Koi Keeper privacy notice

Last updated November 11, 2026

Koi Keeper is made by Alfredo Burbano (“we”). For questions or requests about your information, email burbano4business@gmail.com.

Playing without an account

Your pond, your koi and their names, your garden and your settings are stored on your device, in the app or in your browser’s storage for the site. We don’t receive them. Deleting the app or clearing the site’s data removes them, and we can’t bring them back. If you send us feedback from Settings, we receive that note, as Feedback below describes.

If you play on our website, our host, Vercel, receives ordinary request information when your browser loads the game, such as your IP address and browser details. The iPhone and iPad app carries the game inside it, so playing without an account doesn’t contact our website.

If you make an account

Your age

Before you sign in, the game asks your age. Accounts are for ages 16 and up. We don’t keep the age you enter: your device only remembers that the check passed, for a short time, or that it didn’t, for a day.

Signing in

Clerk handles sign-in. It processes your email address and your sign-in and session records, which include your device type, your IP address and the approximate location that address suggests (a city, never a precise place). The game reads your Clerk user ID and email address to recognize your account and show that you’re signed in.

If you choose Google, Google shares your account identity, email address and basic profile, which can include your name and picture. We don’t ask for access to your Gmail, Drive, contacts or calendar.

If you choose Apple, Apple shares an identifier for your Apple Account and your email address, or a private relay address if you choose Hide My Email. It shares your name the first time you sign in, if you allow it. When we send you an email, such as a code to check it’s you, Apple’s relay passes it on.

Your saved pond

Supabase stores your pond and the identifiers that link it to your account, in a database in the United States. Your saved pond holds your progress, your koi and their names, your garden and your settings. We also keep version numbers, times and session records, so that your devices don’t overwrite each other’s progress.

On your device

Your device keeps your account’s email address and ID, a copy of your saved pond, changes not yet sent, and for up to a week up to two diagnostic copies of changes that couldn’t be saved; signing out removes all of it. In the iPhone and iPad app, your sign-in is kept in the device’s Keychain.

Cookies and checks

Clerk uses cookies and tokens to keep you signed in, and sign-in won’t work without them. If a sign-up on the website looks automated, Clerk may show a Cloudflare Turnstile check, which processes signals such as your IP address and browser details.

Friends

Friends needs an account.

Your username

The first time you open the Keeper tab while signed in, the game makes you a random username, like quiet.koi.1234. You can change it. Anyone with an account can find your username by searching for its first few letters, and can send you a friend request.

Requests and friends

Your friend requests and your friends list are stored with your account.

Visits

A friend you’ve accepted can visit your pond at any time. There’s no setting to turn this off, but removing or blocking a friend ends their access.

Blocking

If you block a player, you can’t find or visit each other and they can’t send you a request. Your list of blocked players is stored with your account, and you can unblock them.

When a friend visits, their device receives:

• your garden, your pond’s water and your pond’s upgrades
• each koi’s name and looks, its size, its bond with you, how long you’ve had it and where it came from
• each koi’s temperament, personality, favorite food, what you’ve learned about its meals and its latest appraisal
• which limited items you own, and each one’s number (see Limited items)

Their device doesn’t receive your gold, gin, XP, stats, stamps, Koi-Dex, logs, settings, Decor or your koi’s earlier appraisals.

A visit isn’t saved as a pond on their device, though the game can keep a few calculated details about a koi there so it doesn’t have to work them out again. Food a visitor tosses isn’t recorded and doesn’t change your pond.

Because this information reaches their device, someone who altered their copy of the game could read it, and could work out a koi’s hidden traits from it. Please don’t put anything private in a koi’s name.

Reports

If you report a player, we store both usernames and account IDs, the reason you chose and anything you wrote, up to 500 characters, so that we can look into it. The report is emailed to us, and we delete it from the game’s database after 30 days. The email stays in our mailbox.

Limits

We keep counts of how often each account saves its pond and uses Friends, for two days, to limit abuse.

Limited items

A few things in the game are given out by our server and kept with your account, so that they stay yours on every device and can’t be made by altering the game. The first is the Founders’ stone. They need an account.

If you claim or are given one, we store with your account which item it is, its number if it has one, when you got it, and a record of each time it was claimed, given, moved to another account or taken back. Where the item stands in your garden is part of your saved pond.

A friend who visits you receives which of these items you own and their numbers. Nobody else does.

We keep counts of how often each account asks about its items, for two days, to limit abuse.

Koi records

When you win over a wild koi on a pond with an account, our server keeps a record of that koi, so that it can be shown to be genuine and can’t be made by altering the game. Nothing in the game looks different because of it.

For this, your account is given a river number the first time it’s needed. The game uses it to decide which wild koi come to your pond, whether up the river by themselves or because bait, your pond’s beauty or a clean-up brought them. When you win one over, your device sends us which koi of your river it was and which version of the game’s koi rules it runs, and nothing about how the koi looks. Our server works the koi out for itself from your river number.

We store with your account your river number and, for each of these koi: which koi of your river it was and when it was there, its variety, form, special traits, pattern number and sizes, when it was recorded, and a record of each time it was recorded, released, given or taken back. We store the same for a koi we give you, with its name if it has one.

Koi that were already in ponds with accounts when these records began are recorded one time, from the pond saved to your account: for each koi, its variety, form, special traits, pattern number and sizes, the name you gave it, and how and when it joined your pond. At the same time we note the number your pond used before then to decide its wild koi, so that koi from that time can still be recorded. This happens once and is never repeated.

When one of these koi leaves your pond for good (you release it, it goes to an order, or it dies), your device tells us how it left, with its name, its size and your bond level with it at that moment. We keep those with its record, which then has no keeper. Nobody else receives these records.

Each time you throw a bait or a lure on a pond with an account, your device tells us which one and when. For a bait it also sends how far your pond has been dug, your stream’s level, the best beauty your pond has reached, the largest koi your level allows and how many koi the bait brings, because those decide which koi come. We keep a lure’s throw for about 90 days and a bait’s for about 180, so that the koi a bait brought can be recorded and so that we can spot cheating.

When you release a koi you have bonded with, the river later sends a wild koi to your pond. On a pond with an account, your device tells us that a koi is owed, with the same facts about your pond as for a bait, so that the koi can be recorded. It doesn’t say which koi you released. We keep that for about 180 days, as we do a bait’s throw.

We keep counts of how often each account records koi and tells us of throws, and of requests we turned down and why, for two days, to limit abuse and spot cheating.

We can send a message to your game, to you or to everyone signed in, such as a thank-you with a small gift. Your game asks us for these when it opens; nothing about you is sent to do so. If an account is found cheating, we can stop recording new koi and items for it.

Feedback

Settings has a Feedback button, with or without an account. If you send a note, Supabase stores what kind of note it is (feedback, an idea or a bug), your words, up to 1,000 characters, the game’s version, whether you’re on a phone, a tablet or a computer, and the time.

If you’re signed in, the note also carries your account’s sign-in ID, so we can tell whose it is. Without an account, your device sends a random ID it keeps for this alone, so that we can limit how many notes one device sends: we keep only a one-way scrambled form of it, for two days, and never with your note.

We delete a note from the game’s database 180 days after it was sent. Please don’t put anything private in a note.

Services we use

These companies process information to run their services, under their own privacy notices. We share only what each one needs, and we expect them to protect it as carefully as this notice describes. Their processing, such as logs and support, doesn’t always stay in the United States.

• Vercel hosts the website.
• Clerk handles sign-in.
• Supabase runs the account database and keeps the feedback you send.
• Google handles Google sign-in when you choose it. It also hosts our support email, sends us players’ reports, and holds the encrypted recovery copies described below in our own private Drive. Signing in with Google doesn’t give us access to your Drive.
• Cloudflare provides the sign-up check described above.
• Checkly tells us whether our services are running. It receives simple signals, not ponds or player details.
• Apple distributes the iPhone and iPad app, and handles Sign in with Apple when you choose it.

Deleting your information

Without an account

Delete the app, or clear the site’s data in your browser. Any save file you exported stays wherever you put it.

With an account

In the game, open Settings, then My Profile, then Delete account. Unless you signed in within the last few minutes, we email you a code to check it’s you first. Once our server accepts the request:

• your account is blocked
• your online pond and its session records are removed
• your username, your friend requests, your friends list and your blocked list are removed, and friends can no longer visit you
• your limited items are retired. A numbered item’s number is never given to anyone else.
• your koi records no longer have a keeper, the names you gave those koi are removed from them, your river number and your pond’s earlier number are no longer kept with your account, and the record of your bait and lure throws is deleted
• your sign-in profile at Clerk is deleted. An outage can delay this, and if you close the app first, it finishes later.

If you signed in with Apple, the iPhone and iPad app also asks Apple to remove Koi Keeper’s access to your Apple Account. If you delete from the website, or that doesn’t finish, you can remove it yourself.

You can choose to keep your pond on that device as a pond without an account. Deleting your Koi Keeper account doesn’t delete your Google or Apple account.

What can remain

• Recovery copies. We keep encrypted recovery copies of the account database, and these can hold earlier pond data after you delete your account. We haven’t set a fixed period for removing them yet.
• Security records. We keep limited records so that a deleted account can’t reopen its pond. Some of these don’t expire.
• Reports. A report you made, or one made about you, isn’t removed when the account is deleted. It’s deleted from the game’s database after 30 days, and the email about it stays in our mailbox.
• Limited items. The record that a retired item existed, with its number and when it was claimed, given or retired, stays. It no longer carries your username, and your sign-in is gone.
• Koi records. The record that a koi existed stays: what kind of koi it was, which koi of which river number it was, when it was recorded and when it left, and its size and bond level when it left. It no longer carries your username or the name you gave it, and your sign-in is gone.
• Feedback. A note you sent isn’t removed when the account is deleted. It’s deleted from the game’s database 180 days after it was sent.
• Other devices. We can’t reach copies stored on your other devices, or files you exported.
• Emails. Emails you sent us stay in our mailbox.

If you can’t sign in

Email burbano4business@gmail.com with the subject “Koi Keeper account deletion” and tell us how you signed in. We’ll need to confirm the account is yours before we act. An email address alone may not be enough. Please never send a password or sign-in code.

Children

Accounts are for ages 16 and up. The age check relies on what you tell us, and we don’t verify it. Without an account, nothing about your pond is sent to us. If you think someone under 16 has an account, email us and we’ll look into it and remove it.

Your requests

You can email us to ask what we hold about you, or to ask us to correct or delete it. We aim to reply within 30 days. We may need to confirm who you are first, so include only what we need to find your account.

Changes to this notice

If this notice changes, we’ll update it here and change the date at the top.