Privacy Policy

1. Who we are

Fishare is operated by Fishare Oy ("Fishare", "we", "us", "our"), founded in 2011 by Olli-Mikael Vaittinen. Fishare Oy is responsible for the personal information described in this policy.

Fishare Oy
25/69 Pittwater Road, Manly, NSW 2095, Australia
Privacy contact: info@fishare.app

This policy covers the website at fishare.app, the Fishare mobile apps, our public content pages, the club and competition tools, and the Fishare connector for AI assistants (together, the "Service"). It sits alongside our Terms of Use.

2. What we collect

Account information

Your email address, display name, and — if you use a password — a securely hashed credential. If you sign in with Google, Apple or Facebook, we receive your name and email address from that provider. We never receive your password for those accounts.

Catches, sessions and spots

What you log: species, length or weight, date and time, the location you attach, gear and bait, notes and photos, plus the conditions we recorded for that place and time (tide, wind, swell, pressure, moon, water temperature). If you use trip tracking, the route you record.

Location

We use your device location only when you ask us to — to centre the map on you, to attach a location to a catch, or to record a trip. You can refuse the permission and still use Fishare by choosing places manually. We also use approximate location derived from your IP address to pick a sensible default region.

Photos

Photos you upload are resized and re-encoded on your device before they are sent to us. That process drops the file's EXIF metadata, including any GPS coordinates the camera embedded, so the copy we store carries none. Before the re-encode, the app may read the photo's EXIF date and GPS to offer you a date and location for the catch — which you can change or clear, and which is then stored as part of your catch under the visibility you choose.

Subscription and payment information

If you subscribe to Fishare Pro, we store your subscription status, plan, renewal date and the identifier our payment provider gives us. We never see or store your card number. Card details go directly to Stripe (or to the app store, for an in-app purchase).

Device and usage information

Standard web and app telemetry: IP address, browser and device type, operating system, pages and screens viewed, referring URL, and the marketing parameters that brought you to us. Which analytics services see this, and how, is in sections 6 and 7.

Communications

Emails you send us, support requests, and whether you opened or clicked our emails.

Club and competition data

If you join a club or enter a competition on Fishare, your entries — including photos and measurements submitted for judging — are visible to that club's administrators and, for public competitions, on the public leaderboard.

3. Why we use it — and our lawful basis

We apply the GDPR standard to everyone who uses Fishare, wherever you live. That means we do not process your personal data unless we have one of the lawful bases below, and it means the rights in section 12 are yours regardless of your country.

• To run the Service: your account, your logbook, your spots, your saved settings — performance of our contract with you
• To produce forecasts, bite scores and habitat scores for the places you care about — performance of our contract with you
• To show your catches to the people you have chosen to show them to — performance of our contract with you, acting on the sharing choice you made
• To run club competitions, leaderboards and season ladders — performance of our contract with you, for the competitions you enter
• To take payment for Fishare Pro and manage subscriptions — performance of our contract with you, and legal obligation for the tax and accounting records we must keep
• To send you service messages — performance of our contract with you. Newsletters and push notifications — your consent, which you can withdraw at any time
• To keep the Service safe: moderation, abuse and fraud prevention, rate limiting — our legitimate interests in running a service that is not abused, balanced against your rights
• To understand how the Service is used and to measure our marketing (section 7) — your consent, given through the cookie banner and withdrawable there
• To improve our models, using aggregated or de-identified data (section 9) — our legitimate interests in improving forecast accuracy. Once data is aggregated or de-identified it is no longer personal data
• To meet legal obligations — legal obligation

Where we rely on legitimate interests, you can object at any time (section 12) and we will stop unless we have compelling grounds that override your rights. Where we rely on consent, withdrawing it is as easy as giving it, and withdrawal does not affect processing we already carried out lawfully.

4. What is private, and what is public

This is the part most anglers care about, so it is stated plainly.

• Community catches: When a catch is shared with the community (you choose your default the first time, and can change any individual catch at any time), other users see your display name, the catch details (species, size, date, conditions, photo unless you hide it) and at most a coarse regional label such as "NSW coast". Spot names and your notes are visible only to friends you explicitly accept; the exact position of a catch is shared only with accepted friends and only when you turn that on for that catch. Any catch can be set fully private, and catches logged before this feature keep the setting they were saved with.
• Publishing to the public web is opt-in. A catch appears on a public catch page or in our public catches feed only if you set it to public. Those surfaces request publicly-shared catches only; a private catch is not served to them and is not indexed by search engines.
• We do not publish exact coordinates. On a public catch page, the coordinates you logged are used only to derive a broad regional label — "Sydney coast", "NSW coast", "US Gulf Coast" — and the coordinates themselves are never rendered.
• Entering a club competition makes your entry visible to that club. That is what a competition is, and it is a separate choice from making a catch public.
• We do not publish the location of protected or threatened species in the reference content we compile. This is enforced in our content pipeline, which refuses to ingest precise locations for protected marine species. It is a rule about our own published content — please use the same judgement about what you choose to share.
• Service providers: We use third-party services including Supabase (database and authentication), Vercel (hosting), and Anthropic (AI analysis). These providers process data on our behalf under their respective privacy policies.
• Legal requirements: We may disclose your information if required by law, regulation, or legal process.

You can delete a catch, or your whole account, at any time.

5. Fishing regulations and other reference content

Our regulations, species, spot, ramp and tackle-shop pages are published reference content, not personal information about you. They are informational and not legal advice — see section 11 of the Terms of Use.

6. Who processes your data

We do not sell your personal information. We do use third-party services to operate Fishare. This is the complete list, and what each one receives.

We also fetch weather, tide and ocean data from Open-Meteo, the Bureau of Meteorology, NOAA and Copernicus Marine. Those requests carry a place and a time, not your identity.

Beyond this list, we disclose personal information only where the law requires it, to enforce our Terms, to protect someone's safety, or as part of a business transfer — in which case this policy continues to apply until you are told otherwise.

7. Cookies, analytics and advertising

Our previous policy claimed we used no third-party tracking cookies and collected analytics server-side only. That was wrong, and this section replaces it with what actually happens.

On the website

• Google Analytics 4 (property G-YBGPGZ7D8Q) loads on our web pages from googletagmanager.com and sets first-party cookies to recognise a returning browser and measure pageviews and events.
• The Google Ads tag (AW-18161615386) loads in the same container on our app pages and measures conversions from our advertising — for example, that a sign-up followed an ad click.
• Vercel Web Analytics and Speed Insights record anonymous pageview and page-performance events. They do not set cookies and do not build a profile of you.
• Local storage holds your preferences (units, default location, theme) and your sign-in session. This is not tracking; clearing it signs you out and resets your preferences.

These tags load when you visit the website. We do not currently present a cookie consent banner. You can refuse or remove these cookies through your browser settings, by using your browser's tracking-protection or "Do Not Track"/Global Privacy Control setting where it is honoured, or by installing Google's Analytics opt-out browser add-on. Refusing them does not affect your ability to use Fishare.

In the iOS and Android apps

The native apps do not load any Google tag — no Analytics, no Ads, no cross-site tracking. This is enforced in code: the tag is skipped whenever the app is running inside the native shell. It is why our App Store privacy declaration states that we do not track you.

8. AI features — and how they differ from our own models

Two different things are often confused, so we separate them.

Fishare's own models

The bite score, the access score and the habitat heatmaps are produced by models we build and run ourselves, from oceanographic layers and fisheries datasets. Producing them does not send your personal information to any AI vendor.

AI-assisted features

Three features are assisted by third-party AI:

• The fishing guide — your question is embedded and ranked by Voyage AI to find relevant passages in our content, and answered by Anthropic's Claude using those passages.
• Fish identification — the photo you submit is embedded by Voyage AI to find visually similar reference images, and sent to Anthropic's Claude to name the species.
• Conditions analysis and written summaries — the conditions for a place and time are sent to Anthropic's Claude to be written up.

We send the question, photo or conditions needed to serve your request, and we do not attach your name or email address to it. Under our agreements with these providers, what we send is used to serve the request and not to train their models.

AI output can be wrong. Treat a species identification or a guide answer as a suggestion, not a fact — particularly before you keep a fish.

The Fishare connector for AI assistants

If you connect Fishare to an AI assistant, you authorise that assistant to call Fishare on your behalf. It can then reach the tools that connector exposes, using your entitlements. You can revoke that authorisation at any time, and what the assistant does with the results is governed by its own provider's privacy policy.

9. Aggregated and de-identified data

We use catch and condition records in aggregate to build and improve our forecast and habitat models. This work uses data that is aggregated or de-identified: it is not used to identify you, and we do not publish your exact fishing locations, in a model output or anywhere else.

10. Storage, security and retention

Your data is stored in our Supabase project, which runs on Amazon Web Services infrastructure. We use encryption in transit (TLS), database access policies, and standard authentication protections including PKCE for sign-in. No system is perfectly secure, and we cannot guarantee absolute security.

We keep your account data for as long as your account exists. When you delete your account, we delete your personal data, except where we must keep records to meet a legal or accounting obligation (for example, payment records) or in backups that expire on their normal cycle. Content you chose to make public may persist in third-party caches and search indexes that we do not control.

11. Where your data goes

Fishare is operated from Australia, and the services listed in section 6 are largely hosted in the United States and other countries. Using the Service therefore involves your information being transferred to and processed outside your own country, including countries whose data protection laws differ from your own.

Where we transfer personal data out of the European Economic Area or the UK, we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where the UK GDPR applies) in our agreements with the providers in section 6, together with an adequacy decision where one covers that provider. You can ask us for a copy of the safeguards that apply to a specific provider by writing to info@fishare.app.

12. Your choices and your rights

You can, at any time:

• Access the personal data we hold about you
• Correct anything inaccurate
• Delete your account and its data — in the app, or from our account deletion page
• Get a copy of your catch and session data in a portable format — email us and we will send it to you
• Control what is public — you choose a catch's visibility when you log it, and you can delete any catch
• Opt out of newsletters (every email has an unsubscribe link) and of push notifications (in your device or app settings)
• Refuse analytics and advertising cookies as described in section 7
• Withdraw consent to location access, camera access and notifications, in your device settings

We give every user the full set of GDPR rights, wherever you live — we do not make them conditional on your country. In addition to the controls above you have the right to: access your data; have inaccurate data rectified; have your data erased; restrict our processing while a dispute is resolved; port your data to another service in a machine-readable format; object to processing we base on legitimate interests, including any profiling; and withdraw consent at any time where consent is the basis. You are never subject to a decision with legal or similarly significant effects made solely by automated means — our forecasts are information, not decisions about you.

We do not charge for these requests and we answer within 30 days (one month). If you think we have got something wrong, tell us first at info@fishare.app — and you also have the right to lodge a complaint with a supervisory authority: in the EU, the data protection authority of the country where you live, work, or where the issue arose; in the UK, the Information Commissioner’s Office; in Australia, the Office of the Australian Information Commissioner.

To exercise any of these rights, write to info@fishare.app.

13. Children

Fishare is not intended for children under 13, and we do not knowingly collect personal information from them. Junior anglers do take part in club competitions run on Fishare; where a club enters a junior, the club and the junior's parent or guardian are responsible for that consent, and clubs can use alias display names for juniors. If you believe a child has given us personal data, contact us and we will delete it.

14. Links to other sites

The Service links to third-party websites — fisheries authorities, tackle shops, charter operators, weather bureaus. We are not responsible for their privacy practices.

15. Changes to this policy

We may update this policy. We will post the new version here and update the "Last updated" date, and for changes that materially affect your rights we will tell you by email or in the app before they take effect.

Change log. July 31, 2026 — corrected the false claims that we used no third-party tracking cookies and collected analytics server-side only; named every processor and what it receives (section 6); described analytics and advertising accurately, including the absence of a consent banner (section 7); separated Anthropic-assisted features from Fishare's own models (section 8); identified Fishare Oy as the operator (section 1); added a plain statement of what is private and what is public (section 4), and sections on aggregated data, retention and the AI connector. The previous policy offered a self-serve data export; because there is no such feature today, section 12 now offers a copy of your data on request instead. April 17, 2026 — previous version.

16. Contact us

Questions, requests or complaints about privacy:

Fishare Oy
25/69 Pittwater Road, Manly, NSW 2095, Australia
Email: info@fishare.app
Website: fishare.app