Last updated: 12 August 2026.
This policy explains what personal data CarnaFish (“we”) collects, why, and what your rights are. It applies to the CarnaFish mobile app and the carnafish.com website.
1. Data controller
CarnaFish is the controller of the data collected via the app and the website. For any question about your data: contact@carnafish.com.
2. Data we collect
- Account: email address, password (encrypted), username, country and language, profile picture and bio if you provide one.
- Apple or Google sign-in: if you use one of those buttons, we receive the account identifier and the email address passed to us. With “Sign in with Apple” you may hide your address, in which case we only receive a relay address.
- Your catches: photos and videos, species, size, weight, lure, rod, spot, date and conditions you log in the Logbook.
- Your spots: name, coordinates and the sharing level you choose.
- Location: a GPS position taken when you analyse a spot, log a catch, open the map or browse the feed. It is used for weather, to identify the water body and to rank posts near you. You can decline this access: the app remains usable, without those features.
- Photo coordinates: if a catch photo contains GPS coordinates, we read them to locate the catch. You can turn them off in your device settings.
- Messaging: the content of messages exchanged with your friends, photos you send, and posts or profiles shared in a conversation.
- Social activity: friends, friend requests, likes, comments, blocked accounts.
- Moderation: reports you send or that target you (reason, snapshot of the reported content, date) and any warnings.
- Notifications: your device's notification identifier and its type (iOS/Android), plus your notification preferences, stored per device.
- Subscription: your Premium status and an anonymous purchase identifier. We never see your payment details: the App Store and Google Play take the payment and pass us no card information.
- AI usage: the number of analyses run, the model used and the cost, to enforce quotas and track our spending.
- Beta list: the email address you provide in the website sign-up form.
- Technical data: information needed for the app to work (device type, error logs).
3. Why we use it
- Provide the service: AI spot analysis, game plan, Logbook, maps, feed, messaging, contests.
- Manage your account, your subscription and your contest entries.
- Send you the notifications you have accepted.
- Improve recommendations from your trip history.
- Keep the service safe and moderated: handle reports, enforce blocks, sanction abuse.
- Contact you about the beta (if you signed up).
Legal basis: performance of the service you request; our legitimate interest in securing and moderating the service; your consent for location, notifications and the beta list — each of which you may withdraw at any time.
4. Providers and sharing
To run the app, we rely on technical providers that process some data on our behalf:
- Supabase — database hosting, authentication, and photo and video storage.
- Anthropic (Claude) — AI analysis of the spot photo. The photo and its context (location, weather, season) are sent for the duration of the analysis; they are not used to identify you, nor to train its models.
- Expo — delivery of notifications to Apple (APNs) and Google (FCM).
- RevenueCat — subscription management and purchase verification with the app stores.
- Apple / Google — subscription payments and sign-in with an Apple or Google account.
- Open-Meteo — weather from approximate coordinates.
- OpenStreetMap, Nominatim, Overpass, OpenFreeMap, Esri — base maps, water body and locality identification.
Some of these providers are established outside the European Union. Such transfers are covered by the European Commission's standard contractual clauses.
We do not sell your data and do not use it for advertising.
5. What others can see
- Your profile (username, picture, bio, public statistics) is visible to other anglers.
- Your catches are only visible according to the visibility you choose for each one: public, friends only, or private.
- Your spots are private by default: they are only shared with the friends you designate, and never become public without your action.
- Your messages can only be read by you and your correspondent. We do not access them, except where a report requires moderation review.
- Blocking someone makes you mutually invisible. The blocked person is not told.
6. Retention
Your data is kept for as long as your account exists. You can delete a catch, a photo, a message or a conversation from the app at any time.
Account deletion: in the app, open My account and choose Delete my account at the bottom of the page. Deletion is immediate and permanent: profile, catches, photos, spots, posts, friends, messages and contest entries are removed. You can also write to contact@carnafish.com from your account's address, in which case we delete it within 30 days at most. Data we are required to keep by law or accounting rules (proof of purchase) may be retained longer, for that purpose only.
Deleting your account does not cancel an active Premium subscription: that is cancelled from your App Store or Google Play account.
7. Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, port and object to your data. You can exercise these rights directly in the app (edit, delete, notification settings) or by writing to contact@carnafish.com. You can also lodge a complaint with your data protection authority.
8. Minors
The service is not intended for children under 15. If you are under 15, your legal guardian's consent is required. If we learn that an account was created without it, we delete it.
9. Website analytics
The carnafish.com website uses no advertising cookies and no third-party trackers. We measure traffic with our own tool, which records the page visited, the referrer, the device type and the browser language, tied to a random identifier stored in your browser. No data is sent to a third party, and that identifier cannot identify you. You can opt out permanently by opening carnafish.com/?noanalytics=1.
10. Security
Passwords are encrypted and traffic is secured (HTTPS). Data access is partitioned per account at the database level. No system is infallible, so let us know if you spot a problem.
11. Changes
This policy may evolve; the update date at the top indicates the latest version. We will tell you in the app if anything material changes.