Privacy Policy

2.1 Account and sign-in

• Sign in with Apple or Google identifier: a stable identifier supplied by Apple or Google. We never see your Apple ID or Google password.
• Email address: your real email, Apple private relay address, Google account email, or email-code sign-in address. We use it for sign-in, receipts, legal notices, and support.

2.2 Entries, catches, and photos

• Entry data: entry name, notes, species tags, tide-station assignment, public/private flag, listing state, and the GPS coordinates of the pin.
• Catch logs: species, length, weight, date/time, conditions, and notes you choose to save.
• Photos: uploaded photos are stored as compressed image files with EXIF metadata stripped, including embedded GPS, camera serials, device fingerprints, and original timestamps.

2.3 Location and tracks

Fishing Codex uses foreground-only location permission when you choose to save an entry or use map/location features. If you record a track, its GPS breadcrumbs are stored on your device and backed up to your own account so they come back on a new phone. A track is visible only to you: it is never shown to other users, never placed on any public map, and it is deleted with your account.

2.4 Marketplace purchases, claims, and entitlements

When you buy, subscribe, purchase lifetime access, or claim a free listing, we store the entitlement needed to unlock that access in your Fishing Codex account. For web payments, Stripe sends us transaction identifiers, charge status, amount, currency, product, and fee information. FCL does not receive your full card number or payment credentials.

When you claim a free listing or join through someone’s invite, the app also sends an app-made device identifier — a random ID the app creates and keeps on your phone; it is not a hardware ID or an advertising ID. We use it only to keep free claims fair per device and to stop invite rewards being abused.

2.5 Angler and payout data

If you become a paid angler, Stripe collects identity, tax, business, and bank details directly through Stripe hosted onboarding. We receive your Stripe connected-account identifier, account status, payout-readiness state, and payout/order summaries needed to operate the marketplace.

2.6 Diagnostics and support

Crash reports may include app version, build, OS version, device model, account ID, coarse region, and stack trace. Sentry Session Replay is disabled. Crash events do not include entry notes, exact GPS coordinates, photos, or catch free-text content.

2.7 Cookies, local storage, and preferences

The web app uses necessary authentication cookies, security/session cookies from Supabase, Stripe checkout/session records during payment flows, and local device storage for preferences such as appearance, text size, high-visibility mode, language, and currency display. We do not use advertising cookies, third-party tracking pixels, behavioural ad profiles, or cross-site ad retargeting. If we add non-essential analytics or marketing cookies later, we will add a consent control where required before enabling them.

2.8 Product usage

We record a small number of first-party usage events tied to your account — for example which screens are opened, and whether a catch entry or an import was completed — under our legitimate interest in understanding how Fishing Codex is used and improving it. These events contain no device identifier, no IP address, no location and no text you type. We use no third-party analytics tool, and we never sell or share this data. Raw events are kept for up to 14 days; after that only anonymous daily totals remain, which contain no personal information. You can object to this at any time by turning off “Usage data” in Settings, and we will stop recording usage events for your account. Raw events tied to your account are deleted when you delete your account. You also have the right to complain to your local privacy regulator.

8.1 Data export

Data export is for permanently-owned data: your account record, entries and catches you created, photo metadata for your own content, and permanent access records where applicable. It does not export angler-owned subscription entries or free-claimed entries. Temporary access remains governed by the subscription or claim entitlement.

8.2 Account deletion

You can request full account deletion from native app settings (Me → Settings → Danger Zone → Delete account), from web account settings at fishingcodex.com/account/settings, or by contacting support. The self-serve deletion flows are intended to satisfy Apple App Store Review Guideline 5.1.1(v): they delete the account itself, not just deactivate it. Cloud account data, user-created entries, catches, uploaded photos, claims, purchases, and entitlements are deleted or anonymised, except for limited records we must retain for law, tax, fraud prevention, chargeback handling, or marketplace accounting — except photo files that another user's paid purchase snapshot still depends on, which are retained for those buyers only.

Deletion is permanent. Before deleting, export any permanently-owned data you want to keep. See Delete Account for user-facing steps.

10.1 General privacy rights

You may have rights to access, correct, delete, object to, restrict, or port personal information under the laws that apply where you live, including the NZ Privacy Act 2020, Australian Privacy Act 1988, EU/UK GDPR, CCPA/CPRA, and other non-excludable local privacy rights.

10.2 EU/UK GDPR basics

Where EU or UK privacy law applies, our main legal bases are performance of contract for account, sync, purchase, subscription, and angler-marketplace services; legitimate interests for safety, fraud prevention, diagnostics, abuse prevention, and product security; legal obligation for tax, accounting, payout, chargeback, and lawful-request records; and consent where a feature specifically asks for it.

Depending on the context, you may request access, correction, erasure, restriction, portability, objection, withdrawal of consent, or review of a privacy concern. You may also complain to your local supervisory authority. We aim to respond to GDPR and UK GDPR requests within one month unless the law allows more time for a complex request.

10.3 California CCPA/CPRA basics

For California residents where the CCPA/CPRA applies, you may request to know the categories and specific pieces of personal information we collect, the sources and purposes for collection, the categories of third parties we disclose information to, correction of inaccurate personal information, deletion of personal information, and portability of information you provided. You may use an authorised agent where the law allows, subject to verification.

Fishing Codex does not sell personal information or share personal information for cross-context behavioural advertising. We do not discriminate against you for exercising privacy rights. We use precise location and payment-related information only to provide requested app, marketplace, security, fraud-prevention, legal, and accounting services, not for third-party advertising.

10.4 How to exercise rights

Use native app settings or web account settings at fishingcodex.com/account/settings where available, or email [email protected] with the subject “Privacy request”. We aim to respond within 20 working days for NZ privacy requests and within the time required by applicable local law.