AquaLog Privacy Policy
This policy lists, item by item, what our server knows about you, why, and for how long. It agrees with the Terms of Service and the data classification; where they disagree, the stricter one holds. The Traditional Chinese version is the original; this is its translation.
1. Without a shared aquarium
AquaLog runs on your device. Without a shared aquarium, reminder push or AI assistance, none of your data leaves the device. We use no third-party analytics, advertising or trackers.
2. What we cannot see
The content of your records and photos. With a shared aquarium, they are encrypted before they leave the device with a key only your devices hold; the server stores ciphertext only, and we do not have the key to it (Terms of Service section 4). Device names are stored on the server, but the operator console does not show them.
3. What is on the server
| Feature | What the server keeps | For how long |
|---|---|---|
| Shared aquarium | Ciphertext of records and photos; the metadata syncing needs (entity type, identifier, revision, device identifier, time, size); devices and members; the recovery envelope (ciphertext) | Until the owner deletes the shared aquarium in the app. Deleted photo ciphertext is cleared 30 days after every device has confirmed |
| Sync activity | The kind and time of each pairing, joining, revoking and similar action (sync_audit_events), with no content | Until the shared aquarium is deleted |
| Rate limiting | A connection address as an irreversible digest, and its request count within one window | 24 hours |
| Rate limit statistics | Counts per 15 minutes and per kind of request, with no identifier | 90 days |
| Paid plans | Paddle's opaque customer and subscription identifiers, subscription status, end of the current period, grace deadline, a random billing reference; the type, time and outcome of payment events | Until the shared aquarium is deleted |
| Operator actions | The operator's email, the action, the workspace identifier, the plan or quota numbers before and after, the reason | Permanently, append-only (Terms of Service section 4, "choose not to", item 5) |
| Reminder push | An anonymous installation identifier, the push subscription, reminder type, due time and status, an opaque reminder identifier. No fish or plant names, equipment names, prices, water quality, notes or photos | See section 5 |
The payer's name, email, country, address and card number are not on our server — Paddle collects and keeps them (Refunds, tax and data portability, section 2). When support looks up a payer's email, it is asked of Paddle at that moment and written nowhere.
4. Other times data leaves the device
- AI analysis explanations: only the summary of an analysis report the app already worked out on the device; no aquarium records, photos or identifiers.
- AI photo comparison: the two photos themselves. This is the only time a photo leaves the device, and only when you ask for it, each time.
- Species photos: only the species name, to query a public image library.
- Caregiver handoff: the content is in the link you share, not on our server; once sent, nobody can take it back, at any time.
5. What the server sees about you: the full list
The app's Settings → "What the server sees about you" shows this same list, with your actual numbers beside it. The list covers every column on the server; a column the server stores that is not on it fails the build.
The server can see
- That a shared aquarium exists, its plan and limits, when it was created and last changed
- The type, identifier, revision, size and time of every write
- Which devices there are, their names (the ones you gave them), and when each one synced
- How many members there are, their roles and when they joined (no names)
- The kind and time of pairing, joining, revoking and similar actions
- Your connection address: only an irreversible hash, for rate limiting, deleted after 24 hours
- With a subscription: Paddle's identifiers, the status and its dates (no name, email or card)
- How many AI explanations were used each month (not what was asked)
- Every action the operator took on this shared aquarium, with its reason
- With reminder push on: the category and due time of reminders, and whether they were sent
Stored but unreadable, or not stored at all
- Your records and photos: stored as ciphertext; the key is only on your devices
- The names of your aquarium, fish and plants, water test numbers, prices and notes
- Reminder titles
- Your Recovery Code and keys: the server has only encrypted envelopes, hashes and public keys
Turning on assignment notifications adds
- Which notification installation belongs to this shared aquarium, and which member
Assignment notifications are off by default. What the server learns once they are on is not content but belonging: we cannot see content; we know which devices are woken together. An assignment push carries no workspace, member, assigner or category. Turning it off deletes the row on the server; it is not marked inactive.
How long things are kept
| Data | Kept for |
|---|---|
| Push delivery records | 30 days |
| Connection address hashes for rate limiting | 24 hours |
| Rate limit statistics | 90 days |
| The assignment notification link | Until you turn assignment notifications off; deleted then |
| Reminder schedules (category and due time) | Deleted once sent, cancelled or abandoned, and both the due time and the last change are more than 30 days old |
| Revoked notification installations, with their push subscription and schedules | 30 days after revocation |
| Other shared aquarium data, billing and operator records | See section 3 |
6. Your rights
- Getting your data: the app exports a complete ZIP itself (Export format). We hold only ciphertext and cannot hand over its content.
- Deletion: see the Terms of Service, section 7.
- What we can hand over: in response to a lawful request, only what is in the table in section 3; never the plaintext of any record or photo.