Privacy policy

Last updated 4 October 2026

This policy explains what Aquarius ("the game"), run by the Aquarius team, stores about you, why, and what you can do about it. Contact: (contact email not published yet).

What we store

• Your account: username, email address and whether you confirmed it, password (only as a salted scrypt hash, never the password itself), whether it is a guest account, your progress (level, XP, coins, diamonds, avatar, title, aquariums, fish and items), when the account was created, when you were last online, and who invited you if you joined through an invite link.
• Signing in with Google, Apple or Discord: if you choose to, we store which service it is, the account id that service gives us and the email address it shares with us (with Apple this can be a private relay address that forwards to you). We don't get your password for that service or access to anything else in that account.
• What you create and share: aquarium names and descriptions, fish names, your profile bio, comments, likes, follows, gifts, trade offers and their messages, and visits to other players' aquariums.
• Chat: messages in an aquarium's chat go live to the people in it and are not saved. The server keeps them in memory for up to 3 hours so they can be reported, then forgets them. If someone reports a message, its text is copied into the report.
• Reports and blocks: who you reported or blocked, the reason and note you gave, and the reported content.
• Purchases: on the web, diamond packs and offers are paid through Stripe. We store the order (your account id, what you bought, amount, currency, status and Stripe's reference). Your card details go to Stripe and never reach us.
• Technical data: sign-in sessions (the server keeps only a hash of your sign-in token), the days you played (for statistics), and your IP address, which is used for a short time in memory to stop abuse such as too many sign-in attempts. The game doesn't save IP addresses; the hosting provider may keep ordinary server logs.
• Notifications: if you turn on notifications in a browser or in the Aquarius app, we store the address its push service gave it (in the app, the device token from Google or Apple), the keys to encrypt messages for it (browsers only), its time zone (so notifications can wait until the morning) and which notifications you already got. We use them only to send the game's notifications.
• On your device: the game keeps your sign-in token, your graphics settings, an invite code you arrived with, which announcement you closed and whether you turned notifications on (in the app, with its device token) in the browser's or app's local storage.

There are no ads, no analytics or tracking tools, and no tracking cookies. Apart from your email address, we don't ask for your real name, phone number, location, contacts or photos.

Why we use it

• To run the game you signed up for: save your progress, show your aquariums and profile, deliver gifts, trades and purchases (contract).
• To send account emails: a link to confirm your address, a link to reset a forgotten password when you ask for one, and a notice to your old address when the email on your account changes (contract). We don't send newsletters or marketing emails.
• To keep the game safe and fair: filter offensive words, handle reports, enforce blocks, suspend accounts that break the terms, and stop cheating and spam (legitimate interest).
• To see how the game is doing through totals such as players online or daily players (legitimate interest).
• To keep purchase records for accounting (legal obligation).
• To send the notifications you turned on, such as fry being born or an aquarium that needs cleaning (consent: turn them off any time in Settings, in your browser or in your phone's settings).

What other players can see

Your username, avatar, title, level, bio, public aquariums (with their fish, decorations, likes and comments), your comments, whether you are online, that you visited their aquarium, and that you are in an aquarium while you are in it. Aquariums you make private are only visible to you. Players you block can't see you in aquariums or chat with you. Your email address and the services you sign in with are never shown to other players.

Who else gets data

We don't sell or rent your data. These service providers process it for us: Railway (railway.com), which hosts the game's servers and database; Resend (resend.com), which delivers our emails and so receives your email address and the email; and Stripe (stripe.com), which handles web payments. If you turn on notifications in a browser, its push service (run by Google, Mozilla, Microsoft or Apple, depending on the browser) delivers them; they are encrypted so only your device can read them. In the Aquarius app, Google's Firebase Cloud Messaging (Android) or Apple's Push Notification service (iPhone and iPad) delivers them, and so receives the device token and the notification's text. If you sign in with Google, Apple or Discord, that service confirms who you are, and its own privacy policy applies to what it does. We would also share data if the law required it.

How long we keep it

• Your account and everything in it: until you delete the account. A changed email address replaces the old one.
• Email links: a confirmation link works for 24 hours and a password reset link for 1 hour. Each works once, and we keep only a hash of it.
• Guest accounts: deleted automatically after 30 days without being used.
• Chat messages: at most 3 hours, in memory only.
• Notifications: a device's push address or token until you turn notifications off or sign out on that device, or it stops working. Notifications waiting to be sent: at most 2 days.
• Reports: until handled, then for 180 days.
• Statistics: players online for 31 days, days played for about 13 months.
• Purchase and sales records: as long as accounting rules require. They hold only the account id, the item and the amount.

Deleting your account

You can delete your account at any time in the game (Profile → Settings → Account → Delete account). It is deleted right away together with your email address, linked Google, Apple or Discord sign-ins, aquariums, fish, comments, likes, follows, visits, notifications, blocks and sign-in sessions. Open trade offers are closed and their items returned, and trade messages you sent are removed. Reports you made stay so they can still be reviewed, without your name. Details: delete your account.

Children

Aquarius is not meant for children under 13. In some countries you must be older to agree to this policy yourself; if that applies to you, a parent or guardian has to agree for you. If you think a child under 13 has an account, contact us and we will delete it.

Your rights

You can ask for a copy of your data, have it corrected or deleted, ask us to limit or stop using it, or object to how we use it. Most of it you can change or delete yourself in the game. For anything else write to (contact email not published yet). If you live in the EU, EEA or UK you can also complain to the data protection authority where you live.

Changes

If this policy changes, we will update this page and the date at the top. Important changes will also be announced in the game.