Privacy Policy

1. Two different kinds of data, and our two different roles

Most of TankBud is a personal aquarium app: you create an account and keep records about your own tanks. For that data we are the controller, which means we decide how it is handled and this policy governs it.

TankBud for business adds a second kind of data. If you maintain tanks for other people, you can store records about your clients and send them invoices and service reports. That means you are putting other people's personal information into TankBud. For that data, you are the controller and we are your processor: we hold and process it on your instructions so the features work, and we do not use it for our own purposes. Section 6 covers this in detail.

If you are one of those clients and you reached a TankBud invoice or service report through a link, section 7 is written for you.

2. Information we collect about you

Your account. When you sign up we collect your email address and a password. Your password is stored in hashed form by our authentication provider; we never see it in readable form. You can also add an optional display name.

Your aquarium records. The tanks, water test results, livestock, plants, equipment, maintenance logs and reminders, materials, planned tanks, and any photos or notes you attach to them.

Your business records, if you use TankBud for business. Your business name, contact details and logo, your team members and their roles, the payment handles you choose to display on invoices, and the invoices, payments, service reports and recurring schedules you create. This category includes personal information about your clients, which section 6 covers separately.

Preferences and delivery records. Your email alert preference, your theme choice, and a record of the reminder emails we have already sent you so we never send the same alert twice.

Support correspondence. If you email us for help, we keep that correspondence so we can answer you.

Technical information. Our infrastructure providers keep standard server logs, such as IP address and browser type, for security and troubleshooting.

3. How we use your information

We use your information to run TankBud: to store your records and show them back to you, to keep your account secure, to provide the business features you turn on, and to send you emails that are part of the service, such as email confirmation and password reset. If you turn on email alerts, we also email you when your reminders come due. If you subscribe, we use your billing details to manage the subscription and tell you about trial and payment problems.

We do not sell or share your personal information for advertising, we do not show ads, and we do not use your data or your clients' data to train machine learning models. We do not share your data with anyone beyond the service providers listed in section 8.

4. Analytics and cookies

TankBud uses PostHog, a product analytics service, to understand how the app is used: which pages are visited and which features people use. This runs under a single first-party cookie so we can recognize returning visitors. When you click a retailer link in a care guide, we also count the click, without tying it to you or your account. We use no advertising trackers, no cross-site tracking, and we never sell your data. If your browser sends the Do Not Track signal, analytics stays off.

Inside the app we also record session replays tied to your account, with everything you type masked, so we can find and fix confusing screens. Replays are never recorded on shared pages, so a client opening your invoice or service report is never recorded.

The only other cookies we set are the session cookies that keep you signed in and remember which workspace you are viewing. We set no other cookies. Your light or dark theme choice is saved to your account so it follows you between devices, as listed in section 2.

5. Payments and subscriptions

If you subscribe to TankBud for business, Stripe processes the payment. Your card details go to Stripe directly and never touch our servers; we keep only your subscription status, plan, seat count and the Stripe references we need to manage it.

If you turn on online payments so your clients can pay you by card or bank transfer, you create a Stripe connected account. Stripe collects the identity and bank details it needs to verify you and pay you out, under Stripe's own privacy policy. We never see or store those details. We record only that the connected account exists, whether it is cleared to accept payments, and the payment records that result.

6. Your clients' data, and what we do with it

If you use TankBud for business, you can store a client's name, email address, phone number, postal address and free-text notes, and that information is copied onto the invoices and service reports you create for them. You decide what to enter. We process it only to provide the features you are using: showing it back to you, rendering it on invoices, reports and PDFs, and delivering those to the recipient you choose.

We do not contact your clients for our own purposes, do not market to them, and do not use their information for anything except running the features you turned on.

You are responsible for having a lawful basis to enter your clients' information and for telling them how you use it, as described in our Terms of Service. TankBud is built for businesses operating in the United States. If your own compliance obligations require a formal data processing agreement, email us before you rely on TankBud for that data so we can tell you what we can offer.

7. If you received an invoice or report from a TankBud user

When a business sends you an invoice or a service report built in TankBud, we host that page on their behalf. The business chose what it contains. We record when the page is opened and when a payment link is tapped, so the business can see that you received it, and if you use the "I've sent payment" form we store what you enter so we can pass it to them. If you pay online, Stripe handles the payment and your card details never reach our servers.

The business that sent it is the controller of your information. To correct or remove it, contact them directly. You are welcome to email us as well and we will help you reach them, but they decide what happens to their records.

8. Service providers

TankBud runs on a small set of providers, and each one only handles what it needs to do its job:

• Supabase stores our database, handles sign-in, and holds uploaded photos.
• Railway hosts the website and the app.
• Cloudflare provides DNS and sits in front of our domains.
• Resend delivers the emails we send, including the invoices and reports you send to your clients.
• Google Workspace receives mail sent to our support address.
• PostHog stores the analytics described in section 4.
• Stripe processes subscriptions and, if you enable it, the payments your clients make to you.

We may add or change providers as TankBud evolves, and we will keep this list current. We do not otherwise disclose your information except where the law requires it, or to protect the rights and safety of TankBud, our users, or the public.

9. Photos

Photos are resized in your browser before anything is uploaded. We store two WebP copies, one for display and a smaller thumbnail, in private storage that only your signed-in account can access. The original file never leaves your device, and because the copies are re-encoded rather than passed through, camera metadata does not travel with them. That includes any GPS coordinates your phone recorded, which matters because photos can end up on a page you share.

If you share a tank or plan, or attach photos to a service report you send, the photos on that page are visible to anyone with the link for as long as sharing stays on.

10. Sharing and links

Sharing is off by default. When you turn it on for a tank or plan, or send an invoice or service report, we create a view-only page at a link containing a long random token. Anyone with the link can see that page without signing in, so share it only with the people it is meant for. Shared pages are marked so search engines do not index them.

Turning sharing off for a tank or plan, or replacing the link, stops the old link working. An invoice link stays live so your client can still see what they owe and what they paid.

11. Emails we send for you

When you send an invoice, a receipt or a service report, we deliver it to the address you chose. It is sent from a TankBud address with your business name shown as the sender, and replies go to your own contact address. If you set up recurring invoices, we send those on the schedule you chose until you pause or delete it. You control who receives these and when.

12. Keeping and deleting data

When you remove a record in the app, it is archived rather than destroyed right away, so an accidental deletion is recoverable. We keep your data for as long as your account is open.

If you want your account closed and your data deleted, email us and we will take care of it. There is not yet a button for this in the app, so it goes through support, and we will confirm when it is done.

Two things are worth being straight about. First, some records survive deletion because the law requires it or because we need them to establish or defend a legal claim: invoices, payment records and the tax and accounting records built from them. Second, we keep an append-only log of certain account actions, and a record of any enforcement action taken against an account, so that history cannot be rewritten. We keep those for as long as we are required to and no longer, and we do not use them for anything else.

Backups are removed on a rolling schedule, so a deleted record can persist in a backup for a short period after it is gone from the app.

13. Your rights

You can edit or remove any record you have created, export your water test history and your invoice, line item and payment records as CSV files, download invoice PDFs, turn reminder emails on or off in Settings, turn sharing on or off, and change your password at any time.

Depending on where you live, you may also have the right to access the personal information we hold about you, to correct it, to have it deleted, to receive a portable copy, to object to or restrict how we use it, and to withdraw consent where we rely on it. If you are in California, you have the right to know what we collect, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioral advertising.

To exercise any of these, email [email protected]. We will respond within the time the law allows. If a request concerns information a TankBud business holds about you as their client, see section 7: we will pass it to them, but they decide.

14. Where your data is processed

TankBud is operated from the United States and our providers store and process data there. If you use TankBud from outside the United States, your information is transferred to and processed in the United States, where privacy laws may differ from those where you live.

15. Security

Access to your records is enforced in the database itself, so one account cannot read another's data. Photos are held in private storage, connections are encrypted in transit, and payment card details never reach our servers. No service can promise perfect security, but if a breach ever affects your personal information we will tell you and the relevant authorities as the law requires.

16. Children

TankBud is not directed at children. You must be at least 13 years old to create an account, or older if the law where you live sets a higher age for online services. If we learn we have collected information from a child below that age, we will delete it.

17. Changes to this policy

We may update this policy as TankBud evolves. When we make material changes, we will update the date above and, where appropriate, let you know in the app.

18. Contact

Questions about this policy or your data? Email us at [email protected], or write to TankBud LLC, 2661 Mount Victor Lane, Apt 1414, Bowling Green, KY 42103, United States.