This page explains, in plain English, what FishTank Live stores about you and why. We keep it to the minimum the site needs, in line with UK GDPR and the Data Protection Act 2018.
What we store
Account: your email address, the display name you chose, a hashed password, and when you verified your email. Your display name appears next to your fish on the site and the stream; your email never does.
Fish and activity: the fish you add (name, species, colour, message), the credits you buy and spend, feature requests and commands. Activity lines ("Ann fed Bubbles") are shown in the public feed for a while.
Sign-up address: a one-way hash of the IP address you registered from, used only to stop welcome credits being farmed. The address itself is not stored.
Visits: a hash of your IP address kept for 35 days, used for the "people online" and visitor counts and to stop abuse. Recent visitors' city and country are looked up from the IP address through ipapi (see below) so the stream can show a "watching from" line; only the city and country are kept, never the address.
Payments: Stripe handles your card and sends us a payment reference and the amount. We never see your card number.
Reports: if you report a fish we keep the report text and which account or visitor sent it, so we can follow up and spot misuse.
Cookies
A session cookie that keeps you logged in and protects forms against forgery.
fishy_vid, a random visitor id (one year) so the site can remember a guest's fish and count visitors without an account. It contains nothing about you.
A small note in your browser's local storage that you have dismissed the cookie bar. No advertising or tracking cookies, and no third-party analytics.
Who else sees data
Stripe (payments), ipapi (city lookup from IP address, only the address is sent), and the hosting provider the site runs on. Email is sent through the mail service configured for the site.
Anything you put on a fish or in a shout is public: it appears on the site, on the live stream (TikTok, YouTube) and may end up in clips we post.
We do not sell data and do not share it with advertisers.
How long, and your rights
Account data is kept while the account exists. Visit hashes are deleted after 35 days; feed lines and old reports are pruned regularly.
You can ask us to show you, correct or delete the data we hold about you, or to close your account. Deleting an account removes your email and name; fish you added may stay in the tank with the owner shown as "Guest".
You can complain to the Information Commissioner's Office (ico.org.uk) if you think we have handled your data badly, though we would rather you told us first.
Children
The site is for people aged 13 and over. We do not knowingly keep accounts for younger children; if you think a child under 13 has one, please contact us and we will remove it.