Privacy Policy

Effective date: July 6, 2026 · Applies to fishician.app, fishician.net, and the Fishician® web application.

Fishician® ("Fishician", "we", "us") is an aquarium companion application that helps hobbyists manage aquariums, track fish and water parameters, get AI-assisted care suggestions, and participate in an aquarium community. This policy explains what personal data we collect, why, how long we keep it, and the rights you have over it — including rights under the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA (CCPA/CPRA).

1. Data we collect

Category	Examples	Source
Account identifiers	Email address, display name, hashed password, optional avatar	You, at registration
Aquarium records	Tanks, fish, equipment, water test logs, maintenance tasks, photos you add	You, in the app
Community content	Posts, comments, photos, videos, group and forum activity, direct messages	You, in community areas
AI requests	Text and images you submit to AI features (e.g. fish health scan), and the responses	You, when using AI tools
Security and device data	Session tokens, IP-derived security events, sign-in history, two-factor settings	Generated when you use the service
Preferences	Cookie/privacy choices, display settings	You

We do not knowingly collect data from children under 13, and accounts are limited to users 13 and older.

2. Why we process it (legal bases)

Provide the service (contract): aquarium tracking, community features, AI tools you request, support.
Security and abuse prevention (legitimate interest / legal obligation): authentication, rate limiting, fraud and abuse detection, audit logs.
Content moderation (legitimate interest / legal obligation): automated and manual review of community content for safety.
Product improvement (consent where required): optional, privacy-conscious analytics you can decline.
Advertising (consent): ads and ad cookies load only if you accept them in Privacy Choices.

3. Cookies and similar technologies

Strictly necessary cookies keep you signed in and protect your account; they cannot be switched off. Optional functional, analytics, and advertising storage are controlled from the cookie banner or Privacy Choices inside the app (Settings → Privacy). We honor the Global Privacy Control (GPC) browser signal as an opt-out of sale/share.

4. Advertising and affiliate links

Fishician may display ads (e.g. Google AdSense) on content pages and includes affiliate links to retailers such as Amazon. Ad scripts only load after you consent to advertising cookies. Affiliate links do not send retailers your Fishician account data; the retailer sets its own cookies on its own site. See our Advertising & Affiliate Disclosure.

5. Who we share data with

Infrastructure: Cloudflare, Inc. (hosting, storage, AI inference) processes data on our behalf.
Email delivery: transactional email providers for verification and security codes.
AI processing: AI requests are processed by models run on Cloudflare Workers AI and, for some features, Google's Gemini API. Prompts are redacted of emails, phone numbers, and IDs before storage.
Legal: where required by law or to protect users and the service.

We do not sell personal information, and we do not share it for cross-context behavioral advertising without your consent. The Privacy Choices "Do not sell or share" toggle records a CCPA/CPRA opt-out regardless.

6. Data retention

Data	Retention
Account and aquarium data	While your account is active; deleted or scrubbed when you delete your account
Community posts you delete	Removed from the service on deletion
Security event logs	Up to 365 days, then automatically purged
AI analysis logs	Up to 90 days, then automatically purged
Backups and legal-hold records	Limited period as needed for disaster recovery, security, or legal compliance

7. Your rights

Depending on where you live (GDPR for EU/UK, CCPA/CPRA for California, and similar state laws), you may have the right to:

Access / know what personal data we hold about you;
Export your data in a portable format (in-app: Settings → Account → Export data);
Correct inaccurate data (edit in-app, or ask us);
Delete your data (in-app: Settings → Account → Delete Account — immediate, permanent, self-service);
Opt out of sale/share and targeted advertising (Privacy Choices toggle or GPC);
Object or restrict certain processing, and not be discriminated against for exercising rights.

To exercise any right, use the in-app controls or email [email protected]. We respond within the timelines required by applicable law (30 days GDPR, 45 days CCPA, extendable where permitted). We may need to verify your identity via your account email. Authorized agents may submit CCPA requests with proof of authorization. If you are in the EU/UK you may also lodge a complaint with your supervisory authority.

8. International transfers

We operate on Cloudflare's global network; data may be processed in the United States and other countries. Where GDPR applies, transfers rely on appropriate safeguards such as standard contractual clauses implemented by our processors.

9. Security

Protections include HTTPS everywhere, HttpOnly session cookies, PBKDF2-hashed passwords, optional two-factor authentication (TOTP or email codes), 2FA-enforced admin access, parameterized database queries, origin-checked requests, automated content moderation, and audit logging of security events. No system is 100% secure; report concerns to [email protected].

10. Changes and contact

We will post updates to this page and, for material changes, notify you in the app. Contact: [email protected].