Privacy Policy
This policy explains what personal data Aquareap collects, how it is used, and your rights regarding that data. Last updated: September 2026.
1. Who We Are
Aquareap ("we", "us", "our") operates the website at Aquareap.com — a fish species encyclopedia and citizen science platform. When this policy refers to "Aquareap" it means the operator of this website and the entity responsible for processing your personal data.
For privacy enquiries or to exercise your rights, contact us at privacy@Aquareap.com.
2. Data We Collect
Account data. If you register for a Aquareap account, we collect your name, email address, username, and the password you set (stored as a one-way hash — we never store plain-text passwords).
Observation data. When you log a fish observation, we collect: species identification, date and time, optional location (latitude/longitude), optional photo upload, and your notes. Location data is optional — you can log observations without providing a precise location.
Usage data. We collect anonymised analytics about how you use the site: pages visited, search queries, referral source, device type, and browser type. This data cannot be linked back to your identity.
Communications. If you contact us by email, we retain your email address and the content of your message for up to 24 months to facilitate follow-up and to improve our services.
Cookies. See Section 5 for full details of the cookies we use.
3. How We Use Your Data
- To create and maintain your Aquareap account
- To display your observations and profile to you and (if public) to other users
- To send occasional product updates and editorial newsletters — only if you have subscribed or opted in
- To improve the accuracy and relevance of search results and species pages
- To detect and prevent fraud, abuse, or security incidents
- To comply with legal obligations
We do not sell, rent, or trade your personal data to any third party. We do not use your data for advertising profiling.
4. Legal Basis for Processing (GDPR)
For users in the European Economic Area and United Kingdom, we process your personal data under the following legal bases:
- Contract performance — to provide the account and observation services you have signed up for
- Legitimate interests — for site analytics, security monitoring, and service improvement
- Consent — for optional marketing emails and non-essential cookies
- Legal obligation — to comply with applicable laws
5. Cookies
We use the following categories of cookies:
- Essential cookies — Required for login sessions and security (CSRF tokens). Cannot be disabled without breaking core site functionality.
- Analytics cookies — Anonymous usage statistics collected via a self-hosted analytics tool. IP addresses are anonymised before storage. No data is sent to Google Analytics or Meta.
- Preference cookies — Remember your display preferences (e.g. unit system). Set only when you interact with these controls.
We do not use advertising or cross-site tracking cookies of any kind.
6. Data Sharing
We share data with a small number of trusted service providers who operate under strict data processing agreements:
- Cloud hosting provider — stores encrypted backups of our database
- Email delivery provider — delivers transactional emails (password resets, verification emails)
- CDN provider — serves static assets; does not receive personal data
All service providers are contractually prohibited from using your data for any purpose other than providing the services described above.
We may disclose data where required by law, court order, or to protect Aquareap from legal liability in good faith.
7. Your Rights
Under GDPR and equivalent laws, you have the right to:
- Access — request a copy of all personal data we hold about you
- Rectification — correct inaccurate or incomplete personal data
- Erasure — request deletion of your personal data ("right to be forgotten")
- Restriction — ask us to pause processing your data in certain circumstances
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — opt out of marketing emails at any time via the unsubscribe link
To exercise any right, email privacy@Aquareap.com. We will respond within 30 days.
8. Data Retention
We retain account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where retention is required by law or for the resolution of a pending dispute.
Observation data you have made public may be retained in anonymised aggregate form for scientific research purposes after account deletion.
9. Changes to This Policy
We may update this policy when our practices change. Material changes will be notified by email to registered users and by a notice on this page. The "last updated" date at the top of this page reflects when the policy was most recently revised.
Last updated: September 2026 · Contact us for privacy queries