We're working on a new website – coming soon.
Fishfy
Contact

Privacy Policy for the App (iOS & Android)

As of: November 1, 2026

1. Overview

Fishfy is designed as a local-first app: your catches, spots, photos, and notes are primarily stored locally on your device (iPhone or Android). Data leaves your device only when you use a feature that explicitly requires it (for example weather retrieval, cloud sync, or “Spot Occupied”).

On Android, the system itself may also back up data if Android backup is active on your device: your catch list with the exact catch locations, the key for the exact catch locations, and your settings are then stored in your Google account. Photos and videos are not included. If you transfer your data directly to a new Android device, Android also brings your photos and videos. You control the backup in the Android settings.

In the app, we do not track you. Fishfy contains no analytics SDK, no advertising, and no cross-app tracking.

This policy applies to the Fishfy app on iOS and Android. It describes which data is processed when and for what purpose, who receives it, and what rights you have.

2. Controller

Controller within the meaning of the GDPR:

Apzura Hafenstraße 39 67346 Speyer Germany

Represented by: Falco Grimminger Email: support@fishfy.app

3. What Data We Process

Account data (when signing in):

  • Email address
  • Provider identifier (Apple, Google) and technical account ID
  • Self-chosen username (publicly visible during content transfer)
  • Language and time-zone code
  • Optional: recovery email

Your content:

  • Catch photos
  • Catch data (location, time, fish species, size, bait, notes, weather snapshot)
  • Spot data (position, notes, depth, season months, target fish)

Location data:

  • Current location when you use weather, water-level, route planning (shore or boat), or “Spot Occupied”
  • Locations of spots and catches you save

Device and diagnostic data (when push or cloud features are active):

  • Anonymous device identifier (iOS: vendorID; Android: ANDROID_ID, stored as vendorID; per app installation)
  • Push token (FCM; on iOS also Apple Push / APNs)
  • Coordinates of your selected spot
  • Device label (e.g. the name of your iPhone or Android device)
  • Active notification settings
  • Pro status

Biometrics (on your device only):

  • Face ID, Touch ID, fingerprint, face unlock, or your device passcode/PIN when you use Incognito
  • The check runs locally. Fishfy only receives yes or no, never biometric data. None of this is sent to us or to the cloud.

Payment data: On iOS, processed exclusively between you and Apple (App Store / StoreKit). On Android, exclusively between you and Google (Google Play Billing). We only receive the respective store’s confirmation of your Pro status.

4. Why We Process Your Data

Provide app features and manage your account: Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

IT security, abuse prevention, stability, 3-device limit: Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Pro features (cloud sync, push, content transfer, live occupancy display): Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Activate “Spot Occupied” (account required, also without Pro): Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Newsletter and voluntary data sharing: Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future.

Retrieve weather and water-level data at the selected location: Legal basis: performance of a contract.

5. Location Data and Features

You control location permission in your device’s system settings. There are two levels:

iOS:

  • While Using the App: location is accessed while Fishfy is active. During an active navigation session (shore or boat), location may also continue in the background (iOS shows this with the blue status indicator) until you end navigation. The position stays local on your device.
  • Always: location can also be used in the background, exclusively for “Spot Occupied”. Without this feature, “While Using” is sufficient.

Android (Settings → Apps → Fishfy → Permissions):

  • While using the app: equivalent to “While Using”. During an active navigation session, Android shows an ongoing location notification.
  • Always: equivalent to iOS. While “Spot Occupied” is active in Always mode, Android shows an ongoing notification. Without this feature, “While using” is sufficient.

How we use your location:

  • Weather and water level: when you view current values, coordinates are sent to Open-Meteo (weather) or our cloud functions (water level). We do not store a location history.
  • Catch and spot positions: stored locally. With cloud sync enabled, also stored in your personal area on Firebase.
  • Route planning (shore or boat): during an active navigation session, Fishfy follows your position locally along the waypoints you set. Nothing is sent to our servers.
  • “Spot Occupied”: see section 7.
  • Background weather refresh: Fishfy retrieves weather data for your selected spot at larger intervals to keep forecasts up to date. Your current location is not requested for this.

You can change or revoke the permission in iOS or Android settings at any time.

6. Cloud Features (Pro)

The following features are available only with a Pro subscription and require an account:

Cloud sync and backup: Your catches and spots are stored in your personal area on Firebase. Photos are kept in a private storage bucket. Only you have access (authentication via Firebase Auth).

Push notifications: Alerts about good bite activity, similar catches, free/occupied changes of watched spots, “Spot Occupied” conflicts, and catch and spot transfers (request, acceptance, decline, withdrawal). Activity and similar-catch calculations run server-side based on Open-Meteo. For this we store on Firebase: your push token, your notification settings, the coordinates of your selected spot, watched spots, and watched catches.

Content transfer: You can transfer your own catches or spots to another Fishfy user. Recipients are identified by username. Content is temporarily placed in a transfer area; once received or expired, it is automatically deleted.

3-device limit: A maximum of three devices can be active per account at the same time. Devices inactive for 60 days are automatically removed server-side.

7. “Spot Occupied” (optional)

With “Spot Occupied”, you let other users know that you are currently fishing.

Requirements:

  • Activate: signed-in Fishfy account (also without Pro).
  • Display live occupancy on spots and on the map: Fishfy Pro.

How it works:

  • Activation is manual or automatic (iOS: Shortcuts automation; Android: app shortcut) and is limited to one device at a time.
  • While active, Fishfy periodically sends your current position to the server. The server turns it into a coarse grid cell. Other users do not see an exact live coordinate.
  • A session ID and a time-limited activation token are transmitted to the server.
  • Other Pro users see only a counter at their spots in the app (“Occupied by 1 person”) if someone with Spot Occupied is within 100 m. They see neither your identity nor your username.
  • With location “While Using the App” (iOS) or “While using the app” (Android), the status stays active for 15 minutes even if the app is minimized or closed. It then ends automatically, with a push reminder and a 5-minute grace period.
  • With location “Always”, the feature stays active in the background. iOS: If you swipe the app away in the app switcher, the server detects this via a short check and ends the status. Android: The feature also stays active if you leave the app or swipe it away from Recents (ongoing notification). If you force-stop Fishfy in Android settings, the app cannot keep running. The server detects this via a short check and ends the status. Android cannot deliver a push during a force-stop; it follows once the app is opened again or allowed to run.

Security measures: VPN and simulator/emulator detection, secured cloud functions, no direct client access to the underlying data.

8. In-App Purchases

Pro subscriptions are processed via the store of your platform:

  • iOS: Apple App Store (StoreKit 2). Payment data is handled solely by Apple.
  • Android: Google Play (Google Play Billing). Payment data is handled solely by Google.

We only receive the information whether your Pro status is active.

Management and cancellation:

  • iOS: Apple ID settings under “Subscriptions”
  • Android: Google Play under “Payments & subscriptions”

9. Protection Against Time Manipulation

To ensure forecasts, catch attribution, and “Spot Occupied” work correctly, Fishfy checks at startup and during operation whether the device clock deviates significantly. For this:

  • individual UDP packets are sent to “time.apple.com” (NTP),
  • alternatively an HTTPS HEAD request is made to “apple.com” to read the HTTP Date header.

No personal data is transmitted, only the standard requests of the respective protocols.

Additionally, Fishfy stores a local time anchor after a successful online check to also detect manipulation when offline.

10. Voluntary Data Sharing

In Settings, you can consent to voluntarily sharing your catch data to improve the app. This feature is off by default.

When active and Pro:

  • After savable catches with sufficient tactic or condition details, the catch data (including weather snapshot and, if size allows, photo) is sent to our analysis endpoint at Vercel Inc. (USA). Incomplete entries are not sent.
  • Vercel forwards the data by email via Resend, Inc. (USA) to us (catch@fishfy.app).

Use:

  • Internal analysis to improve forecasts, including estimating water temperature from nearby shared catch data (anonymized, without showing your identity to other users).
  • No disclosure of results to independent third parties for their own purposes.

Image use:

  • Images without recognizable people may be used for marketing the app.
  • Faces and sensitive location features are made unrecognizable or pixelated before use.

Withdraw anytime in Settings with effect for the future. Data already shared will no longer be newly included in future analyses.

11. Newsletter and Service Emails

When creating your account, you can opt in to the newsletter (“News & Updates”). This option is disabled by default.

Service emails (password reset, email verification, security-related notices) are sent regardless, as they are necessary for account management.

Email delivery uses Resend, Inc. (USA). See section 13 on third-country transfers.

Newsletter withdrawal at any time in app settings.

12. Recipients and Third-Party Providers

We use the following providers:

Google Ireland Limited (Firebase: Auth, Firestore, Storage, Messaging, Cloud Functions): Seat: Ireland. Server region: europe-west1 (Belgium). Function: account, cloud sync, push, “Spot Occupied”, content transfer, device management. Basis: performance of a contract; data processing agreement (DPA).

Apple Distribution International Ltd.: Seat: Ireland. Function: “Sign in with Apple”, Apple Push (APNs), App Store / in-app purchases, time sync. Basis: performance of a contract.

Google Ireland Limited (Google Sign-In): Seat: Ireland. Function: sign in with Google. Basis: performance of a contract.

Google Ireland Limited (Google Play Billing): Seat: Ireland. Function: Google Play / in-app purchases (Pro subscription) on Android. Basis: performance of a contract.

Open-Meteo GmbH: Seat: Switzerland. Function: weather data and historical weather data. Basis: performance of a contract. Switzerland: EU Commission adequacy decision.

Resend, Inc.: Seat: USA. Function: sending service and newsletter emails, and forwarding data from “Voluntary data sharing” (only with active opt-in). Basis: processing on behalf; standard contractual clauses (see section 13).

Vercel, Inc.: Seat: USA. Function: receiving data from “Voluntary data sharing” (only with active opt-in). Basis: consent; standard contractual clauses.

Water-level data sources (PEGELONLINE, Hubeau, Rijkswaterstaat WaterWebservices, eHYD, BAFU hydro data, WATERINFO/HIC, Hydrométrie Wallonie KiWIS, BRUWATER Open Data, Héichwaasser): Seat: EU or CH. Function: current water levels. Only spot coordinates and country code are transmitted via our cloud functions. Basis: performance of a contract.

13. International Data Transfers

Resend (USA) and Vercel (USA) process data in the United States. For these transfers, EU Standard Contractual Clauses (SCC) and Data Processing Agreements (DPA) are in place. Both providers are, to our knowledge, certified under the EU-U.S. Data Privacy Framework. Despite these safeguards, there is a residual risk of access by U.S. authorities.

By using the corresponding features, in particular newsletter (optional) and voluntary data sharing (optional), you explicitly consent to this transfer.

14. Storage Period

Local data (catches, spots, photos, settings): Until deletion in the app or app uninstall. An Android backup in your Google account is separate from this; it is subject to your device settings and Google's rules.

Account data: Until account deletion in the app.

Cloud-synced content: Until deletion via the app or account deletion. After a Pro subscription ends it remains; sync is then merely paused.

“Spot Occupied” sessions: A few minutes up to a maximum of 20 minutes per session in “While Using” / “While using” mode, up to a maximum of 12 hours in “Always” mode.

Content transfer data: Until received or expired, at most a few days.

Device documents (push token, settings): Automatically removed after 60 days of inactivity.

Newsletter subscription: Until withdrawal.

Log files of cloud functions: Typically 30 to 90 days for security and stability purposes.

15. Your Rights

You have the following rights under the GDPR:

  • Access to the data we hold about you (Art. 15)
  • Rectification (Art. 16)
  • Erasure (Art. 17)
  • Restriction of processing (Art. 18)
  • Data portability (Art. 20)
  • Objection to processing (Art. 21)
  • Withdrawal of granted consent with effect for the future
  • Complaint to the competent supervisory authority

Directly in the app (More → Data):

  • “Export catches (PDF)”: exports your catches as a PDF. This feature is part of Fishfy Pro.
  • “Delete all data”: you choose between (a) “Delete in app only” (deletes local data on this device only; cloud data remains) or (b) “Delete app & Firebase” (deletes local and all cloud data in Firebase, plus your Firebase account). For (b), re-authentication may be required for security reasons.

Data portability (Art. 20) without Pro: email us at support@fishfy.app. We will provide your personal data in a common, machine-readable format.

For anything else: support@fishfy.app

16. Data Security

  • Connections to our cloud functions, Firebase, and third-party providers always use TLS.
  • Access to your cloud content is secured via Firebase Auth; without a valid auth token, no read or write access is possible.
  • “Spot Occupied” sessions are protected by short-lived activation tokens.
  • Water-level and weather requests are routed through our cloud functions; raw location data does not reach the source authorities.
  • Your cloud content is protected by Firestore and Storage rules so that only you, as the authenticated owner, can access it.

17. Tracking, Analytics, Advertising

Fishfy contains:

  • no tracking SDK,
  • no analytics tools (no Google Analytics, no Firebase Analytics, no Crashlytics),
  • no advertising.

We do not perform cross-device tracking in the app and do not use advertising IDs. On iOS, there is therefore no App Tracking Transparency dialog.

18. Children

Fishfy is designed for people who go fishing on their own. If you are a minor, please obtain the consent of your legal guardian before creating an account or subscribing to Pro. We do not knowingly process data of children who cannot legally consent to such processing themselves.

19. Changes to This Policy

We will inform you in the app about material changes. The current “as of” date is shown at the end of this policy.

20. Contact

For privacy questions or to exercise your rights: support@fishfy.app

21. Data sources and licenses

Fishfy uses open and official data sources. We thank the following providers and reproduce their data unmodified and without warranty.

Weather and historical weather data:

  • Open-Meteo (Open-Meteo GmbH), licensed under CC BY 4.0.

Water levels and water temperature:

  • Germany: PEGELONLINE, German Federal Waterways and Shipping Administration (WSV).
  • Switzerland: Federal Office for the Environment (FOEN), provided via existenz.ch.
  • Netherlands: Rijkswaterstaat.
  • France: Hub'Eau (eaufrance, OFB and BRGM).
  • Austria: eHYD, Land- und forstwirtschaftliches Rechenzentrum.
  • Belgium: waterinfo.be (Vlaamse Milieumaatschappij), Service public de Wallonie and Brussels Open Data.
  • Luxembourg: heichwaasser.lu (Administration de la gestion de l'eau).

All rights to the respective data and trademarks remain with the named bodies. Water temperatures without a nearby station are estimated from regional climate values and historical weather data.