Privacy Policy
Fishician® ("Fishician", "we", "us") is an aquarium companion application that helps hobbyists manage aquariums, track fish and water parameters, get AI-assisted care suggestions, and participate in an aquarium community. We are organized in Wyoming, operate from Illinois, United States, and serve users worldwide. This policy explains what personal data we collect, why, how long we keep it, and the choices and rights available to you. Legal rights depend on the law and circumstances that apply to your data, including the EU/UK General Data Protection Regulation (GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA), and other applicable privacy laws.
Data controller: FISHICIAN LLC
Registered-agent mailing address:
c/o Registered Agents Inc
30 N Gould St, Ste R
Sheridan, WY 82801
USA
Privacy contact: privacy@fishician.app
1. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account identifiers | Email address, display name, hashed password, optional avatar | You, at registration |
| Product-update preferences | Separate email and in-app choices, consent policy and timestamp, revision and email opt-out status. Unsubscribe links use temporary opaque credentials; they do not put your address in the URL. | Your explicit choices in Settings or an unsubscribe action |
| Aquarium records | Tanks, fish, equipment, water test logs, maintenance tasks, photos you add | You, in the app |
| Community content | Posts, comments, photos, videos, group and forum activity, direct messages | You, in community areas |
| AI and Finn requests | Text and images you submit to AI features, AI responses, signed-in Finn conversations, optional notes derived from future finished chats after you enable the Finn notebook, facts you explicitly approve for Finn memory, selected saved-result references, and a limited current-page context such as the Fishician route, selected aquarium ID, and supported actions | You, when using AI tools; limited aquarium and app context from your authenticated account; separate choices for optional memory |
| Security and device data | Session tokens, IP-derived security events, sign-in history, two-factor settings | Generated when you use the service |
| Optional product analytics | Account ID, event and timestamp, desktop/mobile-browser/PWA surface, feature area and limited event labels, such as a tool opening or a retailer-link click | First-party feature-use events, only after a current account analytics choice is confirmed (see Section 3) |
| Preferences | Cookie/privacy choices, display settings | You |
| Subscription and payment records | Stripe customer, purchase, invoice and payment identifiers; plan, billing interval, paid amounts and tax, funded access dates, renewal consent and cancellation status; refund requests and their reasons, refund and dispute status, bank refund tracking references, issuer fraud warnings, and complimentary grants with their reason, expiration and administrative audit history. These records do not contain your full card number or security code. | You, Stripe, and authorized Fishician administrators |
Fishician accounts are limited to users 13 and older. We do not knowingly collect personal data from children under 13. If you believe a child has provided personal data, contact privacy@fishician.app so we can investigate and address it. Additional protections or parental authorization may be required by the law that applies to a young person's use.
Voice: Finn's voice features are optional; you can always type and read the same interaction instead. Voice chat (signed-in accounts) streams your microphone audio to Fishician's Cloudflare-hosted servers only while a call is open. It is transcribed live by speech models run on Cloudflare Workers AI, which also generate Finn's spoken replies. Fishician does not record or store the audio; the text of each turn is saved in your Finn conversation, like a typed message.
Public reference images: Some images and thumbnails load directly from Wikipedia/Wikimedia or another permitted external image host. Displaying an external image contacts its host even if you have not clicked an external link. The host receives ordinary request information, including your IP address, browser/user-agent information and any referrer permitted by browser and page policy. These requests are separate from optional Fishician product analytics and retailer-link navigation. Mirrored catalog images are served through Fishician.
Finn notebook: This optional feature is off by default. If you enable it in Finn's memory controls after reviewing its explanation, Cloudflare Workers AI models create up to 12 short notes from future finished chats, such as a tank problem and its outcome or how you prefer answers. Existing chats and unapproved older notes are not added when you first enable it. You can read notes, remove individual notes, clear the notebook or turn it off. Turning it off stops new notes and requests deletion of the notebook; a pending or failed deletion is not confirmation that the notes were erased. An off setting alone does not confirm deletion of notes saved under an earlier release. Those notes remain encrypted and unavailable to Finn until a successful removal or expiry cleanup. Use Delete previously saved notes in Finn's memory controls to request removal while keeping the notebook off. If an action cannot be confirmed, check the saved state and retry. Clearing notes leaves the feature's on/off choice unchanged. Neither action deletes your conversation history or separately approved facts. Notes are encrypted; common email, phone and payment-number patterns are rejected. Notes expire after 180 days without an update and are removed through expiry checks and scheduled cleanup.
2. Why we process it (legal bases)
- Provide the service (contract): aquarium tracking, community features, AI tools you request, support.
- Finn notebook (consent): optional notes from future finished chats after your explicit choice. You can refuse or turn it off without losing typed chat or requested conversation history.
- Optional Finn memory (consent): use only facts and saved AI-result references you approve for future signed-in Finn conversations. Memory is off by default and can be disabled or cleared in Finn.
- Security and abuse prevention (legitimate interest / legal obligation): authentication, rate limiting, fraud and abuse detection, audit logs.
- Content moderation (legitimate interest / legal obligation): automated and manual review of community content for safety.
- Product improvement (consent): optional first-party feature-use analytics. Refusal does not prevent account, aquarium, community or requested AI features.
- Advertising: advertising code is disabled in this release, including the public guide articles. A privacy choice does not activate advertising.
3. Cookies and similar technologies
Cookies and local storage support sign-in, account security, settings you request and local recovery functions. These service functions are separate from optional product analytics. Blocking required storage in your browser may prevent those functions from working.
Unfinished sharing on this browser
When you choose to create or stop a public Health Scan summary, this browser keeps a small recovery record so you can check an unfinished request after navigating away or reloading. For unfinished requests, it contains your account identifier, the request identifier and a digest used to match the request. When you stop an existing public link, it also keeps that public link’s identifier. That identifier can reconstruct the public URL; it is not anonymous. These records do not contain your photo, assessment text, notes or sign-in credentials. The digest is not encrypted or anonymous: someone with access to this browser's site storage may be able to infer the broad assessment category, particularly when no photo or saved assessment was associated with the request.
These records remain on this browser after sign-out until you resolve or explicitly remove them. Another signed-in account does not see them in Fishician. Use Check unfinished sharing in Health Scan to review or remove this account's recovery records. Removing a browser record does not stop a server request or public link; an earlier request may still finish. You can manage existing links under Shared health summaries. Clearing Fishician site data in your browser also removes these local records. Browser storage can be unavailable or automatically cleared, so recovery is not guaranteed across devices, browser profiles or private sessions. If storage is unavailable, Fishician still attempts your confirmed stop action and remembers it on the current open page. Other open windows receive a best-effort stop notification containing only account and request or link identifiers. Browser restrictions can prevent this communication, and unsaved recovery can be lost when you reload the page, restart the app or browser, or end the signed-in session. This functional recovery storage and same-origin communication are separate from optional analytics.
Optional product analytics and your choices
Optional product analytics is off until a current account choice is confirmed by the server. It records the limited first-party feature-use events listed in Section 1, rather than chat text, tank records or full destination URLs. It does not create guest analytics identifiers or collect optional product events from signed-out visitors.
Use Accept or Decline in the optional-analytics banner or Privacy choices in Settings → Privacy. These buttons save the choice directly, without another Save step. Guests do not generate these first-party account events, so no account-analytics consent banner is shown to guests. Account choices apply to the signed-in account; previously saved signed-out choices are stored on that device and do not grant account consent. Signing in loads that account's choices. These optional events stay off on a device while a choice is pending or cannot be confirmed. Decline stops them on that device immediately. If a withdrawal fails to save, you must retry to confirm the account change for other devices. Withdrawing does not automatically erase earlier records; their retention and your deletion rights are described below.
Advertising code is disabled in this release, in the application and generated public guide pages. We keep sale/share opt-out controls available and honor the Global Privacy Control (GPC) signal for that opt-out. GPC does not delete an account, change public profile or tank visibility, or replace the separate optional-analytics choice.
4. Advertising and affiliate links
Advertising code is disabled in this release. Fishician includes affiliate links to participating retailers. Opening a retailer link takes you to that retailer's site, where its privacy policy and storage practices apply. Fishician does not put your account records in retailer links. Affiliate relationships do not determine care guidance, compatibility results or editorial conclusions. See our Advertising & Affiliate Disclosure.
5. Who we share data with
- Infrastructure: Cloudflare, Inc. (hosting, storage, AI inference) processes data on our behalf.
- Subscription payments: Stripe processes purchases, optional recurring subscriptions, payments, invoices and billing-management requests. Fishician sends Stripe your account email and an account identifier to associate purchases with your account. You enter payment information directly on Stripe-hosted pages; Fishician does not receive or store your full card number or security code. Fishician stores verified financial records so it can provide purchased access, prevent duplicate credits or refunds, investigate fraud and resolve payment issues. Stripe handles payment information under its Privacy Policy.
- Product analytics: optional first-party events are processed on Fishician's Cloudflare infrastructure and are available to authorized Fishician administrators for product measurement.
- Email delivery: providers for verification, security codes and billing notices. Optional product-update email requires a separate email preference; analytics consent, account registration and care-reminder settings do not grant it.
- AI processing: AI requests are processed by models run on Cloudflare Workers AI and, for some features, Google's Gemini API. Finn conversation content is stored as encrypted, account-owned data for cross-device continuity; operational Finn logs contain message length and persistence status, not conversation text. Other operational AI logs are redacted of common emails, phone numbers, and identifiers before storage. When you explicitly save an AI result, the saved-history record retains the prompt or upload context you supplied so you can understand and reopen that result; you can delete individual saved results or your account.
- Aquatic references: Finn may look up public organism or topic names from your messages using Wikipedia and Seriously Fish. These lookups send only the selected public topic names, not your tank data, account details, or chat history. Answers that use retrieved references include links to them.
- Voice: voice chat audio is processed live by speech models on Cloudflare Workers AI and is not stored.
- Legal: where required by law or to protect users and the service.
We do not sell personal information or share it for cross-context behavioral advertising. The Privacy Choices "Do not sell or share" control records your opt-out, and an enabled GPC signal keeps that opt-out on. Declining optional analytics does not stop necessary service or security processing.
California notice at collection
During the preceding 12 months, Fishician may have collected the categories described in Section 1: identifiers, internet or network activity used for security and, where you choose optional product analytics, limited feature-use measurement; user-generated aquarium and community content; approximate device/security information; and preferences. We use those categories for the purposes in Section 2 and disclose them only to the service providers described above or when legally required. We do not sell personal information, do not knowingly sell or share information about consumers under 16, and do not offer financial incentives for personal information.
6. Data retention
Product updates: Email and in-app product updates start off separately. Manage them in Settings → Notifications. Changes require a confirmed account save. An email unsubscribe link works without signing in and stops product-update email for the address that received it; opening a link alone does not change the preference. Essential account and security messages are separate.
| Data | Retention |
|---|---|
| Product-update preferences and unsubscribe credentials | The latest consent and email opt-out status remain while your account is active, and are included in account export and final deletion. A temporary unsubscribe credential expires 45 days after creation; expired credentials are eligible for scheduled deletion in bounded batches, so cleanup delays or a backlog may extend storage. Only a digest of the random credential and its account/address binding are stored. |
| Current subscription mappings and complimentary-grant records | While your account is active, including its deletion grace period. Local customer/subscription mappings, grants and their account grant audit history are removed during final account deletion. Renewal cancellation is confirmed before deletion is scheduled, and Stripe customer deletion is confirmed before final account erasure. |
| Financial purchase, credit, refund, dispute and fraud records | Limited financial records remain separately after account deletion where needed to reconcile payments, resolve refunds or disputes, prevent fraud, preserve financial audit evidence or meet legal and tax obligations. They include transaction references, amounts, dates and related request/audit records; they do not include your full card number or security code. Your deleted account's profile and login credentials are scrubbed, and access to retained financial records is restricted. Closed-account ledgers become eligible for separately reviewed removal after a business minimum of seven calendar years from their latest associated financial, paid-service, case or legal-hold activity, subject to any longer applicable tax or legal requirement and verified payment closure. Removal leaves a minimal pseudonymous operation receipt, not the detailed transaction or support narrative. Independent recovery safeguards prevent automatic restoration of an erased financial ledger. Stripe may independently retain payment records for its legal and financial obligations. Contact privacy@fishician.app about access or deletion requests concerning these records. |
| Support cases linked to a verified billing payment | Billing messages and replies may remain after account deletion for payment recovery, disputes, financial audit evidence or a legal hold. The account contact email and member identity fields are scrubbed. A closed or resolved case becomes eligible for reviewed content removal after 540 days of inactivity and the related paid service, when financial and legal holds permit. Payment references and an audit receipt remain separately; unrelated support content follows ordinary account deletion. |
| Account, aquarium, and local recovery data | While your account is active. When you delete your account, it is signed out and hidden from other members at once, then deleted or scrubbed 14 days later; signing in before then lets you keep it. To ask for immediate deletion, email privacy@fishician.app. A recovery copy stored in your browser remains under your browser/device control and can be removed by clearing site data. |
| Community posts you delete | Removed from the service on deletion |
| Security event logs | Up to 365 days, then automatically purged |
| AI analysis logs | Up to 90 days, then automatically purged |
| Optional product analytics | Events older than 30 days are eligible for deletion by scheduled cleanup in bounded batches. Processing delays or a backlog can extend removal time. Withdrawing stops future optional collection after the account choice is confirmed; it does not itself delete prior events. Contact privacy@fishician.app to request deletion. |
| Saved AI results | Saved results remain account data until you delete the individual result or your account, subject to disclosed in-product history limits. Legacy outcome fields from the discontinued health follow-up interface, if present on an older saved result, are deleted with that result or account and are not collected by the current interface. |
| Finn conversations | Encrypted and retained for cross-device continuity until you delete the conversation, delete your account, or it reaches 180 days of inactivity. |
| Finn notebook | Off until you explicitly enable it. Encrypted notes are removed by a successfully confirmed note deletion, clear or turn-off action, final account deletion, or expiry cleanup after 180 days without an update. A failed action is not a deletion receipt; retry it. Scheduled expiry cleanup is bounded and may be delayed. |
| Finn approved memory | Encrypted and retained until you delete an item, clear Finn memory, or delete your account. Turning memory off stops recall but does not by itself delete previously approved items. |
| Finn saved-result references | Encrypted and retained for up to 365 days, or until you delete the reference, clear Finn memory, delete the underlying saved result, or delete your account. |
| Backups and legal-hold records | Rotated on a limited disaster-recovery schedule or retained only as needed for security, fraud prevention, legal claims, or legal compliance; deleted data is not restored into the live service except for disaster recovery. |
7. Your rights
Depending on where you live (GDPR for EU/UK, CCPA/CPRA for California, and similar state laws), you may have the right to:
- Access / know what personal data we hold about you;
- Export your data in a portable format (in-app: Settings → Account → Export data);
- Correct inaccurate data (edit in-app, or ask us);
- Delete your data (in-app: Settings → Account → Delete Account). This signs you out and hides the account immediately, with a 14-day recovery period before final deletion or scrubbing. Signing in during that period lets you keep the account. Financial and legal-retention exceptions are described in Section 6; contact us to request earlier deletion;
- Opt out of sale/share and targeted advertising (Privacy Choices toggle or GPC);
- Withdraw consent for optional analytics or Finn memory, without changing the lawfulness of earlier processing based on that consent;
- Object or restrict certain processing, appeal a request decision where applicable, and not be discriminated against for exercising rights.
To exercise a right, use the in-app controls or email privacy@fishician.app. Tell us which right you want to exercise and the account concerned; do not email passwords, security codes or payment-card details. We may need proportionate information to verify your identity or an authorized agent's authority. Applicable response periods and permitted extensions govern requests, including one month for GDPR requests and 45 days for covered CCPA requests. If we cannot act on a request, we will explain the reason and any applicable appeal route. You may also contact your local privacy regulator; EU/UK users may complain to their supervisory authority. These rights can have legal exceptions, including records needed for financial obligations or legal claims.
8. International transfers
We operate from the United States and use Cloudflare's global network and the providers described in Section 5. Personal data may be processed in the United States and other countries, where privacy protections can differ. Contact privacy@fishician.app for information about processing locations and any transfer safeguards applicable to your data.
9. Security
Protections include HTTPS everywhere, HttpOnly session cookies, PBKDF2-hashed passwords, optional two-factor authentication (TOTP or email codes), 2FA-enforced admin access, parameterized database queries, origin-checked requests, account-ownership checks, application-layer encryption for Finn conversation and memory text, automated content moderation, and audit logging of security events. No system is 100% secure; report concerns to support@fishician.app.
10. Changes and contact
We will post updates to this page and, for material changes, notify you in the app. Contact: privacy@fishician.app.