Fishician® — back to the app
Privacy Policy
Fishician® ("Fishician", "we", "us") is an aquarium companion application that helps hobbyists manage aquariums, track fish and water parameters, get AI-assisted care suggestions, and participate in an aquarium community. This policy explains what personal data we collect, why, how long we keep it, and the rights you have over it — including rights under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).
1. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account identifiers | Email address, display name, hashed password, optional avatar | You, at registration |
| Aquarium records | Tanks, fish, equipment, water test logs, maintenance tasks, photos you add | You, in the app |
| Community content | Posts, comments, photos, videos, group and forum activity, direct messages | You, in community areas |
| AI requests | Text and images you submit to AI features (e.g. fish health scan), and the responses | You, when using AI tools |
| Security and device data | Session tokens, IP-derived security events, sign-in history, two-factor settings | Generated when you use the service |
| Preferences | Cookie/privacy choices, display settings | You |
We do not knowingly collect data from children under 13, and accounts are limited to users 13 and older.
2. Why we process it (legal bases)
- Provide the service (contract): aquarium tracking, community features, AI tools you request, support.
- Security and abuse prevention (legitimate interest / legal obligation): authentication, rate limiting, fraud and abuse detection, audit logs.
- Content moderation (legitimate interest / legal obligation): automated and manual review of community content for safety.
- Product improvement (consent where required): optional, privacy-conscious analytics you can decline.
- Advertising (consent): ads and ad cookies load only if you accept them in Privacy Choices.
3. Cookies and similar technologies
Strictly necessary cookies keep you signed in and protect your account; they cannot be switched off. Optional functional, analytics, and advertising storage are controlled from the cookie banner or Privacy Choices inside the app (Settings → Privacy). We honor the Global Privacy Control (GPC) browser signal as an opt-out of sale/share.
4. Advertising and affiliate links
Fishician may display ads (e.g. Google AdSense) on content pages and includes affiliate links to retailers such as Amazon. Ad scripts only load after you consent to advertising cookies. Affiliate links do not send retailers your Fishician account data; the retailer sets its own cookies on its own site. See our Advertising & Affiliate Disclosure.
5. Who we share data with
- Infrastructure: Cloudflare, Inc. (hosting, storage, AI inference) processes data on our behalf.
- Email delivery: transactional email providers for verification and security codes.
- AI processing: AI requests are processed by models run on Cloudflare Workers AI and, for some features, Google's Gemini API. Prompts are redacted of emails, phone numbers, and IDs before storage.
- Legal: where required by law or to protect users and the service.
We do not sell personal information, and we do not share it for cross-context behavioral advertising without your consent. The Privacy Choices "Do not sell or share" toggle records a CCPA/CPRA opt-out regardless.
6. Data retention
| Data | Retention |
|---|---|
| Account and aquarium data | While your account is active; deleted or scrubbed when you delete your account |
| Community posts you delete | Removed from the service on deletion |
| Security event logs | Up to 365 days, then automatically purged |
| AI analysis logs | Up to 90 days, then automatically purged |
| Backups and legal-hold records | Limited period as needed for disaster recovery, security, or legal compliance |
7. Your rights
Depending on where you live (GDPR for EU/UK, CCPA/CPRA for California, and similar state laws), you may have the right to:
- Access / know what personal data we hold about you;
- Export your data in a portable format (in-app: Settings → Account → Export data);
- Correct inaccurate data (edit in-app, or ask us);
- Delete your data (in-app: Settings → Account → Delete Account — immediate, permanent, self-service);
- Opt out of sale/share and targeted advertising (Privacy Choices toggle or GPC);
- Object or restrict certain processing, and not be discriminated against for exercising rights.
To exercise any right, use the in-app controls or email privacy@fishician.app. We respond within the timelines required by applicable law (30 days GDPR, 45 days CCPA, extendable where permitted). We may need to verify your identity via your account email. Authorized agents may submit CCPA requests with proof of authorization. If you are in the EU/UK you may also lodge a complaint with your supervisory authority.
8. International transfers
We operate on Cloudflare's global network; data may be processed in the United States and other countries. Where GDPR applies, transfers rely on appropriate safeguards such as standard contractual clauses implemented by our processors.
9. Security
Protections include HTTPS everywhere, HttpOnly session cookies, PBKDF2-hashed passwords, optional two-factor authentication (TOTP or email codes), 2FA-enforced admin access, parameterized database queries, origin-checked requests, automated content moderation, and audit logging of security events. No system is 100% secure; report concerns to support@fishician.app.
10. Changes and contact
We will post updates to this page and, for material changes, notify you in the app. Contact: privacy@fishician.app.