Privacy and cookie policy
1. General information
At PersonalAquarium.com we are committed to protecting your privacy and keeping your personal data secure. Below we explain how we handle the information we collect through our website.
This Privacy and Cookie Policy describes the data processing practices of PersonalAquarium.com.
By using our website, you accept the terms of this policy.
2. Personal data we process
You can browse the catalog without creating an account; what is measured during that visit is explained in section 3. If you create an account, upload images or save aquariums, we do process your personal data. This is the complete list: what is stored, what for, on what legal basis and for how long.
| Data | What for | Legal basis | How long it is kept |
|---|---|---|---|
| Account email address and password. | To create the account, sign you in and notify you of what happens in it. | Performance of the service you request (Art. 6(1)(b) GDPR). | For as long as the account exists. If you ask to delete it, the account is closed after 14 days (it can no longer be used and its content is no longer shown) and is destroyed along with everything in it six months after the request. If you never confirm your email address, it is deleted automatically after 48 hours. |
| Your aquariums, with their photos and notes, your favourites and your preferences. | This is the content you create, and what makes the site useful to you. | Performance of the service (Art. 6(1)(b) GDPR). | For as long as you keep it. It is destroyed along with the account, six months after you ask to delete it. |
| IP address, browser and date of each sign-up attempt, with a cryptographic hash of the email address rather than the address itself. | To detect automated sign-ups and avoid sending emails to inboxes that never asked for them. | Legitimate interest (Art. 6(1)(f) GDPR): protecting sign-up and not becoming a source of unsolicited email. | 90 days, after which it is deleted automatically. |
| IP address and date of every image you upload, together with the account it was uploaded from. | To be able to tell where an image came from: to handle a report about it, respond to a request from an authority and defend ourselves against a claim. | Legitimate interest (Art. 6(1)(f) GDPR). Explained just below. | For as long as the image exists. If it is removed by moderation, six more months, after which it is destroyed along with the image. |
About the IP address of images. It is the only thing that allows us to know who published a specific image at a specific time. If someone uploads an image of doubtful legality, that address and its date are what make it possible to handle a complaint or support legal action, which is why it is kept for as long as the image exists, unlike the IP address of sign-up attempts, which is deleted after 90 days.
When we remove an image through moderation we do not destroy it straight away: it stops being shown on the site immediately, but it is kept for six months together with that data. That is the period you have to challenge the removal, and it is also the time during which we might receive a request about it. Once that period has passed, the image and its data are destroyed automatically.
We do not sell your data. Apart from the analytics described in section 3, we do not share it with anyone; it only leaves here if a competent authority requires us to hand it over.
3. Use of cookies
We use necessary cookies, which are essential for the site to work properly, and analytics cookies (Google Analytics 4), which help us understand, in aggregate, how the website is used so we can improve it.
Google Analytics cookies are not loaded until you explicitly accept them in the consent banner. Until you do, Google Analytics does not run.
We also use cookieless audience measurement with Matomo, hosted on our own servers. It does not use cookies or store information on your device, and it processes data anonymously and in aggregate; that is why it works with or without your consent (see the legal basis). You can object at any time (see «Managing your preferences»).
| Cookie | Purpose | Duration | Provider | Category |
|---|---|---|---|---|
.AspNetCore.Culture |
Remember the selected language. | 1 year | PersonalAquarium (first-party) | Necessary |
.AspNetCore.Identity.Application |
Keep you signed in to private areas. | Session | PersonalAquarium (first-party) | Necessary |
pa_cookie_consent |
Store your cookie preferences and the date of your consent. | 12 months | PersonalAquarium (first-party) | Necessary |
| Theme preference | Remember the light or dark theme (browser local storage). | Persistent | PersonalAquarium (first-party) | Necessary |
_ga, _ga_* |
Aggregate usage measurement with Google Analytics 4. | Up to 2 years | Google Ireland Ltd. | Analytics (requires consent) |
For Google Analytics we use Google Consent Mode v2, so the default state is denied until you give your consent. Matomo's cookieless measurement is independent of this consent.
4. Legal basis for cookies and measurement
- Necessary cookies: based on the legitimate interest in providing a service the user has requested; they are technically essential and do not require consent.
- Analytics cookies (Google Analytics 4): based on your consent (Art. 6(1)(a) GDPR), which you can give, refuse or withdraw at any time without affecting how the site works.
- Cookieless audience measurement (Matomo): based on our legitimate interest (Art. 6(1)(f) GDPR) in measuring use of the site anonymously and in aggregate in order to improve it. As it neither uses cookies nor identifies users, its impact on privacy is minimal. You can exercise your right to object at any time using the opt-out mechanism described below.
5. Managing your preferences
Google Analytics (with consent): you can change or withdraw your consent at any time. If you refuse it, tracking stops and the related analytics cookies are deleted. You will be asked for consent again after 12 months.
Matomo (cookieless): you can object to audience measurement by enabling your browser's Do Not Track option, which we respect, or by using the following opt-out form: Opt me out of audience measurement.
You can also set your browser to block or delete cookies, although some features of the site may not work properly if you disable necessary cookies.
6. Your rights
You can ask us at any time to access your data, rectify it, erase it, object to processing based on our legitimate interest, restrict it or take it elsewhere. You can do much of this yourself from your profile, including deleting your account; for everything else, write to us at info@personalaquarium.com from your account's email address.
A limit worth knowing about. Asking to delete your account does not erase your data that same day: the account is closed after two weeks and everything is destroyed six months later. And even then, erasure does not reach the data of an image removed by moderation while its own period lasts. The GDPR allows for this (Art. 17(3)(e)): erasure does not sweep away what is needed to establish or defend a legal claim. Once those periods have passed, that data is destroyed too.
If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD).
7. Links to third-party sites
Our website may contain links to external websites. We are not responsible for the privacy practices or content of those sites. We recommend that you review the privacy policy of any website you visit.
8. Changes to this policy
We reserve the right to update this Privacy and Cookie Policy at any time. Any change will be published on this page, stating the date of the last update.
9. Contact
If you have any questions or concerns about this policy, you can contact us by email: info@personalaquarium.com
Last updated: 13 September 2026