Privacy Policy
We respect that your reef setup is personal. Here's exactly what we do with the data you give us, in plain language.
1. What we collect
When you create an account:
- Email address (for sign-in + maintenance notifications)
- Password if you use one — hashed with bcrypt; we never see the plaintext
When you use the app:
- Tank details (name, volume, livestock, equipment, photos you upload)
- Test readings (alk, Ca, Mg, nitrate, phosphate, salinity, etc.)
- Tasks, supplies, dose events you log
- Sessions (which device you're signed in on)
- Mobile phone number — only if you opt in to SMS alerts (Account → Notifications). We store the number and a timestamp of your consent.
When you visit our landing page:
- Page views, anonymous device class (mobile/desktop), referrer
- Your IP is hashed with a per-server salt before storage — we never store raw IPs from anonymous visitors
2. Why we collect it
To make the app work. Test readings drive the Sensei Score. Livestock data drives the species fit checker. Photos let you see your tank's progression over time. The hashed visit data tells us whether the landing page is reaching people.
3. What we share with third parties
Two services, both core to running the app:
- Anthropic (Claude AI) — when Sensei generates a narrative, livestock advice, or dose commentary, the relevant tank data is sent to their API with a hashed version of your user id (not your email). See Anthropic's privacy policy.
- Resend — used to send magic-link sign-in emails and notification emails. They see your email address.
- Telnyx — used to deliver SMS text alerts to the mobile number you opt in with. They process your number solely to send those messages.
SMS / text message alerts
If you opt in (Account → Notifications → Text message), AquaSensei sends you critical, time-sensitive tank alerts by SMS — e.g. a chemistry parameter out of safe range, a skimmer overflow, or a monitoring device offline. These are transactional notifications only; we never send marketing texts. Message frequency varies with your tank's activity. Message and data rates may apply.
You consent by entering your number and tapping Confirm. You can opt out any time by replying STOP to a message, or by turning SMS off in Notifications; reply HELP for help. Consent is not required to use AquaSensei and is not a condition of any purchase.
No mobile information — your phone number or your SMS opt-in/consent — is ever shared with third parties or affiliates for marketing or promotional purposes. The only third party that receives your number is our messaging carrier (Telnyx), solely to deliver the alerts you asked for.
We do not use:
- verifiedGoogle Analytics, Mixpanel, Hotjar, or any third-party analytics
- verifiedFacebook/Twitter/etc. tracking pixels
- verifiedCross-site fingerprinting
- verifiedAd networks
You can verify this yourself: open browser devtools on aquasensei.app and watch the network
tab. The only external requests are to fonts.googleapis.com (Google Fonts, no
tracking) and our own domain.
4. Cookies
Two cookies, both HttpOnly + Secure + SameSite=Lax:
- A session cookie for authenticated users
- A separate admin cookie for site admin login
No third-party cookies. No tracking pixels. No browser fingerprinting.
5. AI spend tracking
Every AI call (Sensei narrative, livestock advice, dose advice) is recorded in our internal
ai_usage table with your user id, the feature it was for, token counts, and
cost. This drives per-user spending caps so a compromised account can't burn unbounded AI
cost. The contents of the AI request and response are not stored — only the
metadata.
6. Your rights
You can:
- Export everything any time from settings (JSON dump of every reading, task, photo, livestock entry)
- Delete your account any time — data goes within 30 days
- Ask what we have on you — email [email protected]
- Correct anything that's wrong — most things you can edit yourself; for anything else, email us
These apply regardless of where you live. We do this not because GDPR/CCPA says so, but because it's the right way to run a tool that touches your hobby.
7. Security
- Passwords are hashed with bcrypt cost 10
- Sessions use HttpOnly Secure SameSite=Lax cookies
- Magic-link tokens are single-use and expire in 15 minutes
- All connections are TLS
- AI API calls are guarded by per-user spend caps + a global monthly cap + a kill switch
We're a small team. If we have a security incident affecting your data, we'll tell you within 72 hours of discovering it.
8. Children
AquaSensei is not intended for children under 13. We don't knowingly collect data from anyone under 13.
9. Changes to this policy
If we change it in a material way, we'll prompt you to re-acknowledge on your next sign-in. The previous version will stay archived in case you want to compare.
10. Contact
Email [email protected] for any privacy question.