Privacy Policy

Last updated: November 2, 2026

The Boy Aquarium (“we”, “us”) runs boyaquarium.app, a private journal where you keep notes about the people you’re dating and share them with friends you choose. This policy explains what personal information we handle, why, and the choices you have. We follow Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA).

1. What we collect

• Your account: your email address, a password (stored only as a secure hash by our login provider), and the mermaid name and aquarium name you choose.
• What you put in your aquarium: the names, photos, zodiac signs, notes, date ratings, screenshots and anything else you add about the people in your tank.
• Sharing: the email addresses of friends you invite or who ask to join, and whether you approved them.
• Activity: which fish you fed, when, and any note you left with the food.
• Technical information: our hosting and email providers keep standard logs (such as IP address, browser type and timestamps) to run and secure the service. Your browser stores a login token so you stay signed in. We don’t use advertising or tracking cookies, and we don’t sell your information.

2. Information about other people

Your aquarium is about other people, and they haven’t signed up for it. You’re responsible for what you add and for having the right to add it. Please keep it to what you’d be comfortable with them reading. Our Terms list content that isn’t allowed. If you believe you’re described in someone’s aquarium in a way that breaks our Terms, email us at the address below and we’ll review it.

3. How we use it

• To run your account and show your aquarium to you and to the friends you approve.
• To send emails you or a friend trigger: confirming your account, resetting your password, invites and approvals.
• To keep the service secure, fix problems, and enforce our Terms.

We don’t use your content to build advertising profiles, and we don’t read your aquarium except where it’s needed to investigate a report, fix a problem you asked us about, or comply with the law.

4. Who can see your aquarium

Only you and the friends you approve. A friend gets access when you invite their email, or when they open your share link, ask to join, and you approve them. They have to confirm that email address before they can see anything. You can remove anyone at any time from Share. Keep in mind that anyone who can see your tank can take screenshots of it, and we can’t control what they do with them.

5. Service providers and where data is stored

• Supabase: database, file storage and logins. Your account and aquarium are stored in Supabase’s Canada (Central) region.
• Vercel: hosts the website. Pages are served from a global network, and Vercel may process request logs outside Canada.
• Resend: sends our emails. It processes recipient email addresses and email content in the United States.
• Google Fonts and jsDelivr: deliver fonts and code to your browser. They may see your IP address.

When information is processed outside Canada, it’s subject to the laws of that country and may be accessible to its authorities. We only use providers that commit to protecting it.

6. How long we keep it

We keep your information while your account is open. When you delete a boy, a screenshot or your account, it’s removed from the live service right away. Copies in our providers’ backups are deleted on their regular schedule, normally within 30 days. If a friend deletes their account, their feedings disappear from your tank too.

7. Your choices and rights

• See and download your data: Settings → Download my data.
• Correct it: edit anything in your aquarium, or change your names in Settings.
• Delete it: Settings → Delete my account removes your account, your aquarium and everything in it.
• Ask us: email us to request access, correction or deletion, or to withdraw consent. We’ll reply within 30 days. If you’re not satisfied with our answer, you can contact the Office of the Privacy Commissioner of Canada.

8. Security

Data is encrypted in transit. Database rules check every request so that an aquarium can only be read by its owner and approved friends, and photos are stored privately and shown through short-lived links. No system is perfect, so please use a strong password that you don’t use anywhere else. If a breach puts you at real risk of significant harm, we’ll notify you as the law requires.

9. Age

The Boy Aquarium is for adults 18 and older. If we learn that an account belongs to someone under 18, we’ll delete it.

10. Changes

If we change this policy in a meaningful way, we’ll update the date above and let you know in the app or by email.

11. Contact

Questions, requests or reports: hello@boyaquarium.app
This address reaches the person responsible for privacy at The Boy Aquarium.