Privacy Policy

HappyFish KC ("HappyFish KC," "we," "us," or "our") operates an online coral auction platform for customers in the United States. This Privacy Policy explains what information we collect, how we use and protect it, and the choices you have. By creating an account or using the platform, you agree to the practices described here. The "Last updated" date and version are shown at the end of this policy.

Information We Collect

We collect the following information when you register an account and use the platform:

• Account information — your email address, used to sign in, verify your account, and send notifications.
• Contact and shipping details — your name, shipping address, and phone number, used to fulfill and coordinate the delivery of items you win.
• Bidding activity — the bids you place, including proxy (maximum) bids, retained as the record of your auction activity.
• Account credentials — your password, which is stored only as a one-way bcrypt hash and is never accessible in readable form.
• Technical information — a first-party session cookie that keeps you signed in, and server logs that include your IP address and basic request metadata, retained for security and troubleshooting.

We do not knowingly collect more personal information than is necessary to operate the auctions and ship your orders.

How We Use Your Information

We use the information we collect to:

• Operate the auctions, including proxy bidding and winner determination.
• Create and send invoices for items you win.
• Send account and transactional messages such as account verification, outbid alerts, ending-soon notices, and win notifications.
• Protect the platform and our users against fraud, abuse, and unauthorized access.
• Comply with our legal obligations.

How We Share Your Information

We do not sell or rent your personal information. We share it only with the following service providers who help us operate the platform, and only as needed to provide their services:

• Square — when you win an auction, we create a customer record and issue an invoice through Square. Your name and email are passed to Square for this purpose. Payment card details are entered and processed entirely on Square's hosted page; we never see or store your card numbers. [Square Privacy Policy](https://squareup.com/us/en/legal/general/privacy)
• Resend — transactional and notification emails (account verification, outbid alerts, win notifications) are sent through Resend. [Resend Privacy Policy](https://resend.com/legal/privacy-policy)
• Railway — the auction application and its database are hosted on Railway's cloud infrastructure. Your account data and bidding history are stored on Railway-managed servers. [Railway Privacy Policy](https://railway.com/legal/privacy)
• Supabase — auction listing images are stored in Supabase Storage. [Supabase Privacy Policy](https://supabase.com/privacy)
• Stripe — we process payment webhook events through Stripe. Stripe does not receive your personal information in this context; only event metadata is exchanged. [Stripe Privacy Policy](https://stripe.com/privacy)

We may also disclose information if required by law, or to protect the rights, safety, and security of our users, the public, or HappyFish KC.

Cookies and Third-Party Services

The auction platform uses only first-party cookies that are necessary to keep you signed in. We do not use advertising, analytics, or cross-site tracking cookies, and we do not load any third-party tracking or analytics scripts at runtime. Website fonts are downloaded at build time and served from our own infrastructure — no requests are made to Google Fonts or any other font service when you use the platform.

The auction may appear embedded within the HappyFish KC storefront (happyfishkc.com), which is operated on Square Online. The storefront uses its own cookies and services, including analytics and advertising tools. Those services are governed by Square's and the respective providers' privacy practices, not this policy.

Because the auction runs in a cross-origin iframe, the storefront's scripts cannot read the contents of the auction or access your auction session. This isolation is enforced by your browser's same-origin security policy — it is not a configurable setting.

Data Security

We protect your personal information using industry-standard safeguards. Your name, shipping address, and phone number are encrypted at rest using AES-256-GCM, and your password is stored only as a one-way bcrypt hash. While no method of transmission or storage is completely secure, we take reasonable measures to protect your information against loss, misuse, and unauthorized access.

Data Retention

We retain your information for the following periods:

• Account data (name, email, shipping address, phone, password hash) — retained while your account is active. Following account deletion or a verified deletion request, personal data is removed within 30 days, except where retention is required to comply with legal obligations or resolve disputes.
• Bidding history — retained for the life of your account, as it constitutes the record of your auction activity and purchase history.
• Server logs (IP address, request metadata) — retained for up to 90 days for security and troubleshooting, then deleted.
• Invoice records — retained for as long as required to satisfy applicable tax and business record-keeping obligations.

You may request deletion of your personal data at any time by contacting us at HappyFishKC@gmail.com.

Your Privacy Rights

Subject to applicable law, including the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), you have the right to:

• Know what personal information we hold about you.
• Access a copy of that information.
• Request deletion of your personal information.
• Opt out of the sale of your personal information — we do not sell personal information.
• Opt out of the sharing of your personal information for cross-context behavioral advertising — we do not share personal information for advertising purposes.
• Correct inaccurate personal information we hold about you.

To exercise any of these rights, email us at HappyFishKC@gmail.com. We will not discriminate against you for exercising your rights.

Children's Privacy

The platform is intended for adults and is not directed to children under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us so we can remove it.

United States Only

The platform is offered to, and ships within, the United States only. It is not directed to users in the European Union or United Kingdom, and we make no representation that the platform is appropriate or available for use outside the United States.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the version identifier and "Last updated" date shown below. Your continued use of the platform after a change takes effect constitutes acceptance of the updated policy.

Contact Us

If you have any questions or requests regarding this Privacy Policy or your personal information, contact us at HappyFishKC@gmail.com.

Operated by HappyFish KC. Owner: Shane Barnard.