Privacy Policy
Last updated: April 4, 2026
Overview
MyAquaLog ("we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, how we use it, and your rights under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
We process your data only with your consent or when we have a legitimate interest, and we minimize data collection to what's necessary for the service.
California (CCPA/CPRA): We do not sell your personal information or share it for cross-context behavioral advertising as those terms are defined under California law.
What we collect
Lawful basis: Consent (identified analytics, session replay, and error tracking), Contract (account data), Legitimate interest (anonymous aggregate page views with no IP or identifier, security, fraud prevention such as Turnstile where applicable).
- Account information: Email address when you create an account (via Supabase Auth).
- Tank data: Tanks, water tests, livestock, and maintenance records you create.
- Billing records: Payment method details processed by Stripe (we do not store full card numbers).
- Anonymous page views: URL paths and Web Vitals performance measurements, with no IP address, cookies, or persistent identifier. Collected by default on the lawful basis of legitimate interest.
- Identified analytics: Feature usage tied to your account, session replay, and device fingerprint. Only with your consent.
- Error reports: Crash data and error context (only with your consent).
- Email addresses: When you sign up for updates or request a recovery checklist.
How data is stored
- Without login: All data is stored locally in your browser using localStorage.
- With login: Data syncs to Supabase (hosted in US-East region) for cross-device access.
- Public tank links: If you share a tank link, that tank's data is viewable by anyone with the link.
- Encryption: All data is encrypted in transit (HTTPS/TLS 1.3). Supabase encrypts data at rest.
Third-party services
We use the following third-party services that may process your data:
| Service | Purpose | Data Shared |
|---|---|---|
| Supabase | Authentication, database, storage | Account data, tank data |
| Stripe | Subscription billing | Email, payment method |
| Resend | Transactional email | Email address |
| PostHog | Anonymous page views by default; identified product analytics and session replay only with consent | URL path and Web Vitals (no IP, no cookies) without consent. With consent: feature usage, device info, session replay. |
| Vercel Analytics | Performance metrics (consent required) | Page load times, device type |
| Sentry | Error tracking (consent required) | Error stack traces, browser info |
| Cloudflare | Bot protection (Turnstile) | Browser fingerprint (anonymized) |
| Anthropic (Claude) | AI tank advisor chat, disease detection, and fish identification | Message text, tank context, and any photos you submit for analysis |
| OpenAI | Text embeddings for AI advisor knowledge search (only when enabled) | Advisor message text |
We use subprocessors that offer GDPR-aligned terms. Standard Contractual Clauses or equivalent safeguards apply where data is transferred outside your region. Written Data Processing Agreements (DPAs) are maintained with vendors that process personal data on our behalf, and copies are available on request. PostHog receives anonymous page-view counts and Web Vitals by default with no IP, cookies, or identifier attached; identified analytics, session replay, and Sentry error tracking activate only after you consent in the app or cookie banner.
Cookies and tracking
We use cookies, local storage, and similar technologies. Anonymous page-view counts (no IP, no cookies, no identifier) collect by default. Identified analytics, session replay, and error tracking only activate after you consent. Consent choices are stored in your browser under the key privacy-consent (local storage), not only in HTTP cookies.
| Storage / cookie | Purpose | Duration | Type |
|---|---|---|---|
| privacy-consent (local storage) | Stores your consent choices for analytics, diagnostics, and marketing | Persistent | Essential |
| sb-* | Supabase authentication session | Session | Essential |
| ph_* | PostHog analytics identifier | 1 year | Analytics |
| __vercel_live_token | Vercel Analytics | Session | Analytics |
| sentry-* | Error tracking session | Session | Error Tracking |
You can manage your cookie preferences at any time via the Privacy & Data settings in the app.
Your rights (GDPR/CCPA)
You have the following rights over your personal data:
- Right to Access: Request a copy of your data (available in-app via Export).
- Right to Rectification: Edit your data directly in the app.
- Right to Erasure: Delete your account and all data via Privacy & Data settings.
- Right to Portability: Export your data in JSON format.
- Right to Object: Withdraw consent for analytics/tracking at any time.
- Right to Restrict Processing: Contact us to restrict specific processing activities.
- Right to Lodge a Complaint (Art. 77): You have the right to lodge a complaint with a supervisory authority if you believe your data is being processed unlawfully.
To exercise any right not available in-app, email hello@myaqualog.com. We respond within 30 days.
EU residents may contact their local Data Protection Authority. A list of DPAs is available at edpb.europa.eu.
Data retention
- Account data: Removed from our live systems when you delete your account. Point-in-time backups held by our hosting providers may persist for a limited period under their retention schedules, then expire.
- Local browser data: Retained until you clear site data or uninstall the PWA.
- Analytics data: PostHog retains data for 12 months, then auto-deletes.
- Error logs: Sentry retains error data for 90 days.
- Billing records: Stripe retains records per legal requirements (typically 7 years).
- Marketing emails: Email addresses retained until you unsubscribe.
- Webhook logs: Retained for 30 days for debugging, then auto-deleted.
Children's privacy
MyAquaLog is not directed at children under 13 (or 16 in the EU). We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us to have it removed.
Security
- All connections use HTTPS with TLS 1.3 encryption.
- Authentication managed by Supabase with secure session handling.
- Database access protected by Row-Level Security (RLS).
- API endpoints protected with rate limiting and CSRF validation.
- No method is 100% secure, but we work to minimize risk.
Report security issues to our security page.
Data breach notification
In the event of a personal data breach that poses a risk to your rights and freedoms:
- Supervisory authority: We will notify the relevant data protection authority within 72 hours of becoming aware of the breach (GDPR Art. 33).
- Affected users: If the breach is likely to result in high risk to your rights, we will notify you directly via email without undue delay (GDPR Art. 34).
- Notification content: We will describe the nature of the breach, likely consequences, and measures taken or proposed to address it.
International transfers
Your data may be processed in the United States where our service providers operate. We ensure adequate protections through Standard Contractual Clauses (SCCs) and processor agreements with GDPR-compliant vendors.
Changes to this policy
We may update this policy periodically. Material changes will be announced via email (for registered users) or a banner in the app. The "Last updated" date at the top reflects the most recent revision.
Contact
Questions about this policy or your data? Contact us at hello@myaqualog.com.