Privacy Policy
Last updated 12 October 2026
Short version: you can use petral without an account and without being tracked. If you make an account we keep your username, email and a hashed password. Analytics only run if you accept them, and they are anonymous. We do not sell data or show ads.
What we collect
If you browse
- Technical data. Like any website, our hosting provider receives your IP address and browser details with each request. We use IP addresses briefly to rate-limit abuse; we do not build profiles from them.
- Settings on your device. Your board layout, panel choices and cached data are kept in your own browser (see Cookies below).
- Analytics, only with consent. If you accept, anonymous page views and a few named actions (for example, that an account was created) are counted. No cookies are used for this and no personal details are attached.
If you create an account
- Your username and email address.
- Your password, stored only as a salted one-way hash (PBKDF2), never in plain text.
- When the account was created, when you last signed in, and preferences you choose to save, such as your board layout.
- A short-lived verification code while you confirm your email or reset your password. Codes expire after 15 minutes.
If you sign up for email
- Your email address and whether you have confirmed it. You can opt in when creating an account, or separately. An unconfirmed sign-up is deleted after 7 days.
How we use it
- To run your account: sign you in, keep you signed in, and let you reset your password.
- To send the emails you asked for, and account emails such as verification codes.
- To protect the service against abuse.
- With consent, to understand which parts of petral are used.
We do not sell or rent personal data, and we do not use it for advertising.
Who processes it
petral relies on a small number of providers, who process data on our behalf:
- Vercel: hosting, and the anonymous analytics if you accept them.
- Upstash: the database that stores accounts and email subscriptions.
- Resend: email delivery.
These providers may process data outside your country, under their own safeguards.
How long we keep it
- Account data: until you delete your account. Deleting it from account settings removes your account record and signs out every device.
- Email subscription: until you unsubscribe with the link in any email. It is separate from your account, so deleting an account does not unsubscribe you.
- Data stored in your browser: until you clear it.
Your rights
You can ask to see, correct, export or delete the personal data we hold about you, or object to how it is used. Most of this you can do yourself from account settings; for anything else, email contact@petral.xyz. You may also complain to your local data protection authority.
Cookies and local storage
petral uses two cookies and some browser storage. Everything below is necessary for the site to work, except analytics, which only runs if you accept it.
| NAME | PURPOSE | TYPE |
|---|---|---|
| petral_session | Keeps you signed in. Set by petral, HTTP-only and secure; it lasts 30 days and is renewed while you use the site. | Necessary |
| petral_pg | Set when you open a page, so the site can tell its own pages from automated scrapers. HTTP-only, holds no personal data, lasts a day. | Necessary |
| Signed-in profile | Your username and email, so you stay signed in on screen if the server is briefly unreachable. Removed when you sign out. | Necessary |
| petral.consent | Remembers your answer to the cookie banner. | Necessary |
| Layout and preferences | Your board layout, map layers, Learn settings and whether you have seen the intro. | Necessary |
| Data cache | Recent data responses, so pages load quickly and work briefly offline. | Necessary |
| Vercel BotID | When a page loads data, an invisible check run by our host, Vercel, looks at signals from your browser to tell people from bots. Sets no cookie and is not used for tracking or advertising. | Necessary |
| Vercel Web Analytics | Anonymous page view counts. Sets no cookie. | Optional |
You can change your answer at any time:
Children
petral is not directed at children under 16, and we do not knowingly collect their data.
Changes
If this policy changes, the date at the top will change with it. Significant changes affecting account holders will be announced on the site. See also the Terms of Service.