Fish Thanks privacy policy
Controller
Fish Thanks is provided by CARLOS EDUARDO PEREIRA GONCALVES AGENCIA DE PUBLICIDADE LTDA (nome fantasia STARTUP KIT), CNPJ 51.471.362/0001-00, Avenida Paulista, 1106, sala 01, 16º andar, Bela Vista, São Paulo/SP, CEP 01310-914, the controller of the personal data processed by the app and by the app's server. Contact for any privacy matter: suporte@fishthanks.app. As a small-scale processing agent, the company does not appoint a data protection officer (LGPD, art. 41) and keeps this communication channel with data subjects (ANPD Resolution CD/ANPD No. 2/2022, art. 11, § 1).
What the app does without an account
The whole app works without an account. The aquarium, routines, history, test kit readings, timeline photos, reminder choices and the assistant conversation stay on the device only. None of it is sent to any server while there is no account. The app uses no third-party advertising, analytics or crash reporting SDK, and does not track the user across apps or websites. With the user's permission, the app itself sends usage data to the app server, with nothing from the aquarium (see Optional app usage data).
The camera and the photo library only open when the user chooses to take or pick a photo. Reminder notifications are scheduled on the device itself, with no push server, and the system permission is only requested when the user turns reminders on.
What we process when there is an account
The account is optional and is used to sync the aquarium across devices and for the Pro plan.
| Data | Purpose | Where it is kept |
|---|---|---|
| E-mail and account identifier (sign in with Apple, with Google or with an e-mail code) | Identify the account and allow sign-in | App server |
| Aquarium document: setup, fauna and flora, completed routines, events, test kit readings and photo file names (the photos themselves are not uploaded) | Sync across devices | App server |
| Purchases and subscriptions: product, store, transaction identifier, dates and the store's validation response | Unlock Pro and process renewals, cancellations and refunds | App server |
| Credits and assistant usage: question type (text or photo), cost, model and token counts | Meter Pro credits | App server |
| Question to the assistant, aquarium context and up to three photos per question | Answer the question on Pro | Pass through the app server to the AI provider; the app server does not keep the question text or the photos |
Payments are made through the App Store and Google Play. Neither the app nor the server receives or stores card data.
Pro assistant and photos
When the user sends a question to the Pro assistant, the text, an aquarium summary generated by the app and the attached photos go to the app server and from there to the Pro assistant's AI provider: OpenRouter, which forwards the request to the chosen model. The server asks OpenRouter to route only to providers that do not store or train on the submitted data. We do not use the photos to train any model. The app says so before the first photo. The photo copy and the conversation stay on the device.
Optional app usage data
With the user's permission, the app sends the app server a summary of each day the user uses the app. This is usage data linked only to a random number on this device, with no name, e-mail or account. The app asks for this permission once, on a screen with the buttons "Aceitar" (accept) and "Agora não" (not now).
| Data | Purpose | Where it is kept |
|---|---|---|
| Random installation number, generated on the device only after the yes | Group the summaries of the same device | App server |
| Day of use, app and system version (Android or iOS), phone brand (manufacturer) and whether reminders are on | Measure usage, retention and stability by version and by brand | App server |
| How many times each feature was used that day: routines, readings, photos, species, diagnosis, export, opened reminders, assistant, sign-in, sync, subscription screen and purchases | Learn which features are used | App server |
| App failures: type, code location and count, with no error message and no user text | Find and fix failures | App server |
| Date and version of the accepted text | Record the consent | App server |
The purpose is to measure the app's usage, retention and stability in order to improve it.
The number is not linked to the account, the e-mail or the sign-in: the request does not carry the account token, and the app works the same with or without an account. So deleting the account does not delete the summaries; turning the sending off does.
Not in the summary: what the user writes, the photos, the aquarium data, the device model and the location. The sender's IP address is not stored: the count of requests per IP, which limits repeated requests, lives only in the server's memory and is gone within two hours at most.
Nothing is collected before the yes. Choosing "Agora não" sends nothing, and the app does not ask again. To turn it off at any time, use the "Enviar dados de uso" (send usage data) switch in About, on the Tank tab. Turning it off deletes the number from the device and has the app ask the server to delete the summaries linked to it; without a connection, the app repeats the request on the next launches. Turning it on again creates a new number.
Uninstalling the app without turning it off first leaves the summaries on the server until the 90-day limit, because the server has no way to find the number by name or e-mail.
The summaries are not shared with anyone. They are kept on the app server, on the Hostinger VPS, the hosting listed in Who the data is shared with.
Website waitlist
Before launch, visitors to https://fishthanks.app can join the Fish Thanks waitlist. The waitlist is separate from the app and from the account. Launch, in this policy, means the app's release to production in the stores, open to the public, after the closed tests.
| Data | Purpose | Where it is kept |
|---|---|---|
| Announce the app's launch and invite the person to test the app before launch | App server; during the app test, also on the test panel, a private spreadsheet of the controller on Google Drive | |
| Date and version of the consent text and the spot on the website where the request came from | Record the consent | App server |
An e-mail only joins the list after the person ticks the consent box and confirms through the link sent to that e-mail. Without confirmation within 7 days, the request is deleted. The requester's IP address is not stored: the count of requests per IP and per e-mail, which limits repeated requests, lives only in the server's memory and is gone within two days at most.
During the test, the controller tracks on a private panel who was invited to test and which stage of the test the person is at (installed, answered the follow-up check-ins). The panel is not shared and is deleted within 30 days after the end of the test.
To leave the list, open the "leave the list" link in the confirmation e-mail and confirm on the page it opens, which deletes the e-mail immediately, or write to suporte@fishthanks.app.
Legal bases
- LGPD, art. 7, V, and GDPR, art. 6(1)(b): performance of the contract with the user, for the account, sync, purchases, credits and assistant.
- LGPD, art. 7, I, and GDPR, art. 6(1)(a): consent, for the website waitlist. Consent can be withdrawn at any time by leaving the list.
- LGPD, art. 7, I, and GDPR, art. 6(1)(a): consent, for the app usage data. Consent can be withdrawn at any time with the "Enviar dados de uso" switch in About.
- LGPD, art. 7, IX, and GDPR, art. 6(1)(f): legitimate interest, for service security and abuse prevention (for example, the per-minute question limit on the assistant).
- LGPD, art. 7, II, and GDPR, art. 6(1)(c): compliance with a legal obligation, when a law requires keeping a record.
Who the data is shared with
Only with processors that provide the service on our behalf, and data is never sold:
- App server (https://api.fishthanks.app) and website (https://fishthanks.app) hosting: Hostinger (VPS). Hostinger is also the e-mail service that sends the waitlist confirmation.
- Pro assistant AI provider: OpenRouter (final model and sub-processor to be confirmed by the operator), only for Pro users and only what was sent in the question.
- Apple and Google, to process and validate purchases under each store's policies.
- Apple and Google as sign-in providers, when the user chooses to sign in with them.
- Google, during the app test: Google Drive, where the private test panel is kept.
Pro assistant data (question, aquarium context and photos) may be processed outside Brazil by the AI providers used through OpenRouter. This is an international data transfer under the LGPD (art. 33) and follows the contractual safeguards the operator has with OpenRouter; for users subject to the GDPR, chapter V applies. The same holds for any other processor on this list that handles data outside Brazil.
How long
- While the account exists, the account data stays on the server.
- When the account is deleted, the server immediately deletes the identity, the synced aquarium, purchases, credits and assistant usage.
- The waitlist e-mail is kept until 90 days after the app launches in the stores or until the person leaves the list, whichever comes first. An unconfirmed request is deleted after 7 days. The test panel is deleted within 30 days after the end of the test.
- Summaries linked to the random number are deleted automatically 90 days after the day of use; only the total for each day remains, without the number (how many devices used the app, the sum of each count and failures by type).
- Records of store notifications (renewal, cancellation, refund) are kept so the same notification is not processed twice; they carry no e-mail.
- Server backups and technical logs, if any, are kept for 30 days and then deleted.
- Data on the device stays until the user erases it ("Recomeçar do zero" on the Tank tab) or uninstalls the app.
Data subject rights
The user may request confirmation, access, correction, portability, anonymization or deletion of their data, information about sharing, and withdrawal of consent (LGPD, art. 18; GDPR, arts. 15 to 22).
- Access and portability: About, on the Tank tab, has "Exportar dados" (export data), which produces a file with the aquarium as JSON plus the photos on the device.
- Deletion: the Account screen has "Excluir conta" (delete account), which really deletes on the server. Steps and the request without the app are in account deletion page.
- Withdrawal of consent for usage data: the "Enviar dados de uso" switch in About, on the Tank tab, turns the sending off and asks the server to delete the summaries. A request to suporte@fishthanks.app cannot locate these summaries, because they are linked only to the random number, which only the device holds.
- Any other request: suporte@fishthanks.app. The data subject may also complain to the ANPD or to the data protection authority of their country.
Security
Communication between the app and the server (https://api.fishthanks.app) uses HTTPS. Sign-in tokens are kept in the system's secure storage (Keychain on iOS, Keystore on Android). The app never talks to the AI provider directly and holds no provider key; everything goes through the app server.
Children
The app is not directed at children under 13 and does not knowingly collect data from children. Purchases and subscriptions follow the stores' parental controls.
Changes to this policy
Material changes are announced in the app or on this policy's page, with the date of the new version.
Last updated: October 20, 2026.