Privacy Policy

Fishingstat is operated by ROLAND BICOK PR AGENCIJA ZA VEB PORTALE BROLI SUBOTICA, a sole proprietorship registered at Lajoša Joa 61, 24000 Subotica, Serbia (tax number PIB 112265820, registration number MB 65988852). It is built and run by Roland Bicok and Aleksandar Langer (about us). We decide how your data is used, which makes us the “controller” in data protection law. For anything in this policy, write to privacy@fishingstat.com.

When you create an account and use Fishingstat, we collect:

• Account information: your email address and name and, if you add them, a profile photo and your country, region and city. If you sign in with Google, we receive your name, email address and profile picture from Google.
• Location: GPS coordinates when you start a fishing session, log a catch or fetch local weather. Location is optional; you can enter a location name manually.
• Catch photos: photos you choose to attach to catch records.
• Fishing activity: sessions, catches, gear items, notes, and measurements you log in the app.
• Subscription status: which plan you are on, whether it is monthly or yearly, and when it renews or ends. We never see or store your card details.
• Usage: when you sign in and by which method, on which days you used the app and for roughly how long, whether you use the website or the Android app, and whether you installed the app or finished the intro tour.
• Technical data: your IP address is used for short-lived counters that limit abuse, such as too many sign-up attempts, and these expire within hours. It also appears in server logs, described in the section on data retention. When you open the site, we also look up which country your IP address belongs to and whether it belongs to a known VPN service, and we can refuse connections from some countries and from VPNs. The lookup runs on our own server, using country data from DB-IP.
• Messages you send us: the name, email address and message you enter in the contact form.

We do not collect background location data. We do not collect location when the app is not in use.

• To provide the service you signed up for (contract): your log, stats, weather and place names for your sessions, account emails such as verification and password reset, and your subscription status.
• Because we have a legitimate interest in a service that is safe and works: preventing abuse and fake leaderboard entries, and understanding in aggregate how the app is used.
• To answer you (legitimate interest): a message sent through the contact form is used only to reply to it and to follow up on the same request.
• Because you consented: analytics cookies, appearing on leaderboards, a public profile, share cards, and your device’s location permission. You can withdraw each of these at any time, in Settings or on your device.

Fishing tips: a summary of your recent sessions (dates, location names, weather, species caught and bait), your overall stats and the question you type are sent to Anthropic’s Claude API to generate the answer.

Species recognition and catch verification: when you ask the app to recognise a fish or to verify a catch, the catch photo is sent to Anthropic together with the species and weight you entered. A fish name you type may also be sent so it can be matched to our species list.

Under its commercial terms, Anthropic does not use this data to train its models. Please do not upload catch photos that show other people who have not agreed to it.

• Leaderboards: off by default. If you turn them on in Settings, your name, profile photo, ranked catches and their country, region and water are visible to anyone, including people without an account.
• Public profile: off by default. If you turn it on, anyone who has your profile link can see your profile.
• Share cards: a share card you create can be opened by anyone who has its link.
• Photo files: photos are stored under long, random web addresses. They are not listed anywhere and cannot be guessed, but they are not password-protected: anyone who has the exact address of a photo can open it.

We use these services to run the app. Each receives only what it needs for its task:

• Railway: app hosting and database, on servers in the Netherlands. Railway Corporation is a US company and holds a SOC 2 Type II report.
• Cloudflare: storage and delivery of photos and share cards.
• Anthropic: the AI features described above.
• Resend: sending account emails (verification, password reset, welcome) and delivering contact-form messages to our support inbox.
• Google: sign-in with Google, if you use it; Google Analytics, only if you accept cookies; and Google Play billing, if you subscribe in the Android app.
• FastSpring: subscriptions bought on the website. FastSpring is our authorised reseller and the seller of that purchase: it takes the payment, issues the invoice and pays out any refund, and it handles your payment details under its own privacy policy.
• OpenStreetMap services (Nominatim, Photon, Overpass): coordinates or the place name you type are sent to find place names and nearby waters. Map tiles are loaded from OpenStreetMap by your device.
• Open-Meteo: coordinates are sent to fetch the weather.

Some of these providers are based in the United States or process data there. Where personal data leaves the European Economic Area or Serbia, it is covered by safeguards recognised in data protection law, such as the European Commission’s standard contractual clauses.

We do not sell your data to any third party, and we show no ads.

Some cookies are required for the app to work at all, and are set without asking: the cookie that keeps you signed in, the one that protects forms against cross-site request forgery, and the one that remembers which language you chose. We also store display preferences (theme, onboarding progress) in your browser’s local storage. None of these track you, and none are shared with anyone.

These are the cookies and how long each one lasts:

• next-auth.session-token: keeps you signed in. Up to 1 year.
• next-auth.csrf-token and next-auth.callback-url: protect the sign-in form and remember which page to return you to. Until you close the browser.
• fs_auth: a single flag that tells the public pages whether to show “Log in” or “Go to app”. It identifies nobody. 30 days.
• fishingstat.locale: the language you chose. 1 year.
• fishingstat.consent: your answer to the cookie question. 1 year.
• _ga and _ga_…: Google Analytics, only if you accept. Up to 2 years.

On signed-in pages we load FastSpring’s checkout script so that the upgrade window can open. FastSpring may set cookies of its own, which are described in its privacy policy.

Google Analytics is different. It stores an identifier in your browser that lets Google recognise it, so we ask first. It stays switched off unless you accept, and if you refuse it is never loaded with an identifier at all. You can change your mind at any time using the Cookie settings link at the bottom of any page. Analytics runs only on the public website, never inside the signed-in app.

We also count basic activity (sign-ins, sessions logged) in our own database. That happens on our servers, stores no IP address or device identifier, and is tied to your account rather than to your browser, so it needs no cookie and is not affected by the choice above.

Your data is kept until you delete it or delete your account. If you delete a catch, its photo is removed from storage too. Some things have their own period:

• Usage records (sign-in dates and method, the days you used the app and for roughly how long) and the monthly total of what your use of the AI features cost: kept while your account exists and deleted with it.
• AI questions and answers: not stored on our servers.
• Abuse counters tied to an IP address or an email address: expire within one hour.
• Links we email you: a password reset link works for 1 hour and a sign-up link for 24 hours. A sign-up that is never confirmed is deleted 7 days after its link expires.
• Messages sent through the contact form: kept in our support mailbox for as long as it takes to deal with the request.
• Server logs (the time and address of each request, the IP address it came from, errors and account identifiers): kept by our hosting provider for 90 days, then deleted automatically. We do not copy them anywhere else.

Payment and invoice records are kept by FastSpring or Google for as long as tax and accounting law requires of them. We cannot delete those for you.

You can delete your account and all associated data at any time from Settings → Delete Account in the app. See our account deletion page for step-by-step instructions.

Deletion removes your profile, sessions, catches, photos, gear, share cards and leaderboard entries straight away, and it cannot be undone. When you delete your account we cancel a subscription bought on the website for you; one bought through Google Play you must cancel yourself, as described in our terms. Each deletion sends us a short notice (your name, your email address and, if you had one, the subscription reference) so that a subscription which could not be cancelled automatically is cancelled by hand before its next charge. We delete the notice once that is done, or straight away when there was nothing to cancel.

Data protection law gives you rights over your data. You can:

• Get a copy of your data. Sessions and catches can be downloaded at any time under Settings → Export your data.
• Correct your data, in Settings or by writing to us.
• Have your data deleted.
• Object to how we use your data, or ask us to restrict it.
• Withdraw a consent you gave, at any time.
• Complain to the data protection authority of the country you live in.

To use any of these rights, write to the address at the top of this policy. We answer within one month.

All data is sent over HTTPS. Passwords are hashed with bcrypt and never stored in plain text. The database sits on storage that our hosting provider encrypts at rest. The links we email you for sign-up and password reset are stored only as hashes, and resetting your password signs you out on every other device.

Fishingstat is for people aged 16 and over, and we ask you to confirm this when you sign up. We do not knowingly collect data from anyone younger. If you think we have, contact us and we will delete it.

When we change this policy we update the date at the top. If a change affects how we use data we already hold about you, we will tell you by email or in the app before it takes effect.

Questions about this policy or your data: privacy@fishingstat.com