Privacy Policy

This Privacy Policy explains how your personal data is collected, used, and protected when you use the Coralist mobile application (the "App").

1. Information We Collect and Legal Basis

We process your personal data only when we have a valid legal basis under GDPR Art. 6(1). The table below maps each data category to its legal ground.

Data Category	Examples	Legal Basis (GDPR Art. 6(1))
Account Information	Email address, full name, avatar (via Supabase Auth); OAuth tokens from Google or Apple Sign-In	(b) Contractual necessity — required to create and operate your account
Aquarium Telemetry	Water parameters, equipment, livestock inventory, maintenance logs, dosing records	(b) Contractual necessity — core service functionality
AI Interaction Data	Anonymized prompts sent to Google Gemini; AI-generated responses	(b) Contractual necessity — to deliver the AI analysis features you request
Flagged AI Responses	Conversation history and flagged reply when you report an inaccurate AI response	(f) Legitimate interest — to monitor and improve AI output quality and safety
Usage & Rate-Limit Data	API call timestamps, monthly request counts (usage_tracking, token_usage_logs)	(f) Legitimate interest — to enforce fair-use rate limits and prevent abuse
Subscription Data	Anonymous app user ID, subscription tier, entitlement status (via RevenueCat)	(b) Contractual necessity — to manage your subscription
Support Communications	Email contents when you contact [email protected]	(b) Contractual necessity — to respond to your inquiry
Local Notifications	Notification preferences and scheduled reminders	(b) Contractual necessity — stored on-device only

We do not use third-party tracking, advertising, or analytics SDKs (no AdMob, Meta Pixel, Mixpanel, or similar).

Anonymous Sessions: If you use the App without creating an account, a temporary anonymous session is created via Supabase Auth to enable basic functionality. No personally identifiable information is collected in this mode. Anonymous session data is not retained after account creation or app uninstallation.

2. How We Use Your Information

We use the collected information for the following purposes:

• To create, manage, and secure your account.
• To provide core features, including charting water parameters and reminding you of maintenance tasks.
• To generate personalized AI-driven insights (see Section 3).
• To process in-app purchases and manage subscription entitlements.
• To communicate with you regarding updates, security alerts, and support messages.

3. Artificial Intelligence (AI) Data Processing

Coralist uses Google Gemini (via the Google Cloud Generative AI API) to power parameter analysis, compatibility assessments, task generation, and the conversational assistant.

• Anonymized Data Transmission: When you request an AI analysis, we transmit non-personally identifiable aquarium data (water parameters, livestock types, equipment inventory, and your optional notes) to the Google Gemini API. Your personal information (name, email, account ID) is never included in AI prompts.
• AI Response Flagging: If you flag an AI response as inaccurate, the conversation history and flagged reply are stored in our database linked to your user ID, for the purpose of monitoring AI quality and safety.
• No Model Training: We access Google Gemini via its paid API tier, which is governed by the Google Cloud Platform Terms of Service and the Generative AI Prohibited Use Policy. Under these terms, data submitted via the API is not used to train or improve Google's foundation models.

Sub-Processors

Provider	Purpose	Data Processed	Location	Transfer Mechanism
Supabase Inc.	Authentication, database, edge functions	Account data, aquarium telemetry, usage logs	EU (Ireland, AWS eu-west-1)	Adequacy / SCCs as applicable
Google Cloud (Gemini API)	AI inference	Anonymized aquarium data (no PII)	EU/US (Google Cloud regions)	EU–US Data Privacy Framework; SCCs
RevenueCat Inc.	Subscription entitlement management	Anonymous app user ID, subscription status	US	EU–US Data Privacy Framework; SCCs

We require all sub-processors to maintain appropriate technical and organizational security measures in accordance with GDPR Art. 28 and Art. 32.

4. Third-Party Service Providers

We share your information only with trusted third parties essential for operating the App. See the Sub-Processors table in Section 3 for a full list. Key details:

• Supabase: Acts as our backend database and authentication provider. They securely store your account details, passwords (hashed), and aquarium telemetry.
• RevenueCat: Manages our in-app purchases and subscriptions. When you make a purchase, RevenueCat receives anonymous app user IDs to validate subscription status. Payment processing is handled entirely by Apple or Google; we do not collect or store credit card information.
• Google Cloud (Gemini): Processes anonymized aquarium data for AI features as described in Section 3.

5. Data Retention and Deletion

We retain your personal data only as long as necessary for the purposes described in Section 2, or as required by law.

• Active account data: Retained for the duration of your account.
• Usage and rate-limit logs: Retained for the current calendar month plus one rolling month, then automatically purged.
• Flagged AI responses: Retained for up to 12 months for AI quality monitoring, then deleted.
• Backup copies: Supabase automated backups are retained for up to 7 days and are automatically overwritten.

Account Deletion Process

You may delete your account at any time directly within the App:

1. Navigate to Settings > Account Details > Delete Account.
2. Confirm deletion when prompted.

What happens after you request deletion:

• Immediately: Your account is deactivated. Your data becomes inaccessible and is excluded from all active queries via Row-Level Security policies.
• 30-day grace period: You may restore your account during this window by logging back in and selecting "Restore Account."
• After 30 days: An automated nightly process permanently and irreversibly deletes your account and all associated data (aquarium records, logs, livestock, equipment, AI interaction history) from all active databases, including the Supabase Auth record.

6. Your Data Protection Rights

For All Users

You may exercise the following rights by contacting us at [email protected]. We will respond within 30 days (or within the legally required timeframe for your jurisdiction).

• Right to Access (Art. 15 GDPR): Request a copy of all personal data we hold about you.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate personal data.
• Right to Erasure (Art. 17 GDPR): Request deletion of your personal data (also available directly in-app).
• Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format. (Note: You can export your aquarium data locally via the App's backup feature.)
• Right to Object (Art. 21 GDPR): Object to processing based on legitimate interest. If you object, we will cease processing unless we demonstrate compelling legitimate grounds.
• Right to Restrict Processing (Art. 18 GDPR): Request that we limit how we use your data while a complaint is resolved.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with your local supervisory authority.

Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, the following additional disclosures apply:

• Categories of Personal Information Collected: Identifiers (email, name); internet or electronic network activity information (app usage data); aquarium hobbyist data.
• Sale or Sharing of Personal Information: We do not sell or share your personal information as defined by the CCPA/CPRA. We have not sold or shared personal information in the preceding 12 months.
• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected.
• Right to Delete: You may request deletion of your personal information (available in-app or via email).
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To submit a verifiable consumer request, email [email protected] with the subject line "CCPA Request."

Additional Rights for CalOPPA Compliance

• We honor Do Not Track (DNT) browser signals. The App does not track users across third-party websites.
• We will notify users of material Privacy Policy changes via in-app notification.

7. Children's Privacy

Our App is not intended for children under the age of 13 (or 16 in certain EU jurisdictions). We do not knowingly collect personal information from children. If we discover that a child has provided us with personal information, we will delete it immediately.

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy within the App. Your continued use of the App after the effective date constitutes your acceptance of the revised policy.

9. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at: