Privacy Policy

This is an English translation for convenience. The German version (“Datenschutzerklärung”) is the legally binding version.

1. Overview

The protection of your personal data is important to us. This policy explains which data we process when you visit this website (fishfy.app), for what purpose, and on what legal basis.

This policy applies only to the website fishfy.app. The Fishfy mobile app has separate privacy information, which you can view in the app under More.

We process personal data in particular when you contact us via the contact form or by email, and in the form of technically necessary server log files. We store your chosen language locally in the browser (localStorage, key “fishfy_lang”) so the website stays in your language. Fonts are served locally from our server; no external CDNs or font services are used.

2. Controller

The controller for data processing within the meaning of the General Data Protection Regulation (GDPR) is:

Email: support@fishfy.app

3. Hosting and Server Log Files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you access the website, Vercel, as our processor, processes technically necessary access data (server log files), in particular:

• IP address of the requesting device
• date and time of access
• the page or file accessed and the amount of data transferred
• referrer URL (the previously visited page)
• the browser type and operating system used

This data is required to deliver the website, to ensure security and stability, and to defend against attacks. The legal basis is our legitimate interest in a secure and functional operation (Art. 6 (1) (f) GDPR). Regarding transfers to the USA, see the section “Transfer to Third Countries”.

4. Contacting Us (Contact Form and Email)

When you contact us via the contact form or by email, we process the data you provide in order to handle your request. For the contact form, this includes in particular:

• Name
• Email address
• Subject
• the content of your message

Providing your name, email address, subject, and message is required in order to answer your request.

The legal basis is the performance of pre-contractual measures or the performance of a contract (Art. 6 (1) (b) GDPR), insofar as your request is aimed at concluding or preparing a contract, and otherwise our legitimate interest in responding to inquiries (Art. 6 (1) (f) GDPR). In addition, you confirm your consent in the form to the processing of your data for the purpose of handling your request (Art. 6 (1) (a) GDPR), which you can withdraw at any time with effect for the future.

The technical delivery of the messages sent via the form is handled by the service provider Resend, Inc. (USA); see the sections “Recipients and Third-Party Providers” and “Transfer to Third Countries”. We store the request data until your matter has been fully processed and no statutory retention obligations prevent deletion.

5. Cookies and Consent

This website uses cookies and similar technologies. Technically necessary cookies and local storage for language selection (localStorage, key “fishfy_lang”) are required to operate the site and are set without consent. We only use statistics if you have actively consented via our consent banner (opt-in).

On your first visit, we ask for your consent. You can change or withdraw your choice at any time with effect for the future via the “Cookie settings” link in the footer. The legal basis for consent-requiring technologies is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG).

For Google services we use Google Consent Mode v2. Before your consent, no Google tags are loaded and no cookies used for statistics are set.

6. Google Analytics 4

After your consent, we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar identifiers to analyze the use of the website statistically (e.g. pages visited, time spent, approximate origin, device used).

The IP address is truncated by Google and not stored permanently. We do not merge this data with other data sources. The usage data collected is automatically deleted after the retention period we have selected (by default up to 14 months). The legal basis is your consent (Art. 6 (1) (a) GDPR, Section 25 (1) TDDDG), which you can withdraw at any time with effect for the future. A transfer of data to Google LLC in the USA is possible; see the section “Transfer to Third Countries”.

7. Recipients and Third-Party Providers

We use the following service providers as processors for the operation of the website:

• Vercel, Inc. (based in the USA) – hosting and delivery of the website. Basis: legitimate interest; data processing agreement; standard contractual clauses.
• Resend, Inc. (based in the USA) – technical delivery of messages sent via the contact form. Basis: pre-contractual measures or legitimate interest; data processing agreement; standard contractual clauses.
• Google Ireland Limited (Google Analytics) – based in Ireland; transfer to Google LLC (USA) possible. Function: statistical audience measurement. Basis: consent; standard contractual clauses.

Beyond this, we only share your data if we are legally obliged to do so.

8. Transfer to Third Countries

Vercel (USA) and Resend (USA) process data in the United States. For these transfers, standard contractual clauses (SCC) of the European Commission and data processing agreements (DPA) are in place. To our knowledge, both providers are also certified under the EU-U.S. Data Privacy Framework. Despite these safeguards, there is a general risk in the USA of access by U.S. authorities.

When using Google Analytics, data may be transferred to Google LLC in the USA. Google is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses are additionally in place. This processing only takes place after your consent.

9. Retention Period

• Server log files: generally for a short period for security and stability purposes (usually up to 30 days), unless a security-relevant event requires longer storage.
• Contact requests: until your matter has been fully processed and until any statutory retention periods have expired.
• Language selection (localStorage): until you delete the data in your browser or we change the key.

10. Your Rights

Under the GDPR, you have the following rights:

• access to the data stored about you (Art. 15)
• rectification (Art. 16)
• erasure (Art. 17)
• restriction of processing (Art. 18)
• data portability (Art. 20)
• objection to processing (Art. 21)
• withdrawal of consent given with effect for the future (Art. 7 (3))
• lodging a complaint with a supervisory authority (Art. 77)

To exercise your rights or for questions about data protection, you can reach us at support@fishfy.app. The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Rheinland-Pfalz).

11. Data Security

Access to this website and the transmission of your form data take place exclusively in encrypted form via TLS (recognizable by “https://” and the padlock symbol in your browser’s address bar).

12. Changes to This Policy

We will update this privacy policy if the legal situation or our processing changes (e.g. when introducing new features or services). The version published on this page applies; you can find the current status at the beginning of this policy.