of an outbound link that takes you off our site;
• when you place the cursor in a form field, recorded as the field's name and type only (for example "email", "text"). The value you enter is never sent by this script;
• that a form was submitted, and which form;
• when a video on the page is started or played to the end.

This is first-party analytics: the data goes to our own servers. There are no third-party advertising networks, ad pixels, social-media trackers, or data brokers on this site.

Information you give us

Contact form. When you write to us we store your name, email address, subject and message, together with the hashed IP address of the submission. Because you submitted it from a browsing session, the message is linked to the visitor and session records described above — so when we answer you, we can see the pages that prompted the question. We use this to reply to you and to keep a record of the inquiry, and we keep it as long as needed to respond and for business records.

Accounts. Accounts on this website are for Reef Labs staff; your test results live in the separate customer portal at app.reef-labs.com (see above). For staff accounts we store the email address and send transactional email only — sign-in links and confirmations of account changes.

How long we keep it

Analytics records are deleted on a fixed schedule: detailed engagement events after 90 days, page views after 180 days, visit sessions after one year, and a visitor record two years after that visitor was last seen. Daily summary statistics that are not tied to any individual visitor are kept for three years. Messages you send us are kept as long as needed to respond and for business records.

Who else sees it

We do not sell, rent, or trade your information, and we do not share it with advertisers. We use service providers to host this site (Fly.io) and deliver our email (Postmark), and they process data only on our instructions. We may disclose information if the law requires it, or to protect the safety and rights of Reef Labs, our customers, or the public.

Your choices

• Global Privacy Control and Do Not Track. If your browser sends a Global Privacy Control or Do Not Track signal, we honor it: we set no analytics cookies and record nothing described under "What we record as you browse". Only the cookies the site needs to work are used.
• You can block or delete cookies in your browser settings. If you do, we simply treat you as a new visitor next time; the site keeps working.
• You can ask us what we hold about you, ask us to correct it, or ask us to delete it. Email info@reef-labs.com and we will respond. We will not treat you differently for asking.
• We do not sell personal information, so there is nothing for you to opt out of on that front.

Security and children

This site is served over HTTPS, IP addresses are pseudonymized before storage, and access to the data behind it is limited to authenticated Reef Labs administrators. No system is perfectly secure, so we cannot guarantee absolute security.

This site is not directed to children under 13, and we do not knowingly collect information from them. If you believe a child has sent us information, email us and we will delete it.

Changes and contact

If we change this policy we will update the date at the top of this page. Continuing to use the site after a change means you accept the updated policy.

See also our Terms of Service .