Privacy policy — CyberAquarium

CyberAquarium is a desktop aquarium application for Windows, developed and operated by channing xiao, an individual software developer (“the developer”, “we”, “us”, “our”). This policy explains what we collect, why, and the choices you have. It covers the app, cyberaquarium.app, and the community forum.

1. Summary

We collect the minimum needed to license the app and keep it reliable.
Payment and billing data are handled by our payment provider, not stored on our servers.
Your tanks, scenery, presets and local settings stay on your device.
We do not sell personal information.

2. Information we collect

2.1 Licence and device data

When you activate a licence, we store:

the licence key as a one-way hash (we never keep the plaintext after it is issued);
a salted hash of a device identifier, used to bind the licence and enforce the device limit;
app version, operating system and activation timestamps.

We use this to validate the licence, let you move to a new machine, and prevent abuse.

2.2 Product telemetry

The app sends anonymous usage events: session start and end, which screens were opened, which features were used, frame-rate buckets, and errors. Events carry a random installation id. They do not contain your name, email address, file paths, screen contents, keystrokes or window titles.

2.3 Website and community

When you visit cyberaquarium.app, we collect aggregate page and click events through our own endpoint and Cloudflare Web Analytics. These use a random identifier stored in your browser, set no advertising cookies, and are suppressed when your browser sends Do Not Track.

The community forum is a separate Discourse installation. It sets its own cookies once you register, and its privacy behaviour is described on the forum itself.

2.4 Support and legal communications

If you email us, we receive your address and the content of your message so we can reply. If you buy a licence, we keep the email address and the correspondence needed to answer you and to meet tax and accounting obligations.

2.5 Payment data

Purchases are processed by Creem, which acts as Merchant of Record. Creem collects payment details, billing address and transaction records. We receive limited purchase metadata — email, product purchased, transaction id, amount and currency — to deliver your licence. We never receive your full card number.

Payment data is subject to Creem’s privacy policy, shown at checkout and on your receipt.

3. What we do not collect

We do not require an account to use the desktop app.
We do not upload your tanks, scenery, presets or local configuration.
We do not access your microphone, camera or files beyond what the app needs to run.
We do not run third-party advertising trackers on the website.

4. How we use information

Validate and manage licences, including device limits and re-activation.
Deliver licence keys and purchase confirmations.
Provide customer support.
Improve stability, performance and security.
Comply with legal, tax and accounting obligations.

5. Legal bases (EEA / UK)

Where applicable, we rely on: contract (delivering the app and licence you purchased), legitimate interests (fraud prevention, security, product improvement), consent (where required, for example optional analytics), and legal obligation (tax, accounting, regulatory requirements).

We share data only with processors that help us run the service:

Cloudflare — hosting, CDN, email routing and delivery.
Creem — payment processing and tax handling.
Our transactional email provider — licence delivery and support notifications.
The forum host — community discussions, if you choose to register.
Authorities — when required by law or to protect our rights.

We do not sell personal information.

7. Retention

Raw telemetry events: 90 days. Aggregated statistics: up to 24 months.
Licence and order records: as long as needed for accounting, tax and dispute resolution (typically 7 years).
Support email: 24 months after the last message, unless you ask us to delete it sooner.
Forum content: until you delete it or ask us to.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or restrict processing of your personal data, and to object or withdraw consent. Write to [email protected]. We answer within 30 days. If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

9. Security

We use reasonable technical and organisational measures: hashed licence keys, hashed device identifiers, signed licence tokens, access-controlled admin systems and audit logging. No method of transmission or storage is completely secure.

10. Children

CyberAquarium is not directed at children under 16 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.

11. International transfers

Data may be processed in countries other than yours. Where required, we rely on appropriate safeguards such as standard contractual clauses.

12. Changes

We may update this policy. The “last updated” date above will change when we do, and material changes will be announced on the website before they take effect.

13. Contact

Privacy requests: [email protected]. Other enquiries: [email protected].

Operated by channing xiao, an individual software developer.