Privacy Policy

Effective date: 2026-05-11

This Privacy Policy describes what data Aquarium Coach (the iOS app, hereafter "we" or "the app") collects, why, who else sees it, and the choices you have. It is written in plain English on purpose. If anything is unclear, email us at amtyurin@gmail.com.

Contents

The short version
Data we collect
Who else sees your data
Where your data lives
How long we keep your data
Encryption and security
Your rights and choices
Children
Changes to this Policy
Contact
Apple App Store disclosures

1. The short version

We collect the minimum we need to run the app: photos you take, an opaque Apple user ID (only if you Sign in with Apple), and crash diagnostics.
Photos you submit for AI analysis are sent to our backend and then to Anthropic (a third-party AI provider). The actual image bytes are NOT retained on our servers after the AI returns its result.
We do NOT track you across other apps or websites.
We do NOT sell your data to anyone.
We do NOT show ads.
Most of the app works without an account. Sign in with Apple is optional and only enables iCloud sync and Pro purchases.
You can delete your local data at any time from Settings → Delete all local data.

2. Data we collect

2.1 Photos

When you tap "Scan Strip" or "Tank Health Scan", the app sends a photo (compressed to ≤1280px, JPEG) to our backend at aquariumcoach-api.cpmtek.com. Our backend forwards it to Anthropic's Claude API for AI analysis, then receives the AI's parsed response (text only). We log the AI's text response for debugging, but we do NOT persist the image bytes after the API call returns.

Why: it's the entire point of the app — our backend holds the AI provider's API key so the key isn't exposed in the iOS binary.
Where it goes: your device → our backend (Postgres database) → Anthropic Claude API. Returns to your device.
How long: image bytes are kept in memory only during the API call (≤30 seconds). The text response is logged for ~30 days then purged automatically.
Linked to identity: photos are associated with your Sign in with Apple identifier in our backend logs. If you don't sign in, photos are sent anonymously (just by request session).

2.2 Apple User ID (only if you Sign in with Apple)

If you choose Sign in with Apple, we receive an opaque identifier (Apple calls it the "user" or "sub" claim) that uniquely identifies you to our app. This identifier:

Is generated by Apple, not us
Is stable across reinstalls (you keep your data)
Is different for every app you sign into — we cannot use it to track you across other apps
Is required to associate a Pro purchase with your account

We do NOT receive your real Apple ID, your real email (unless you choose to share it), or your name (unless you choose to share it).

2.3 Optional: name and email (only if you share via Sign in with Apple)

When you Sign in with Apple, Apple lets you choose:

Share your real name and real email — we receive them and display the name in Settings.
Hide my Email — Apple gives us a relay email address (xxx@privaterelay.appleid.com) that forwards to your real one, which we never see.
Don't share name/email at all — we get only the opaque identifier from §2.2.

If you share name/email: we display your name in Settings on your device. We do NOT store the email on our backend. We never sell or share these to anyone.

2.4 In-app reminders, livestock, equipment, tank notes

Everything you log in the app — tank names, gallons, livestock species, equipment install dates, water-change reminders, test result history, AI scan readings — lives:

On your device (encrypted SwiftData storage)
In your private iCloud database (only if you've enabled iCloud sync), encrypted by Apple under your Apple ID

This data is NEVER sent to our backend. We don't have access to it. If you turn off iCloud sync, it stays solely on your device.

2.5 Crash and performance diagnostics

The app may collect anonymized crash reports and performance metrics (frame rate, memory usage, etc.) to help us identify bugs. These reports do NOT include photos, tank data, or your identifier. They are aggregated and used only to fix bugs.

If you opt out of "Share with App Developers" in iOS Settings → Privacy & Security → Analytics & Improvements, we receive no diagnostics at all.

2.6 In-app purchases

When you buy Pro Monthly, Pro Yearly, or Pro Lifetime, the transaction is processed entirely by Apple. Apple sends us a signed notification (App Store Server Notifications V2) telling us the transaction occurred so we can grant the entitlement. We receive:

The product ID purchased (e.g., com.cpmtek.aquariumcoach.pro.monthly)
An opaque transaction ID
The purchase / renewal / refund timestamp
Linkage to your Sign in with Apple identifier (only if you signed in before purchasing)

We do NOT receive your credit card number, billing address, or any other payment information. Apple handles all of that.

2.7 What we do NOT collect

We never collect: your location, contacts, health/fitness data, browsing or search history, audio recordings, biometric data, financial account info, contacts, calendar events, photos other than ones you explicitly submit for scanning, advertising identifiers (IDFA), tracking IDs of any kind. We don't use any third-party analytics SDK that tracks you across other apps (no Google Analytics, no Facebook SDK, no Mixpanel, no Segment).

3. Who else sees your data

3.1 Anthropic

Photos you submit for AI scanning are sent to Anthropic for analysis. Their privacy policy: https://www.anthropic.com/legal/privacy. We use Anthropic's API in standard mode — they may retain submissions briefly for abuse monitoring per their published policy but do NOT use submissions to train their models when accessed via the paid API.

3.2 Apple

Apple handles:

Sign in with Apple authentication
App Store + In-App Purchase processing
iCloud sync (if you've enabled it)
App Store crash reports (if you've opted in)

Apple's privacy policy: https://www.apple.com/legal/privacy/

3.3 Cloudflare

Network traffic from your device to our backend transits Cloudflare's edge (we use Cloudflare Tunnel for network ingress). Cloudflare may log connection metadata (IP address, timestamp, request size). They do not see request bodies (encrypted in transit). Cloudflare's privacy policy: https://www.cloudflare.com/privacypolicy/

3.4 We never sell or share data with anyone else

We do NOT sell any data. We do NOT share data with advertisers, data brokers, marketing platforms, social media platforms, or any other third party not listed above.

4. Where your data lives

Data	Storage location
Tank, livestock, equipment, reminders, test history	Your device (SwiftData) + your private iCloud database (if enabled). NEVER on our backend.
Sign in with Apple identifier (only if signed in)	Our backend's Postgres database, hosted on cpmtek-controlled hardware
AI scan response text logs	Our backend's Postgres database, retained ~30 days then auto-purged
Pro entitlement records	Our backend's Postgres database, retained indefinitely (needed for billing reconciliation)
Photo bytes during AI scanning	RAM only, during the ≤30 second API call. Then discarded.

Our backend is currently hosted on a small Kubernetes cluster on cpmtek-managed hardware. As we scale, this may move to a managed cloud provider (AWS, GCP, or DigitalOcean). Your data remains within the United States and EU regions only.

5. How long we keep your data

Type	Retention
On-device data (SwiftData)	Until you delete the app or tap Settings → Delete all local data
iCloud-synced data	Per Apple's iCloud retention. Deleted from your iCloud when you delete the app or sign out.
AI scan response logs	~30 days, then auto-purged by a scheduled job
Sign in with Apple ID + Pro entitlement state	Until you request deletion (see §7), or 7 years after your last sign-in (whichever is earlier), to satisfy tax record-keeping for the IAP revenue
Photo bytes	Never persisted past the AI call (~30 seconds in memory)

6. Encryption and security

All network traffic uses TLS 1.2 or higher (HTTPS).
Authentication tokens are stored in iOS Keychain with kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly — not synced to other devices, not backed up to iCloud.
iCloud-synced data is encrypted by Apple end-to-end under your Apple ID.
Our backend uses standard PostgreSQL access controls and is not exposed directly to the public internet (traffic enters via Cloudflare Tunnel).
We use only Apple's standard cryptographic frameworks (CryptoKit, Keychain, URLSession TLS) — no proprietary or non-standard encryption.

We do not yet have a SOC 2 or ISO 27001 certification. This may change as we grow.

7. Your rights and choices

7.1 Access and portability

View all your tank/test data inside the app at any time.
Export a PDF report of any tank: Settings → Reports → Generate PDF report.
Request a machine-readable copy of any backend data we hold about your account: email amtyurin@gmail.com. We respond within 30 days.

7.2 Deletion

Delete local data immediately: Settings → Delete all local data. iCloud-synced copies are deleted by Apple's sync system within ~30 minutes.
Delete your backend account (signed-in users): email amtyurin@gmail.com with the subject "Delete my account" from the email associated with your Sign in with Apple. We delete your backend record within 30 days.
Note: Apple retains some IAP transaction records for tax purposes regardless of our deletion, per Apple's policies.

7.3 Opt out of analytics

iOS Settings → Privacy & Security → Analytics & Improvements → Share with App Developers → toggle OFF. We will receive no diagnostics from your device.

7.4 Use the app without an account

You can use the app without ever signing in. All your data stays on your device + your private iCloud (if you've enabled it). You will:

Not be able to purchase Pro (Apple requires an Apple ID for IAP)
Not have iCloud sync (your data is local-only)
Be subject to free-tier scan limits the same way signed-in users are

7.5 GDPR / CCPA / EU-UK rights

If you're in the EU, UK, or California, you have additional rights under GDPR / UK GDPR / CCPA respectively, including:

Right to access, rectify, delete, restrict, or object to processing
Right to data portability
Right to lodge a complaint with your local data protection authority

To exercise any of these, email amtyurin@gmail.com. Our legal basis for processing is "performance of a contract" (delivering the app you've installed) for app data, and "legitimate interest" (running the app's anti-abuse systems) for diagnostics.

8. Children

Aquarium Coach is rated 9+ in the App Store. It is not directed at children under 13. We do NOT knowingly collect personal data from children under 13. If you are a parent or guardian and believe we have collected personal data from a child under 13, email amtyurin@gmail.com and we will delete it.

9. Changes to this Policy

We may update this Privacy Policy as the app evolves. When we do:

We update the "Effective date" at the top.
Material changes (new data categories collected, new third-party recipients) trigger an in-app banner at next launch.

10. Contact

Questions about this policy or about data we hold about you:

amtyurin@gmail.com

11. Required Apple App Store disclosures

Per Apple's App Privacy nutrition labels (visible on the App Store listing):

Data collected	Linked to your identity	Used to track you	Purpose
Photos	No	No	App Functionality
User ID	Yes	No	App Functionality
Crash Data	No	No	App Functionality
Performance Data	No	No	App Functionality, Analytics

Everything else is Not Collected.