Privacy Policy for Aqua Diary: Website and Mobile App

Last updated: October 2026

This Privacy Policy covers the Aqua Diary website (aqua-diary.com) and the Aqua Diary mobile app for iOS. It explains what personal data we process when you use either of them, why we do it and what rights you have.

1. Data Controller

The controller of your personal data is:

Legal Name: WebDeveloper Marcin Mirecki
Email: [email protected]
Website: https://aqua-diary.com

2. Data Protection Officer

For any questions or concerns regarding the processing of your personal data, you may contact our Data Protection Officer at:

Email: [email protected]
Subject line: "Data Protection Inquiry"

3. Data Categories Collected

We collect and process the following categories of personal data:

Account Information:

Name and email address
Profile picture (if provided)
Authentication credentials (encrypted)
If you sign in with Apple, Google or Facebook: the account identifier, name and email address that the provider shares with us. With Sign in with Apple you can hide your email address; Apple then gives us a private relay address that forwards our emails to you
Account preferences and settings

Aquarium Data:

Aquarium profiles (names, descriptions)
Aquarium photos
Water parameters and chemistry records
Equipment, plants, and animal inventory
Maintenance schedules and notes
Dosing and event logs

Photos and Camera (Mobile App):

The app asks for access to the camera or the photo library only when you add a photo yourself
We upload only the photos you pick or take; we do not read the rest of your photo library
The app does not use the microphone
You can withdraw camera and photo access at any time in your device's system settings

Usage Data:

Screens and pages visited and features used
Interaction patterns and session duration
Session recordings (see below)
Error and crash reports and performance metrics

Device Information:

Device type, browser type and version
Operating system and app version
IP address
Device identifiers

Analytics, Session Recordings and Error Reports (PostHog):

We use PostHog to understand how Aqua Diary is used and to find and fix errors. We use PostHog's EU region (EU Cloud), so this data is processed in the European Union. On the website and in the mobile app, PostHog collects:

The screens and pages you visit and the features you use
Session recordings: a replay of what happens on screen during a visit. Text fields and selected content are masked; images, such as aquarium photos, are visible
Error and crash reports
Device or browser type, operating system and app version
IP address: PostHog receives your IP address when you connect, but does not store it or use it to determine your location

When you are signed in, we link this data to your account number (in the form user:<id>) and your account role. We do not send your name or email address to PostHog. Before data is sent, we remove tokens and other sensitive parameters from the captured page addresses (URLs).

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in improving the service and fixing errors.

How to object: in the mobile app, turn off "Share analytics data" in your account settings. The switch is on by default; turning it off stops analytics and session recordings. On the website, you can block cookies or scripts in your browser settings (see the Cookie Policy) or object by email to [email protected].

Retention: up to 12 months (see Section 6).

Protection Against Bots (Google reCAPTCHA):

Google reCAPTCHA protects sign-in and sign-up against bots, on the website and in the mobile app. To do this, Google processes information about your device and how you interact with the page or screen, under Google's Privacy Policy. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in keeping the service secure.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds (Article 6 GDPR):

Consent (Art. 6(1)(a) GDPR): For optional communications such as marketing emails and newsletters. You may withdraw your consent at any time.
Performance of Contract (Art. 6(1)(b) GDPR): To provide the Aqua Diary application services, manage your account, and process your aquarium data.
Legitimate Interest (Art. 6(1)(f) GDPR): For application security and protection against bots (Google reCAPTCHA), fraud prevention, service improvement, and analytics, session recordings and error reports (PostHog) to enhance user experience; and for keeping aquarium photos in a non-public archive after account deletion and using them to promote the service under the license granted in our Terms of Use. You may object to this processing (Art. 21 GDPR) at any time by email to [email protected].

5. Data Recipients

Your personal data may be shared with the following categories of recipients:

Hosting Providers: Cloud infrastructure services that store and process data on our behalf
Analytics Services: Tools used to understand application usage and improve our services
Authentication Providers: Third-party sign-in providers (Apple, Google, Facebook) if you choose to sign in with them

In particular, we work with:

PostHog: analytics, session recordings and error reports (EU Cloud, data processed in the EU)
Google: reCAPTCHA and sign-in with Google
Apple: Sign in with Apple
Meta (Facebook): sign-in with Facebook
Apple App Store: distribution of the mobile app

We do not sell your personal data to any third parties. All data processors are bound by data processing agreements ensuring GDPR compliance.

6. Data Retention Periods

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected:

Account data: Retained for the duration of your active account, plus 30 days after account deletion
Aquarium data: Retained for the duration of your active account
Aquarium photos: After account deletion, aquarium photos are no longer public and are kept in a non-public archive for up to 5 years, after which they are deleted automatically. You may request earlier deletion by email from your account's email address to [email protected] with the subject line "Photo Deletion Request"
Usage and analytics data (PostHog, including session recordings and error reports): Retained for up to 12 months
Server logs: Retained for up to 90 days

You can delete your account yourself at any time: on the website in My Account, or in the mobile app under Account → Delete account. The Data Deletion page explains what we delete and what we keep. You can also request deletion by contacting us at [email protected].

7. Your Rights

Under the GDPR, you have the following rights regarding your personal data:

Right of Access (Art. 15): You may request a copy of all personal data we hold about you
Right to Rectification (Art. 16): You may request correction of inaccurate personal data
Right to Erasure (Art. 17): You may request deletion of your personal data ("right to be forgotten"). This also applies to archived aquarium photos, using the same email request (subject line "Photo Deletion Request")
Right to Restriction (Art. 18): You may request restriction of processing under certain conditions
Right to Data Portability (Art. 20): You may request your data in a structured, machine-readable format
Right to Object (Art. 21): You may object to the processing of your personal data based on legitimate interests

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days.

8. Right to Lodge a Complaint

If you believe that our processing of your personal data violates the GDPR, you have the right to lodge a complaint with a supervisory authority. In Poland, the supervisory authority is:

Urząd Ochrony Danych Osobowych (UODO) - The President of the Personal Data Protection Office
ul. Stawki 2, 00-193 Warszawa, Poland
Website: https://uodo.gov.pl

9. International Data Transfers

Your personal data is primarily processed within the European Union / European Economic Area (EU/EEA). PostHog analytics data is stored in the EU (PostHog EU Cloud). Google, Apple and Meta, which provide sign-in, reCAPTCHA and app distribution, may process data in the United States on the basis of the EU–US Data Privacy Framework or Standard Contractual Clauses.

In cases where data is transferred to countries outside the EU/EEA, we ensure that appropriate safeguards are in place, including:

Standard Contractual Clauses (SCCs) approved by the European Commission
Adequacy decisions by the European Commission for the recipient country
Binding Corporate Rules where applicable

10. Policy Changes and Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or for other operational reasons. When material changes are made, we will notify users through their account homepage (aqua-diary.com/my) and update the "Last updated" date at the top of this policy.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data.

11. Contact Information

If you have any questions about this Privacy Policy or our data processing practices, please contact us at [email protected].

By using Aqua Diary, you acknowledge that you have read and understood this Privacy Policy.