Our commitments

What LOCUS does with your data, and what it doesn't. Each point describes the app as it is today and can be checked. If anything changes, it will be announced ahead of time in the Release notes.

🔒 Your data

• Stored in Canada: database, sign-in and photos at Supabase, ca-central-1 region (Montreal). Supabase and GitHub are, however, American companies.
• Communications go over HTTPS, and each account only sees its own data (row-level security, enabled on every table of the database).
• Customer data entered in the app (name, contact details) is additionally encrypted server-side.
• Public links (shared record, QR, storefront) never show the purchase price, the buyer or the animals' location.
• You can export everything at any time, for free: full backup, Excel, PDF. You can delete your account yourself.
• Your data is also kept on your device: LOCUS works offline.
• Photos are stored in a space with public addresses: anyone who has the exact address of a photo can see it. This is needed, for example, for the MorphMarket export.

👁 No tracking

• No visitor analytics or advertising tools: no Google Analytics, no Facebook pixel, no advertising cookies.
• No downloaded fonts. LOCUS uses the fonts already installed on your device. No request goes to Google Fonts, so your IP address isn't sent there. It's not a detail: in 2022, a German court (Munich) ruled that passing a visitor's IP address to Google Fonts without consent breached the GDPR.
• The libraries the app uses (Supabase sign-in, reading Excel files) are served by our own site, not by an external service.
• The Google and Bing tags in the page only prove the site is ours (Search Console). They don't track anyone.
• The developer has a restricted dashboard that shows, for each account: the email, the sign-up date, the last sign-in and the number of animals, pairings and clutches. No price, buyer, location or record content appears in it. Page visits are not measured.
• Maintenance. To fix a problem or improve the app (for example, checking that an import went well), the developer may look at an account's data. That data is never sold, shared or used for anything else.

🤝 External services: the full list

• GitHub Pages hosts the site. Like any host, it receives your IP address when you open a page.
• Supabase stores your data, sign-in and photos, in Canada. Like any online service, it receives the IP address and device type of each request, which appear in its technical logs.
• qrserver.com produces the image of QR codes (tub labels, shared record). It receives the address encoded in the code (an animal's or rack's internal ID, or the public link of the shared record) and the device's IP address, only when a QR code is generated.
• Stripe processes payments. Subscriptions aren't active yet. A user can connect their own Stripe account (My profile › Payments): they are then redirected to Stripe's site, which receives their information directly. LOCUS only keeps the Stripe account ID.
• Zoho Mail hosts the support@locusscales.com mailbox: emails exchanged with the developer go through it.
• Namecheap manages the domain names (locusscales.com and locusscales.ca).
• External links (MorphMarket, World of Ball Pythons, sources) are only contacted if you tap the link.

📣 No aggressive marketing

• No paid ads, no fake reviews, no fake engagement.
• No countdowns or fake urgency to make you pay.
• LOCUS emails are sent from support@locusscales.com and only to confirmed accounts. Unsubscribed accounts are left out; just ask at that address.
• Tiers are announced ahead of time. Reliability, offline mode, backup, export and installation stay free.
• Your data is neither sold nor used for advertising.

🧬 Transparency

• Genetics: Morphpedia as the main source, World of Ball Pythons as a complement. When something isn't certain, it says so (documented, reported by the community, uncertain).
• Every visible change is described in the Release notes, in English and French — error fixes too.
• A single developer, reachable directly in the app (☰ menu › Contact us).