Privacy

Effective and last updated September 15, 2026

What we store and why

Fish. The cut-out fish as a JPEG image, which of our fish it is, and when it was added. We use these to show the fish in its aquarium.

Aquariums. The aquarium's random link code, when it was made, the chosen backdrop, and any name you give it. A name can be up to 40 characters, and everyone with the link can see it — please choose one that does not identify a child or your family. We do not accept email addresses, phone numbers or web links in a name.

Accounts. If you sign in with Google, your Google account identifier, email address and name; which plan the account is on; when it was created and last signed in; and which aquariums it owns. We use these to recognize your account and connect it to your aquariums and purchases.

Purchases. The plan, amount, currency, date, Stripe's reference for the payment, whether it was refunded, and the date and version of the Terms you agreed to when buying — linked to the account that bought it. We use this to provide the plan and to handle payment questions and refunds.

Daily counts. One number per day for each of these: the front page opened, an aquarium made, a first fish added, an aquarium connected to a TV, a limit reached, the plans page opened, a payment, a refund, and whether a photographed sheet was read — and for a failure, which kind. These totals carry no image, IP address, cookie, account or aquarium identifier. We keep them for 60 days.

Messages to us. If you email us, we receive your email address and whatever you write or attach. We use it to answer you. Please do not send passwords, card numbers, or photos or details that identify a child.

Security information. We keep no website access log, and our application does not record visits or IP addresses. To stop people guessing the short TV codes, our server holds IP addresses briefly in memory only (see how long below). The server's login, firewall and error records can contain IP addresses; we use them for security and troubleshooting, never for advertising.

Photos and children's privacy

Charmreef is made for an adult to operate. A child can color on paper, or color a fish on the screen with a finger, with an adult nearby. Adults handle the website, the photographs, aquarium names, sign-in and purchases. There are no child accounts, no profiles and no chat.

A fish colored on the screen is drawn in the browser and sent as a picture, exactly like a photographed one. Nothing about who drew it is collected.

When you photograph a sheet, your phone's browser straightens it, adjusts its colors and cuts out the fish. In this process the original photograph is not sent to us; only the resulting fish image is. Before it is sent, the phone shows you exactly that image.

The browser makes a brand-new JPEG from the fish's pixels, so it carries no location, camera or date information from the original photo. That does not remove anything drawn or written inside the fish itself. An aquarium name or a fish image can contain personal information if it includes a name, a face, contact details or other identifying details — please leave those out.

If you believe a child's personal information has reached us, or you want identifying details removed, email hello@charmreef.com with the aquarium's link and which fish it is. Please send the link rather than another copy of the image. We will review it promptly and remove information that should not be there.

Aquarium links and TV codes

An aquarium has no password. Anyone who has its link can see its fish and name and add fish. If an aquarium belongs to a signed-in account, only that account can rename it, change its backdrop, remove fish or delete it; other people can remove only fish they added themselves, from the same browser. If no account has claimed an aquarium, anyone with its link can do all of these things, including deleting it. People you give the link to can forward it or take pictures of what they see, so share it only with people you trust.

When a fish is added, the browser that added it keeps a random code that lets it remove that fish later. We store only a scrambled (hashed) form of the code, and it is not linked to a person.

We do not publish a list of aquariums, and we ask search engines not to index them. That does not guarantee a link stays private.

The short code shown on a TV is different from the aquarium's link. It connects that TV to an aquarium, lasts at most five minutes, and exists only in our server's memory.

Who processes information

We do not sell personal information or share it for advertising.

• Aquarium viewers. Anyone with an aquarium's link, as described above.
• Hosting and backups. DigitalOcean runs our server in New York, United States, and keeps backups of it. We also keep a private backup copy on the company owner's computer in California, United States. These copies let us run and restore the service.
• Google. If you choose to sign in with Google, Google's sign-in service handles that step. Its script loads only when you press Sign in with Google. See Google's privacy policy.
• Payments. Stripe processes payments on its own checkout page. We never receive your card number. Stripe, and any wallet or Link account you choose to use, handle payment and device information under their own policies and may keep payment details according to your settings with them. See Stripe's privacy policy.
• Email. Messages to hello@charmreef.com are forwarded to a Gmail inbox the company owner uses to answer them, so Google processes those messages as our email provider — whether or not you ever signed in.

We may disclose information when the law requires it, such as in response to valid legal process, and only as much as is required. We may also use or disclose limited information when needed to investigate abuse, protect someone's safety, or resolve a payment dispute.

Sign-in and your browser

You can use the free aquarium without signing in. Buying a plan requires signing in with Google, because a plan belongs to an account. Signing in also lets you find your aquariums and your plan on another device. We never see or store a Google password.

Signing in sets one cookie that keeps you signed in for up to 365 days. Signing out removes it from that browser; it does not delete your account or your aquariums.

Your browser also keeps a list of your aquariums on your device. Clearing your browser data removes that list from the device; it does not delete the aquariums from our server.

Tracking

We do not track your activity across other websites, and we load no advertising or third-party analytics tools. Our daily counts are anonymous totals kept separately from account and purchase records. Because we do no cross-site tracking, there is nothing for a browser's Do Not Track signal to switch off. Google sign-in and Stripe checkout are separate services; when you choose to use them, those companies may collect information as described in their own privacy policies.

Keeping and deleting information

• Aquariums and fish stay until they are deleted. Deleting an aquarium removes it and all its fish from our active server immediately. A refund deletes nothing. We do not currently delete aquariums for being unused; if that ever changes, we will give notice first.
• Backups. DigitalOcean's backups are kept for 14 days. Each private backup copy is deleted within 30 days of being made. Deleted information can remain in those backups until they expire.
• Accounts. Email us to delete an account. We will confirm the request comes from you and explain, before deleting, what happens to its aquariums and any paid plan.
• Purchase records are kept for accounting and tax purposes for seven years after the tax year they belong to, limited to what those purposes need. While a plan is active we also keep what is needed to honor it.
• Messages to us are deleted from the inbox we use within 90 days after the matter is closed, and photos or identifying attachments sooner, normally within seven days after the problem is solved. Google's own systems may keep residual copies under its policy.
• Security records. Server login, firewall and error logs stay on the active server for no more than 30 days. The IP addresses held in memory to stop code guessing are removed 15 minutes after the last wrong guess, and always within 24 hours.
• Daily counts expire after 60 days. Because they do not identify anyone, there is no individual entry in them to remove.
• A specific dispute, incident or legal obligation can require keeping the related records longer. When that happens we keep only those records, only for as long as needed.

Your choices

You can ask what personal information we hold about you, ask for a copy, ask us to correct it, or ask us to delete it: email hello@charmreef.com, from the email address on your account if you can. We may ask for a little information to confirm the request is yours. You can download an aquarium's fish images, or delete the aquarium, yourself at any time from the three dots next to it on the home page. We will never treat you differently for making a privacy request.

If you are in California

We do not sell personal information and do not share it for advertising. The requests described under “Your choices” are open to you, and we will tell you if we cannot honor one and why.

Security

Everything travels over HTTPS, and our server accepts no passwords — access is by cryptographic key only. No system on the internet is perfectly safe; that is one more reason we keep as little as we do.

Changes to this policy

The date at the top shows when this policy took effect. We will explain important changes on the site before they take effect, and email account holders about them — including changes to what we collect, how we use it, who receives it, or how long we keep it. Where your permission is needed, we will ask before applying the new practice.

Who we are

Charmreef is run by GNR PRODUCTION INC, 5430 Corteen Pl, Valley Village, CA 91607, United States, which is responsible for the information described here.

Contact

hello@charmreef.com — a real person reads it.