Aqualizer DE

Privacy policy

Last updated: 1 October 2026

This policy covers the website aqualizer.app, the Aqualizer app for iOS and Android and the web app in your browser. Aqualizer is built local-first: your tanks, measurements and photos stay on your device. An account is optional. Data only reaches our server when you use a feature that needs it – which ones those are is listed below. The German version is authoritative.

Contents

Controller

EDV-Technik Dennis Weimer
Owner: Dennis Weimer
Franz-Rector-Straße 1
55411 Bingen am Rhein
Germany

Email: info@weimex.de

We are not required to appoint a data protection officer. Please send privacy questions to the email address above.

Website, hosting and server log files

The website, the web app and our server (api.aqualizer.app) are hosted by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, on servers in Germany, under a data processing agreement pursuant to Art. 28 GDPR.

With every visit to the website and every request from the app to our server, the web server automatically stores technical data: IP address, date and time, requested address, referrer, browser or app version and operating system. This is necessary to deliver the site and service and protect them from abuse (Art. 6 (1) (f) GDPR). Log files are deleted after 30 days at the latest. To prevent abuse we also limit the number of requests per IP address; for this we keep the IP address briefly in memory without storing it.

If you click a link to the App Store, TestFlight, Google Play or the Google group for the beta, you move to Apple or Google, whose privacy policies apply from then on. The website sends nothing to the store before you click.

Cookies and Google Analytics (website only, only with consent)

Fonts and images are served from our own server. Without your consent the website sets no cookies and loads nothing from third-party servers. Only your decision itself is stored (entry cmplz_statistics in your browser and as a cookie for aqualizer.app, 1 year) so we don’t ask on every visit (§ 25 (2) no. 2 TDDDG).

If you accept in the banner, we load Google Tag Manager and through it Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). This shows us which pages and calculators are used and how many visitors move on to the app. Collected are page views, clicks on app links, use of the calculators (without the values you enter), device and browser, approximate location (region) and the shortened IP address. Advertising features are switched off (Consent Mode: no advertising cookies, no personalised ads).

Cookies after consent: _ga (visitor ID) and _ga_* (session), up to 2 years each.

Legal basis is your consent (Art. 6 (1) (a) GDPR, § 25 (1) TDDDG). You can withdraw it at any time without giving reasons: at the bottom of every page under “Cookie settings” → “Decline”. The Google cookies are deleted.

Transfer to the USA: Google LLC may process data in the USA. Google is certified under the EU-US Data Privacy Framework (adequacy decision, Art. 45 GDPR); EU standard contractual clauses apply in addition. More from Google: policies.google.com/privacy.

The app and the web app under /app/ load neither Google Analytics nor any other analytics or advertising tools.

App without an account

Data on your device. The app stores tanks, measurements, care tasks, livestock, plants, log book, photos, AI results and settings only on your device (in the web app, in your browser’s storage). We have no access to it. The app scales photos down before saving them. If you delete the app or your browser data, this data is gone unless you created a backup.

Reminders are scheduled by the app as local notifications on your device. We send nothing through a push service, and there is no push token on our server.

Installation ID and credits. So that AI credits work without an account, the app creates a random identifier on first launch (no device or hardware characteristics) and keeps it in the device’s secure storage. Our server stores only an irreversible hash of it together with the credit balance. To prevent mass creation of installations we count per day how many come from the same IP address; for this we store only a keyed hash of the IP address that changes daily. Legal basis is Art. 6 (1) (b) GDPR (providing the credits) and (f) (preventing abuse).

Catalogue and templates. The app downloads species, plant and template data from our server. It sends no identifier, only the version of the data it already has.

Anonymous usage statistics

If “Anonymous usage statistics” is switched on in the settings (the default), the app reports without any identifier which tank types and sizes, which equipment (including freely entered device names such as the filter model) and which species are kept, how livestock changes and which compatibility warnings are overridden. Our server stores this only as totals, not as individual reports, and cannot link it to a device. We use the figures to improve the catalogue, the warnings and matching suggestions (Art. 6 (1) (f) GDPR). You can switch the statistics off in the settings at any time.

Independently of this, the app sends two things you trigger yourself: if you report “species missing”, we store the search term, and after three identical reports we have an AI service (see AI features) research it for a new catalogue entry. If you suggest a tank template, we store the suggestion. Neither is linked to you.

AI features

For AI features (for example the stocking advisor, overall analysis, algae, plant and cycling diagnosis, treatment assessment) the app sends the necessary information to our server, which forwards it to OpenAI (OpenAI, L.L.C., San Francisco, USA, as processor). Transmitted are tank type, dimensions and volume, tank age, equipment, measurements, livestock and plants from the catalogue, the app’s own assessment and – depending on the feature – your question or note (up to 500 characters) and the photo you take for it. Not transmitted are your tank name, your email address or any device or account identifier. Please do not put personal details into questions and notes.

We instruct OpenAI not to store requests (store: false) and not to use them for training. OpenAI may retain requests for a limited time to detect abuse. Our server stores neither your values nor the result; it only deducts the credits and counts anonymously how often each feature is used. The app stores the result on your device (and, if you use them, in backup and sync).

Legal basis is Art. 6 (1) (b) GDPR (you request the analysis). For the transfer to the USA see Recipients. AI answers can be wrong; the app checks them against its own assessment before showing them.

Account

An account is optional. If you create one, we store your email address, your password as an Argon2id hash (never in plain text), your language, when the account was created, confirmed and last signed in to, and your tap water values if you enter them. To confirm your email address and to reset your password we send you a link with a one-time code (valid for 7 days or 1 hour). You stay signed in through a session token of which we store only a hash; it expires 30 days after last use. Your credit balance moves from the device to the account when you sign in. Legal basis is Art. 6 (1) (b) GDPR.

Signing in with Apple or Google. Instead of an email and password you can sign in with your Apple or Google account. The provider then confirms your identity to us: we receive and store the identifier of your account with the provider (with Apple, one used only for Aqualizer) and, if you share it, your email address and whether the provider has confirmed it (with Apple, a relay address if you choose). We don’t ask for your name, profile picture or access to the provider’s other services. If an account with the same address, confirmed by the provider, already exists, we link the two. The provider handles the sign-in itself under its own responsibility; in the web app we load Apple’s or Google’s sign-in script only on the sign-in page. Legal basis is Art. 6 (1) (b) GDPR.

Account from the previous website. If you already had an account on the previous Aqualizer website, our new server takes it over from there (email, password hash, confirmation, language, tap water values, weekly summary setting and subscription status) so you can sign in to the app with the same credentials. If you delete your account on the website, we delete it here too. The app only fetches your tanks from the website when you start this in the app; our server only passes them through and does not store them. Legal basis is Art. 6 (1) (b) and (f) GDPR (continuing your existing contract).

Deleting your account. You can delete your account at any time in the app under Settings → Delete account. We then immediately delete the account, sessions, backups, sync data including photos and your credit balance. We cancel a running web subscription at the end of its term. We only have to keep purchase records (see Retention). You cancel a subscription through the App Store or Google Play there. If your account was taken over from the previous website, it remains there; please delete it there as well.

Backup, sync and web app

Backup to your account. If you switch on backup, we store your complete data from the app (tanks, measurements, tasks, log book, photos, AI results and settings, without the demo tank), transmitted encrypted, on our server. We keep the last three versions. You can delete the backup in the app at any time; otherwise we delete it with your account.

Backup file. If you save a backup file in the app, the app creates it on your device and hands it to the place you choose (e.g. iCloud Drive, Google Drive, email). We receive nothing of it. The respective provider is responsible for processing it there. The file is not encrypted.

Sync. With Pro the app continuously syncs your data with your other devices through our server. For this all tank data is stored entry by entry and photos as files in your account on the server. We remember deleted entries for 90 days so they also disappear on your other devices.

Web app. If you use the web app in your browser with an account, your tanks are kept in your account on the server even without Pro; the browser only caches them and clears this cache when you sign out. If the app on your phone takes over the state from the browser, we keep the previous state for 30 days so nothing is lost.

Backup and sync also contain your personal settings, including the secret keys with which you can later edit or withdraw shared tanks and submitted photos. We do not analyse the contents of backup and sync. The only exception is the weekly summary email (see Emails). Data from sync and the web app remains stored until you delete it in the app or delete your account, even if Pro ends. Legal basis is Art. 6 (1) (b) GDPR.

Purchases, subscriptions and cancellation

On the web you pay for Pro and credit packs through Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland). Stripe collects your payment data itself and under its own responsibility; we only receive your email address, a customer and subscription ID, amount, term and status. More: stripe.com/privacy.

In the app you buy through the App Store (Apple) or Google Play (Google), which process the payment under their own responsibility. We manage purchases through RevenueCat (RevenueCat, Inc., San Francisco, USA, as processor). RevenueCat receives a random purchase ID (not your installation ID), the store’s receipts and technical device data such as operating system and app version, but no tank data and no name. More: revenuecat.com/privacy.

Cancellation. The cancellation page records your notice with email address, name, contract reference and optional reason; we confirm it by email. We keep the notice as proof.

Legal basis is Art. 6 (1) (b) GDPR and, for keeping records, Art. 6 (1) (c) GDPR (§ 147 AO, § 257 HGB).

Sharing tanks and community photos

Sharing a tank. When you share a tank, we store a copy of the following on our server: tank type, water volume, dimensions, type of filter, CO₂ system and lighting, the animals and plants in the tank with their numbers and the month and year it was set up, and on request also the tank name and a photo. We remove all embedded metadata (for example location and camera data) from the photo before storing it. Anyone with the link can view the copy and, if you choose, other app users can see it as “Tank of the day”. We do not link the copy to your account and store no IP address with it; it can only be edited with a secret key kept in your app. Exception: public tanks you had shared on the previous website are shown with a reference to your account there until you take them over in the app. “Inspires me” is only counted as a number.

Legal basis is your consent (Art. 6 (1) (a) GDPR). You can withdraw it at any time with “Stop sharing”; the copy is then deleted immediately. If a link is neither viewed nor changed for twelve months, we delete it automatically. For this purpose we only store the date of the last view.

Submitting photos. We store photos you submit for a species or plant without any link to you and without embedded metadata. After review we show them in the species and plant view of the app, without your name. By submitting you confirm that you took the photo yourself and grant us a simple right, revocable at any time, to show it in the app (Art. 6 (1) (a) GDPR). You can withdraw a photo in the app at any time; it is then deleted. We delete rejected photos immediately and the entry for them after 30 days.

Reports. With “Report content” you can point us to illegal content. We store the reason, your optional description and the time, without an IP address, and receive an email about it. After processing we keep the report as proof of our review obligations (Art. 6 (1) (c) and (f) GDPR, Art. 16 DSA).

Feedback

If you send us feedback from the app, we transmit type, subject and message together with the screen you write from, platform, app version and language. We create an entry from it in our non-public project management system at GitHub (GitHub, Inc., San Francisco, USA, as processor). If you give an email address for follow-up questions, it does not go to GitHub but only to us by email. Feedback does not include tank data. Legal basis is Art. 6 (1) (f) GDPR (handling your request and improving the app).

Product suggestions

In some places the app suggests a matching product at Amazon (marked as an ad; can be switched off in the settings). If you tap it, the link leads through our server to Amazon. We only count which link was tapped when, without IP address and without identifier. From then on Amazon’s privacy policy applies; as a participant in the Amazon Associates programme we receive a commission on a purchase but do not learn who bought. Legal basis for the counting is Art. 6 (1) (f) GDPR.

Emails

We send emails from our own mailbox over an encrypted connection. Account emails are email confirmation (with reminders after 7 and 29 days), password reset, confirmation of a cancellation, notices about your subscription and the notice before we delete an unused account (Art. 6 (1) (b) GDPR). For this we remember when you last used your account (updated at most twice a day).

Weekly summary. With Pro and sync we send you a summary of upcoming care on Sundays. For this our server reads tank names and tasks from your sync data and only remembers when the last summary was sent. You can unsubscribe via the link in every email or in the app (Art. 6 (1) (b) GDPR, you can object at any time).

News and tips. Only if you tick the (not pre-selected) box when creating your account do we store this consent with a timestamp (Art. 6 (1) (a) GDPR). This includes at most one reminder if you haven’t used the app for two months. You can withdraw your consent at any time via the link in every such email or by emailing us.

Recipients and transfers to third countries

We do not sell data or pass it on for advertising. The only recipients are:

For transfers to recipients in the USA we rely on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on EU standard contractual clauses (Art. 46 (2) (c) GDPR). You can request a copy of the safeguards.

Retention

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7 (3)). Some of this you can do directly in the app: delete backup, stop sharing, withdraw photos, delete account. For anything else, such as a copy of your data, contact us.

Right to object: where we process data on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR). You can also switch off the anonymous usage statistics and product suggestions directly in the settings.

Contact us at the address above for any request. You also have the right to lodge a complaint with a data protection supervisory authority, for example the one responsible for us: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.

You are not obliged to provide us with data. Without an account the app works fully on your device; only features such as backup, sync, web purchases or AI analyses need the information listed for them. There is no automated decision-making pursuant to Art. 22 GDPR.

Changes

We update this policy when new features or service providers are added. We inform you of significant changes in the app or by email.