AquaLog Terms of Service

These terms describe how AquaLog actually works, and what we can do, cannot do, and choose not to do. They agree with the architecture document, the recovery wording baseline, and Refunds, tax and data portability; where any of them and these terms disagree, the stricter one holds and the looser one is corrected. Quoted sentences are word for word what the app says, checked by src/i18n/termsConsistency.test.ts. The Traditional Chinese version is the original; this is its translation.

1. What the service is

AquaLog is an app for keeping aquarium records. It runs on your device and needs no account and no connection. When you turn on a shared aquarium, your records and photos are encrypted before they leave the device and synced through our server between the devices you authorise.

2. Where your data is

• On your devices: the plaintext of every record, photo and setting. It is yours to control; we cannot touch it.
• On our server (only with a shared aquarium): ciphertext, and the metadata syncing needs. We do not have the key to the ciphertext. Which metadata the server sees is in the Privacy policy.

3. Recovering data

If the Recovery Code is lost and no authorised device survives, nobody can recover the data, including us. As long as one authorised device remains, the data can be recovered.

A paid plan does not change this:

Paying does not change this: lose your Recovery Code and every device, and the data cannot be recovered. We cannot recover it either — we have never been able to read it.

When you have one device left and no confirmed Recovery Code, the app tells you:

This is your only copy. Lose this device and the data cannot be recovered. Generate a Recovery Code now.

The Recovery Code is a key, not a copy of your data. Keeping it is your responsibility; the app guides you to confirm you kept it and reminds you when your ways back become fewer, but nobody can reset it for you after you lose it.

4. What we cannot do, and what we choose not to do

These two kinds of "no" are different, so we write them separately.

Cannot (decided by the encryption; no request changes it):

1. Read or show the content of any of your records or photos.
2. Recover your data after you lose the Recovery Code and every device, or reset a key or a Recovery Code for you.
3. Hand over the plaintext of your data in response to any request. What we can hand over is only what we hold: ciphertext, times, sizes, device and workspace metadata, and billing status.

Choose not to (technically possible; we commit not to, and every exception is recorded):

1. Sign in as you, or write or revoke devices in your name.
2. Change the roles of a shared aquarium's members, or remove members and devices.
3. Delete your ciphertext without the owner's confirmation in the app — unpaid bills, refunds and suspensions are not reasons.
4. Use the payer's email to sign in, verify identity or recover data.
5. Change or delete the record of operator actions.

The operator console sees billing, usage and counts only; it sees no record, no photo, and no device name.

5. Shared aquarium members and sharing

• Every member, whatever their role, sees every record in the shared aquarium.
• After someone is removed or given a lesser role, they receive no new records and cannot make changes; but what they have already downloaded, we cannot take back.
• A caregiver handoff is sent as a link, and its content is in the link itself, not on our server. A handoff once sent cannot be taken back by anyone, at any time. The app says so before you press share.

6. Paid plans

• A paid plan is per shared aquarium, bought by the owner. Paddle is the seller of record and handles payment, tax and invoices.
• What a paid plan buys is capacity on the server: space for records and photos, more members and devices, more AI explanations. It does not buy recovery (section 3).
• Within 14 days of the first purchase, a full refund, no questions asked. After a refund or a cancellation the shared aquarium returns to the free limits, and not one item of data on the server is deleted.
• If a payment fails, VIP stays for 30 days while Paddle retries the charge; after that the aquarium returns to the free limits, and not one item of data is deleted.
• Above the free limits, new entries wait on the device and upload once there is room or after an upgrade; existing data stays and downloads as usual.
• The full rules are in Refunds, tax and data portability.

7. Deletion

• Data on this device: cleared in the app; it affects that one device only.
• Everything on the server: only the owner, only from the app, with a confirmation code. Before it, the app shows:

After deletion, the server holds no copy of this shared aquarium. Lose every device after that, and the data cannot be recovered. We cannot recover it either — we have never been able to read it.

What we delete is the server copy; what stays with you is the data on every device and the files you exported.

8. Data portability

Because we hold only ciphertext, your data is exported by the app itself: the full backup is a ZIP file with every record (JSON) and every original photo, in a published format; see Export format. Our responsibility is to keep that export available and complete.

9. Changes to these terms

When the terms change, the app shows the changed text and the date it takes effect. No change makes the commitments in sections 3 and 4 looser without notice first; and the three "cannot" items in section 4 are properties of the encryption, not something terms can change.

10. Contact

The support address is in the app's Settings. We answer every message, but please remember section 3: we cannot see your data, and we cannot recover data after the Recovery Code and every device are lost.