Privacy Policy

1. Data We Collect

• Account Information: your name, email address, and password (stored only as a secure hash), plus an optional bio.
• Location Data: GPS coordinates when you log a catch or check conditions with location permission on, and the spots you save. You can log catches without a location.
• Voice Recordings: the audio of voice recaps you record, its transcript, and the catch details and journal entry drafted from it.
• Catch Data: species, size, weight, photos, flies and lures, notes, times, and the weather and water conditions recorded with each catch.
• Trip Reports: reports you have the app write for a fishing day, kept so you see the same report when you come back.
• Subscription Data: your subscription status and a Stripe customer reference. We never see or store your full card number.
• Technical Data: error reports and performance data from your browser (see Sentry below), and basic request logs on our servers.
• Usage Analytics: which pages of the app you visit and a short list of actions (such as signing up, starting a recording, saving a catch, or starting checkout), along with your browser, device type, approximate location derived from your IP address, and the site that referred you. Page addresses are recorded without their query strings, and record IDs in them are replaced, so links like password resets are never collected. We don’t send your name, email address, or catch details to analytics.

2. How We Use Your Data

• Your Fishing Log: to store and show your catches, spots, photos, recaps, statistics, streaks, achievements, and personal records.
• Voice Recaps and Trip Reports: to transcribe recordings and draft catch details, journal entries, and trip reports with the AI services listed below. You review every draft before it’s saved.
• Conditions: to look up weather and stream-flow data for your catches and the places you fish.
• Social Features: to show your profile, catches, and leaderboard standing to other anglers, only as your privacy settings allow.
• Your Account: to sign you in, verify your email, reset your password, and manage your subscription.
• Improving the App: to see, in aggregate, which features get used and where people get stuck, using the analytics described below.
• Keeping the App Working: to find and fix errors and keep the service secure.

3. Who Can See Your Data

New accounts start private. In your privacy settings you choose whether your profile is public, whether your catches appear to other anglers, whether you appear on leaderboards, and whether a general region (never exact coordinates) is shown with shared catches. Spots are private unless you make them public.

4. Data Storage & Security

• Where: your data is stored on Amazon Web Services in the United States, encrypted in transit and at rest.
• Account Security: passwords are stored as secure hashes, and you stay signed in with signed, expiring tokens. Resetting your password signs out every session.
• Retention: catches, photos, voice recordings, and trip reports are kept until you delete them or your account. Voice recordings stay attached to their catch so you can play them back, and we keep each recording’s text transcript in encrypted storage so we never have to send the audio out again. Processing records for a voice recap expire after 24 hours.
• Guide trips and clients: optional trip records include clients' names, addresses, phone numbers, fishing license numbers and license-check confirmations. These stay private to the guide account and are not sent to AI services. Client catches stay off public profiles and feeds. Guide records have no automatic expiry and are kept for at least five years under NH Fis 1303.01. You can export a private CSV or print/PDF, erase an individual client's personal details, or delete your account. Erasing those details or the account also erases the retained guide record information, so export any legally required records first. An in-app reminder flags incomplete records after a trip and marks them overdue after ten days.
• Usage Records: for billing and cost accounting we log each AI request your account makes: which feature, which model, how much it used, and what it cost. These records never contain your recordings, transcripts, or catch details, and we keep them after you delete your account.
• Backups: deleted data can remain in our backups and versioned file storage for up to 90 days before it’s permanently removed.
• On Your Device: the app keeps your sign-in tokens, a copy of your profile, and catches you logged offline in your browser’s storage so it works without signal. Signing out removes your sign-in data from the device.

5. Third-Party Services

These services receive only what they need for the job described, under their own privacy policies:

• OpenAI: Transcribes your voice recaps. The audio recording is sent to OpenAI’s speech-to-text service. (privacy policy)
• Anthropic (Claude): Reads your transcripts to draft catch details and a short journal entry, and writes trip reports. For a trip report it receives that day’s catch details (species, sizes, times, flies, water and spot names, conditions, notes, and voice-recap text). When photo identification is enabled for your account and you submit a photo for analysis, Anthropic receives the JPEG image contents and available coarse region/month context. We strip embedded metadata before this upload and do not include structured GPS coordinates in these AI requests. Stripping metadata does not hide visible image contents: people, landmarks, signs or location text in the photo can still identify a person or place. (privacy policy)
• OpenWeatherMap: Receives the coordinates of a catch, or of the place you check conditions for, to look up the weather there.
• U.S. Geological Survey (USGS): Receives coordinates to find nearby stream gauges and their flow and water-temperature readings.
• Google Maps: Shows maps in your browser and turns place names into map locations. Your browser sends the map area you view and those place names to Google. (privacy policy)
• Stripe: Handles subscription checkout and billing. Your card details go directly to Stripe; we keep only a Stripe customer reference and your subscription status. (privacy policy)
• Amazon Web Services (AWS): Hosts the app and stores your data (databases, photos, audio), and sends account emails such as verification and password resets. (privacy policy)
• Google Analytics: Measures how the app is used (see Usage Analytics above), only if you accept analytics cookies. It then sets cookies in your browser to recognize returning visits. Until you accept, it isn’t loaded at all. Google signals and ad personalization are turned off, and we don’t use it for advertising. You can change your choice under Cookie Settings below. (privacy policy)
• Umami: Privacy-focused analytics on a self-hosted analytics server we operate. It records the same page visits and actions without cookies, and respects your browser’s Do Not Track setting.
• Sentry: Error and performance monitoring, so we can find and fix crashes. Session replays are recorded with all text masked and all images and media blocked. (privacy policy)

6. Cookie Settings

These static learning pages load no analytics cookies. Open the app’s cookie settings to inspect or change your choice for the app.

7. Your Rights

• Access Your Data: everything you log is visible to you in the app.
• Export Your Data: download catch rows as CSV or selected catch, spot, achievement and basic profile fields as JSON from your profile. These are partial exports, not a complete account archive. They omit trip/roster relationships, full attribution and original audio/media files; photo URLs are references. There is no general account restore/import workflow. Read what your data export contains before relying on an export.
• Correct Your Data: edit your profile, catches, and spots at any time.
• Delete Your Data: delete individual catches and spots, or delete your whole account from your profile. Account deletion removes your catches, photos, recordings and their transcripts, spots, achievements, social connections, and trip reports. AI usage records are kept, as described under Retention.
• Control Sharing: change your privacy settings at any time.

For anything else, including GDPR and CCPA requests, contact us using the details below.

8. Contact

Questions about this policy or your data? Email us:

• Email: privacy@fishfish.fish