Privacy Policy

AquaTracker ("Aquarium Water Tracker", "we", "us") is committed to protecting your privacy. This Privacy Policy explains what information we collect, why we collect it, who we share it with, and what rights you have over your data when you use our service.

1. Information we collect

Account data. When you register we store your email address, name (optional), and a securely hashed password. If you sign in with a third-party provider (Google, Facebook, or Apple), we receive your name, email address, and profile picture from that provider.

Aquarium data. The content you create in the service: aquariums, water parameter measurements, maintenance logs, notes, and parameter range settings.

Usage and technical data. We use Vercel Analytics to collect anonymous, aggregated usage statistics (page views, performance metrics). Vercel Analytics is cookieless and does not track individual visitors.

2. How we use your information

We use the collected information to:

• provide and operate the service (accounts, measurements, alerts);
• authenticate you and keep your account secure;
• generate AI-powered aquarium insights for premium users (only aggregated aquarium data is sent to the AI provider — never your personal data);
• send transactional emails (e.g. password reset);
• improve the application through anonymous usage statistics.

3. Third-party services

We rely on the following processors to run the service. Each processes only the data needed for its role:

• Vercel — hosting, content delivery, and cookieless analytics;
• Neon — PostgreSQL database hosting;
• Resend — transactional email delivery;
• Google, Facebook, Apple — optional sign-in providers. Their own privacy policies apply when you use them;
• Moonshot AI (Kimi) — processes aggregated water parameter statistics to generate AI insights. No user account data or PII is sent.

4. Cookies and local storage

Strictly necessary cookies. We use session and security cookies (authentication, CSRF protection) that are required for the service to function. These cannot be disabled.

Preferences.Your theme choice, unit system, and cookie consent decision are stored in your browser's local storage so the app remembers them.

Third-party content with your consent. Google One Tap sign-in is loaded only after you accept cookies in our consent banner. If you decline, One Tap is never loaded; you can still sign in with email or via the standard, user-initiated OAuth buttons. Google may set its own cookies when you choose to sign in with Google.

5. Legal bases for processing (GDPR)

• Contract — processing needed to provide the service you signed up for (account, aquarium data);
• Legitimate interest — security, fraud prevention, and improving the service via anonymous statistics;
• Consent — optional third-party sign-in content (Google One Tap). You can withdraw consent at any time by clearing your browser storage.

6. Data retention

We keep your account and aquarium data for as long as your account is active. Password reset tokens expire within a short time window and are stored only as salted hashes. If you delete your account, your personal data and aquarium data are removed from our primary systems within a reasonable period, except where retention is required by law.

7. Your rights

Depending on your jurisdiction (including the EU/EEA under GDPR), you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• request erasure of your data ("right to be forgotten");
• data portability — your measurements can be exported as CSV at any time;
• restrict or object to certain processing;
• lodge a complaint with your local data protection authority.

To exercise any of these rights, contact us at the address below.

8. Data security

We apply industry-standard measures: hashed passwords (bcrypt), hashed one-time tokens, encrypted connections (HTTPS), and access-controlled infrastructure. No method of transmission or storage is 100% secure, but we work to protect your data and will notify affected users of any confirmed breach as required by law.

9. International data transfers

Our processors (e.g. Vercel, Neon) may process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as standard contractual clauses.

10. Children's privacy

The service is not directed at children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their personal data.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced in the application or by email. The "Last updated" date above always shows the current version.

12. Contact us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at the support email listed on our website or through the application.