Refunds, tax and data portability
This document sets out how AquaLog meets the three obligations that come with charging money (#1505, ADR-015). The matching sections of the terms and the privacy policy refer to it rather than restating it; sentences about recovery are quoted from the recovery wording baseline. The Traditional Chinese version is the original; this is its translation.
One fact sets the tone of everything below: the operator holds only ciphertext. That changes how two of these obligations are met compared with an ordinary online service — not less is done, but a different party does it.
1. Refunds
| Item | Rule |
|---|---|
| First purchase | Full refund within 14 days, no questions asked (ADR-015) |
| Later renewals | Handled under the refund policy of the payment provider, Paddle |
| How to ask | Email the support address, or use the link in the receipt Paddle sends. No reason needed |
| Who carries it out | The operator refunds in Paddle and cancels the subscription at once; Paddle sends subscription.canceled, and the workspace returns to the free plan on its next request |
| Chargebacks | Handled by Paddle, with the same result as a refund |
What happens to the data after a refund
| Happens | Does not happen |
|---|---|
| The shared aquarium returns to the free limits: new entries above them wait on the device until there is room | Ciphertext on the server is not deleted — not one item |
| With more members or devices than the free limits allow, no new member or device can join | Members and devices already there are not removed |
| Plaintext on each device is not touched — it was never ours to touch |
"A refund deletes nothing" has no time limit, for the same reason as unpaid bills: what the operator deletes could be the keeper's last copy, and because it is ciphertext the operator cannot even tell what it deleted (ADR-015).
2. Tax and invoices
Paddle is the seller of record (merchant of record). It calculates, collects and files sales tax and VAT, and issues invoices and receipts.
| Personal data | Who collects it | Do we keep it |
|---|---|---|
| Email (for the receipt) | Paddle, on its checkout page | No. The database has no column for it |
| Country or region, a postcode in some places | Paddle, for tax | No |
| Card number or other payment details | Paddle | No, and it never passes through our server |
| Company name, tax number (optional) | Paddle, only for a company invoice | No |
The server keeps only Paddle's opaque identifiers (customer id, subscription id) and the subscription status, matched to Paddle through a billing_ref that is random per workspace; Paddle never sees the workspace identifier. This is ADR-015's separation of billing identity: the person who pays can be found, but their billing identity does not become their content identity. When support looks a workspace up by the payer's email, the email is asked of Paddle at that moment and written nowhere.
3. Data portability: done by the app
For regulators
An online service's portability obligation is usually "export the user's data on request, by the operator". AquaLog's operator cannot do that, and the reason is design, not policy:
- The user's records and photos are encrypted before they leave the user's device, with a key only the user's devices hold (ADR-011, ADR-016).
- The synced copy on the server is ciphertext. The operator has no key and cannot turn it into readable data; handing over ciphertext is of no use to the user.
- So portability is done by the user's own app: it exports the complete data on the device, with no connection and no part played by the operator.
The obligation the operator takes on instead: keep a working, complete export with a published format in the app at all times. The format is in Export format: one ZIP file with every record (JSON) and every original photo, which any software that opens ZIP and reads JSON can open; plus CSV files for spreadsheets. The field lists in that document are checked against the code by a test, so a format change without a document change fails the build.
What the operator can hand over is only what it holds: ciphertext, times, sizes, device and workspace metadata, billing status (ADR-016 item 5). On request it provides these as they are, and says that they are not a readable copy of the user's content.
4. "Delete my account" and "delete my data" are two things
AquaLog has no accounts or passwords. What people mean by "account" is, here, separate things:
| The user says | What it actually is | How |
|---|---|---|
| "Cancel my subscription" | The Paddle subscription | Plan page → "Manage subscription" (owner). The shared aquarium returns to the free plan; the data is untouched |
| "Delete my payment details" | Paddle's customer record | Ask Paddle (it controls that data). What remains on our side is opaque identifiers, deleted with the workspace |
| "Delete the data on this device" | IndexedDB on the device | Settings → Backup, restore and data management → Danger zone → "Clear all data and start over". Affects this device only |
| "Delete everything on the server" | The shared aquarium's ciphertext, key envelopes, members, devices and billing records | Only the owner, only from the app: sync settings → "Delete every server copy" issues a confirmation code valid for 7 days, sent with the workspace code to the support address; the operator carries it out only on that code and sends back a deletion receipt. A live subscription is cancelled at once. The operator deletes in no other case — unpaid bills, refunds and suspensions are not reasons (ADR-015, ADR-024) |
One thing to say before deleting
A user asks for everything on the server to be deleted, and it is done — and then their device is lost. With no ciphertext left on the server, the Recovery Code has nothing to unlock.
So before issuing a deletion code, the app shows the recovery.delete.serverCopy sentence from the recovery wording baseline, unchanged; src/i18n/recoveryWording.test.ts checks it word for word.
Deleting ciphertext does not delete plaintext on any device. The terms say so: what we delete is the server copy; what stays with you is the data on every device and the backups you exported.
5. How this relates to other documents
- The terms and the privacy policy refer to the rules in sections 1, 2 and 3 and the table in section 4 rather than writing their own.
- Sentences about recovery are quoted only from the recovery wording baseline.