Privacy Notice (GDPR)

1. What we collect

We collect only what the features you use actually require.

• Account and profile: email address, hashed password (handled by our authentication provider), account identifier, sign-in timestamps, fishing profile answers such as target species, water types, methods, budget band and experience level.
• Delivery references: delivery addresses and contact names you save to pass to a retailer at checkout. We do not store card numbers — you pay on the retailer's own checkout.
• Product searches and links: the URLs, product names and photos you submit to the finder, the extraction results, and the timestamped checks derived from them.
• Saved and owned gear: your gear inventory, saved items, price alerts and comparison sessions.
• Catches and photos: species, length, weight, date and time, water name and type, method, gear used, released/kept, your story text, the photo you upload, and a perceptual hash of that photo used for duplicate detection.
• Location: exact coordinates only if you explicitly tap "Use my location". You can keep them private, publish a server-generalised point no more than 500 m from the recorded spot, share only the water name, or separately consent to publishing the exact coordinate.
• Rewards and leaderboard: point ledger entries, levels, streaks, badges, challenge progress, redemption claims and, if you opt in, the nickname you display on the weekly leaderboard.
• AI prompts and outputs: the question you ask an FishingPal, the candidate set supplied with it and the answer returned.
• Support, complaints and privacy requests: category, reply email, subject, message, reference number and status.
• Purchase intents, audit and security logs: what you approved, when, to which retailer, plus administrative actions, rate-limit counters and error diagnostics.
• Cookies and session storage: strictly necessary authentication and security storage. See the Cookie Notice.

2. Why we use it and on what legal basis

• Providing the account, finder, compatibility engine, catch diary and gear inventory — performance of our contract with you (Article 6(1)(b)).
• Passing a purchase intent to a retailer on your instruction — performance of our contract and your explicit instruction (Article 6(1)(b)).
• Publishing an opted-in catch to the community feed or leaderboard — your consent (Article 6(1)(a)), withdrawable at any time by making the catch private or leaving the leaderboard.
• Storing exact coordinates for prize and fraud review — your consent given when you tap "Use my location", and our legitimate interest in preventing reward fraud (Article 6(1)(a) and (f)). Publishing an exact coordinate requires a separate, explicit consent and may earn the stated FishToken reward after verification.
• Running rewards, verification and anti-abuse checks including duplicate-photo detection and daily caps — performance of the rewards rules and our legitimate interest in a fair programme (Article 6(1)(b) and (f)).
• Handling support, complaints and data-rights requests — legal obligation and legitimate interest (Article 6(1)(c) and (f)).
• Security, logging, debugging and abuse prevention — legitimate interest (Article 6(1)(f)).
• Accounting and legal record-keeping where applicable — legal obligation (Article 6(1)(c)).

3. AI processing

When you ask an FishingPal a question, your question and the supplied candidate set are sent to the configured model provider to generate an answer. We do not send your exact coordinates, your email address or your payment references to a model provider. Providers are instructed not to train on this content where their API offers that setting. See the AI Transparency Notice for what the AI can and cannot decide.

4. Recipients and processors

We share personal data only with providers that process it on our behalf under a data processing agreement, and with the retailer you choose.

• Hosting, database, authentication and file storage provider (application infrastructure).
• AI model providers, where an FishingPal is configured and you use it.
• Retailers you select, receiving only what a purchase needs — for example a delivery address and contact name.
• Merchant feed and discovery connectors, where configured, receive product queries — not your identity.
• Public authorities where we are legally required to disclose.

5. International transfers

We prefer EU/EEA hosting. Where a processor operates outside the EEA, the transfer is covered by an adequacy decision or by the European Commission's Standard Contractual Clauses together with supplementary technical measures such as encryption in transit and at rest. You may ask us for details of the safeguards used.

6. Catch photos and location — specific safeguards

Catch privacy is designed to fail closed.

• Every catch photo is re-encoded in your browser before upload, which strips EXIF metadata including embedded GPS coordinates. The original file never leaves your device.
• Catch privacy defaults to Private. Nothing is published until you actively choose to share.
• Exact coordinates are stored in a separate, access-restricted table. They are not public unless you deliberately select "Exact spot — public" and confirm the separate warning.
• Without that exact-public consent, only you and authorised administrators performing prize or fraud review can access exact coordinates.
• Where you choose "Approximate area", the public point is derived on the server and is no more than 500 m from the recorded spot; the exact point is not returned in that mode.
• If you choose exact-public sharing, anyone can see, save and revisit that coordinate. You can withdraw the sharing consent later; any location-sharing reward is then reversed under the Rewards Rules.
• We do not sell precise location data, and we do not share it with advertisers or data brokers.

7. How long we keep data

• Account, profile and gear: while your account exists, then deleted within 30 days of account deletion.
• Catches and photos: while your account exists or until you delete the catch; deleted copies are purged from backups within 30 days.
• Exact coordinates: 24 months, or until you delete the catch, whichever is earlier.
• Point ledger and redemptions: 24 months after the reward period, for prize integrity and accounting.
• Purchase intents and audit records: 7 years where accounting or legal obligations apply, otherwise 24 months.
• Support, complaint and privacy requests: 3 years from closure, to evidence handling.
• Security and error logs: 12 months.
• Rate-limit counters: 24 hours.

8. Security

Access to your rows is enforced in the database itself with row-level security, so one account cannot read another's data. Privileged operations run only on the server with server-side role checks; no privileged key is ever present in the browser. Outbound page fetches run through host, redirect, size and timeout guards. Uploaded photos are stored in a private bucket and served through short-lived signed URLs.

9. Minors

FishSmash is not intended for children under 16. We do not knowingly collect data from under-16s. If you believe a child has created an account, contact us and we will delete it.

10. Automated recommendations

FishSmash ranks and recommends gear automatically, using deterministic rules (compatibility, verified price, freshness, stock) and, optionally, AI-generated explanations. These are suggestions only. There is no automated decision-making producing legal or similarly significant effects on you within the meaning of Article 22 GDPR, and no profiling for advertising.

11. Your rights

You have the right of access, rectification, erasure, restriction of processing, objection to processing based on legitimate interests, and data portability, plus the right to withdraw any consent at any time without affecting processing already carried out.

Exercise them in the Privacy Centre when signed in, or through the contact form. We offer an immediate machine-readable export of your own rows where it is safe to do so; anything else is handled as a tracked request with a target response date of 30 days, extendable by two further months for complex requests, in which case we tell you why.

Deletion is a reviewed workflow rather than an instant cascade, so that we do not destroy records we must lawfully keep (for example accounting records or evidence in an open dispute) or break another user's data. We tell you exactly what was deleted and what was retained, and why.

12. Complaint to a supervisory authority

If you believe we have handled your personal data unlawfully, please tell us first so we can fix it. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), Tatari 39, 10134 Tallinn, https://www.aki.ee/en, or with the supervisory authority of your EU country of residence.

General information about your GDPR rights is published by the European Commission at https://commission.europa.eu/law/law-topic/data-protection/rights-citizens_en.

13. Contacting the controller

Notsu OÜ, registry code 16305121, Soo tn 2, 10414 Tallinn, Estonia.

We have not appointed a Data Protection Officer, because our processing does not meet the Article 37 criteria that would require one.

We have not yet published a public support email address. Until we do, the fastest and only guaranteed route to us is the in-app contact form at /contact, which creates a tracked request with a reference number that our operators work through. Do not rely on any email address for FishSmash that you did not receive from us directly.