This policy explains what Fishinary collects, why, who it is shared with, and how to delete it. Fishinary is operated by AnyLuck LLC ("we", "us"), a California limited liability company, which is the controller of the data described here. It covers the Fishinary app and this website.
When you create an account we collect your email address and a username. If you sign in with Apple or Google, we receive your email address and a unique identifier from that provider. If you use Apple's Hide My Email, we only receive the relay address. We never receive your password from these providers.
When you log a catch, the photo is uploaded to our servers and stored with your account. Photos are sent to Google's Gemini API for automated analysis that identifies the fish species and estimates size. This means your catch photos leave your device and are processed by a third-party AI service. We also compare each photo with earlier submissions to detect duplicates.
If you grant location permission, we record the coordinates where a catch was made, and we use your approximate location to generate local weather and bite forecasts. Location is only collected while you are using the app — we never collect location in the background.
You control who can see catch locations. When you share catches with friends in approximate mode, we deliberately reduce location precision to roughly a one-mile area rather than revealing an exact point.
Photos you select may contain embedded metadata such as the time taken and GPS coordinates. We read this to pre-fill the date and location of a catch. You can edit or remove these values before saving.
Species, weight, length, bait, water type, timestamps, and notes you enter, along with experience points, level, coins, quests, badges, titles, and friend relationships.
We record first-party analytics events — such as opening the app, signing up, saving a catch, which screens you open and how long a session lasts — to understand how the app is used and where people encounter problems. These events include your phone's region setting (not its location) and how long actions such as a photo check take, so we can see how the app performs in each country. We use Sentry to receive crash reports and, for a sample of sessions, performance measurements; they contain the device model, operating system, app version, and technical error details. We do not use advertising identifiers, we do not serve ads, and we do not track you across other companies' apps or websites.
If you log a catch without a connection, the photo and the details you entered stay on your phone, in the app's own storage, until the app can upload them. They are sent the next time the app is open with a connection, and from then on the same rules as any other catch apply. Signing out of the app deletes catches that have not been uploaded yet.
Camera and photo library, to take or choose catch photos and a profile picture. Location while using the app — optional — for catch locations and forecasts. Notifications — optional — for reminders the app schedules on your device.
Your contacts, your location in the background, advertising identifiers, browsing history, health data, payment card details (Apple and Google handle payment), and biometric data. We do not run facial recognition on photos.
We do not sell your personal information, and we do not share it for advertising.
| Purpose | Legal basis |
|---|---|
| Running your account, storing your catch log, identifying species and estimating size from your photos, calculating rewards, the sharing you enable, subscriptions | Performance of our contract with you (the Terms of Service) |
| Catch and forecast locations, photo metadata | Your consent, given through the device permission and the choices you make for each catch; withdraw it in your phone's settings or by removing the location from a catch |
| Detecting fraud and duplicate submissions, moderation, security, keeping the service working, first-party analytics and crash reports | Our legitimate interests in running a fair, safe and reliable service, balanced against your rights; you can object (see Your rights) |
| Answering support, legal and data-protection requests; records we are required to keep | Legal obligation, and our legitimate interest in handling requests |
| Marketing email (we send none today) | Consent, which you can withdraw at any time |
We do not rely on consent for the processing a 13- to 15-year-old needs to use the app, so no parental consent is required for it; location features are optional.
When you submit a catch photo, automated analysis decides whether the catch can be logged: accepted, flagged (logged, but left out of rankings) or not accepted. The decision is based on what is visible in the photo — for example an aquarium, a store, or a screenshot — and on whether the photo duplicates an earlier one. It has no legal effect on you, and you can ask a person to review any "not accepted" result from the same screen; a member of our team then decides. We make no other automated decisions about you, and we do not profile you for advertising.
We share data with these providers only as needed to run the app. Each acts as our processor under a data processing agreement, or is an independent service that receives only the data listed:
We may also disclose information if required by law, or to protect the rights, safety, or property of our users or of AnyLuck LLC.
Your username, avatar, level, and badges are visible according to your profile visibility setting. Catches and catch locations are private by default and are shared only to the extent you enable sharing. If you report another user's catch, your report is never shown to the person you reported.
How long we keep each kind of data:
You can delete your account at any time from Settings → Account → Delete Account in the app, or by following the instructions on our account deletion page.
Deleting your account permanently removes your profile, catches, photos, analytics events, friend relationships, rewards history, and login credentials. This cannot be undone. Backups are purged on a rolling basis, and anonymized aggregate statistics that cannot identify you may be retained.
Depending on where you live, you may have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy in a portable format, to restrict or object to certain processing (including processing based on our legitimate interests), to withdraw consent, and not to be treated differently for exercising these rights. Deletion is available immediately in the app (Settings → Account → Delete Account). For everything else, email privacy@fishinary.com from the address on your account; we verify requests through that address and respond within the time the law sets — one month in most places, which the law lets us extend for complex requests, in which case we will tell you. An authorized agent may act for you where the law allows, and we may ask for proof of their authority.
Complaints. If you believe we have handled your data unlawfully, you can complain to a regulator: in the European Economic Area, your national data protection authority; in the United Kingdom, the Information Commissioner's Office; in Switzerland, the FDPIC; in Australia, the OAIC; in New Zealand, the Privacy Commissioner; in Canada, the Office of the Privacy Commissioner or, in Quebec, the Commission d'accès à l'information; in Brazil, the ANPD; in Japan, the Personal Information Protection Commission; in South Korea, the PIPC. We would appreciate the chance to resolve the matter with you first.
United States. We do not sell personal information, do not share it for cross-context behavioral advertising, do not use it for targeted advertising, and do not make decisions about you with legal or similarly significant effects. Residents of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states with privacy laws may exercise the rights above by email. Because we neither sell nor share personal information there is nothing to opt out of, and for that reason we do not currently respond to Global Privacy Control signals. California residents may also ask, once a year, for a list of personal information disclosed to third parties for their own direct marketing: we make no such disclosures.
Fishinary is not directed to children under 13 (under 14 in South Korea), and we do not knowingly collect personal information from them. If you believe a child under that age has created an account, email privacy@fishinary.com and we will delete it.
Data is transmitted over encrypted connections and stored with access controls that restrict each account to its own records. No system is perfectly secure, but we design access so that one user cannot read another user's private data. If a security breach affects your personal data, we will notify you and the relevant authorities as the law requires.
We operate from the United States and store data in a single United States region. If you use Fishinary from another country, your information is transferred to and processed in the United States, where it may be accessed by authorities under United States law. For users in the European Economic Area, the United Kingdom, and Switzerland, these transfers rely on our processors' data processing agreements incorporating the European Commission's Standard Contractual Clauses (and the UK Addendum or IDTA where applicable), and where available on the EU–US Data Privacy Framework certifications of those providers. Country-specific details follow below.
Canada. We comply with PIPEDA and, in Quebec, the Act respecting the protection of personal information in the private sector (Law 25). The person in charge of the protection of personal information is the Managing Member of AnyLuck LLC, reachable at privacy@fishinary.com. Your information is stored in the United States; we assess the protection it receives there before transferring it. Confidentiality incidents that present a risk of serious injury are reported to the Commission d'accès à l'information and to the people affected, as the law requires.
Brazil. You have the rights in Article 18 of the LGPD, including confirmation, access, correction, anonymization, portability, deletion, information about sharing, and information about the consequences of refusing consent. Your data is transferred to the United States because the service you request cannot be provided without it (LGPD Article 33, IX), under contracts with the providers listed above. Our channel for communications with data subjects and the ANPD is privacy@fishinary.com.
Japan. The business operator is AnyLuck LLC, 2108 N St, Ste N, Sacramento, CA 95816, United States; representative: Robert Ramirez. The purposes of use are those listed under "How we use it", and the information the app sends from your device to others is listed under "Service providers". Your data is handled in the United States, which has no comprehensive federal privacy law equivalent to the Act on the Protection of Personal Information; our providers are bound by contract to safeguards equivalent to those required of us. The security measures we take are described under "Security". Requests and complaints: privacy@fishinary.com.
South Korea. You must be 14 or older to use Fishinary. Location is collected only with your consent through the device permission, only while you use the app, and you can withdraw that consent at any time in your phone's settings. Your account, catch, photo and gameplay data are transferred to and stored in the United States by the providers listed under "Service providers", over encrypted connections each time you use the app, for the purposes and periods stated in this policy. You may refuse the overseas transfer, but the app cannot run without it. Department in charge of personal information: AnyLuck LLC Privacy, privacy@fishinary.com.
Australia and New Zealand. Your data is disclosed to the United States providers listed above, and we take reasonable steps to ensure they handle it consistently with the Australian Privacy Principles and New Zealand's information privacy principles. If a complaint to us is not resolved, you may contact the OAIC or the New Zealand Privacy Commissioner.
Other countries. If your country's law gives you additional rights, email privacy@fishinary.com, which is also our grievance contact; we honor requests to the extent the law requires.
This website does not use analytics, advertising or tracking cookies. It is hosted by Cloudflare, which processes visitors' IP addresses to deliver the pages.
Launch waitlist. If you join the waitlist on fishinary.com we store the email address you enter, the kind of phone you were using (iPhone or Android), your browser's language and the time you joined, so we can send you one email when Fishinary is available. The list is stored by Supabase (USA), is never shared or sold, and is deleted within 90 days of the launch announcement. To be removed earlier, email support@fishinary.com.
We may update this policy. If a change reduces your rights or expands what we collect, we will tell you before it takes effect, in the app or by email, and the date at the top will be revised.
AnyLuck LLC — a limited liability company organized in California, United States
2108 N St, Ste N, Sacramento, CA 95816, United States
Privacy requests: privacy@fishinary.com
General support: support@fishinary.com
EU Digital Services Act point of contact: users of the service can reach us at support@fishinary.com; Member State authorities, the European Commission, and the Board can reach us at security@fishinary.com. Communications may be in English.
For consumers in Japan, our Specified Commercial Transactions Act disclosure (特定商取引法に基づく表記) is available.