Privacy policy

1. Controller

The controller for the processing of your data is Johannes Claudi, Amsterdam, the Netherlands. E-mail: privacy@klubfish.com.

No data protection officer has been appointed, and none is required by law. For any privacy question and to exercise your rights, an e-mail to the address above is enough.

2. The website klubfish.com

When you visit the website, our hosting provider Vercel processes technically necessary access data: IP address, time, page requested, browser and operating system. This serves to deliver the site and keep it secure (Art. 6(1)(f) GDPR); the logs are deleted after a short time.

The website sets no cookies, loads nothing from other servers (fonts and images are on our own server) and contains no tracking. A small script reads your browser's language setting to send you to the German or Dutch page; nothing is stored or sent.

3. Waitlist and access to the beta

The beta is open only to approved e-mail addresses. When you sign in, we first check whether your address is approved. If it is not, you can join the waitlist. We then store your e-mail address, an optional note (for example who invited you), the page language and the time.

The operator is told about the request in the app and by e-mail and decides on access; if you are let in, you receive an e-mail. The legal basis is Art. 6(1)(b) GDPR (steps taken at your request before a contract). The request is kept until 30 days after it is decided, an undecided one at most 6 months; on request we delete it at once.

4. Account and sign-in

For your account we need your e-mail address. You sign in with a six-digit code we send you by e-mail; there is no password. The sign-in service logs sign-ins with time and IP address to detect abuse. To keep you signed in, a session key is stored on your device.

The legal basis is Art. 6(1)(b) GDPR (the contract of use); for the security log Art. 6(1)(f) GDPR (our interest in a secure service).

5. Profile and settings

Your profile consists of the name others see you by (a first name is enough), your initials and, optionally, a profile photo. The photo is cropped and resized on your device; location and capture data are removed before it leaves your device. Only people you are connected to see your photo (a shared club, followers, people you follow).

We also store your settings: language, units, who sees your catches, notifications and, if you use it, your place for the weather. Only you see these settings. Legal basis: Art. 6(1)(b) GDPR.

6. Catches and photos

For a catch we store what you enter: species, length and weight, date and time, whether the fish was released or kept, water or place, notes, method and gear, the weather at the time of the catch and up to five photos. From your catches we compute personal bests and, in your clubs, records and rankings.

You decide who sees what: species, size and whether you released it are seen by everyone allowed to see the catch; photos, notes, method and gear, weather and location only as you have set them for clubs and followers. Visibility is checked on the server, not in the app.

Photos: date and location from the capture data (EXIF) are read on your device only. The location is offered to you, never applied without you. Before uploading, the app removes all capture data; the server removes it a second time before the photo is stored. Photos are delivered only through links that expire. Legal basis: Art. 6(1)(b) GDPR.

7. Location

Every catch has three levels: exact, area or no location. We store the exact point for you. Others see at most what you allow: “area” means a circle of about 5 km, never the spot. A club can hide exact spots for everyone, but can never show more than you allow.

The app asks for your device's location only when you tap for it (for example “My location” when logging or for the weather). Your browser asks for your permission first; you can withdraw it at any time in the browser's settings. The legal basis is your consent (Art. 6(1)(a) GDPR).

8. Clubs, groups and followers

When you join a club (a Verein or a group), we store your membership, your role, join requests and, to protect join codes from guessing, your join attempts for one day. Members of a club see your name and the catches you share with the club. Then there is what you do in the club: replies to events, competition results, announcements read and your “Petri Heil” on catches.

Whoever registers a Verein gives its name, place and a note; the operator reviews the application. If a Verein uses the fee list, it records there whether your fee is paid; no money moves through klubfish. This entry is deleted 13 months after the membership ends.

Club admins can export a catch list of the catches shared with the club. The club is then responsible for an exported list.

Following needs your approval: whoever wants to follow you sends a request that you accept or decline. If someone logs a catch for you, it is a proposal you accept or decline. The legal basis for all of this: Art. 6(1)(b) GDPR.

9. Notifications and e-mails

Only you see your notifications in the app. We send e-mails only about your account, such as the sign-in code, access to the beta, notices about deleting your account or about your data export, and decisions that concern you. Legal basis: Art. 6(1)(b) GDPR.

Push messages are sent only if you turn them on for a device (Art. 6(1)(a) GDPR). For this we store the push address and keys your browser creates. Delivery runs through your browser maker's push service (for example Google, Apple or Mozilla). A push message is encrypted and contains no names and no catch data, only the kind of message and a reference; the app reads the details only when you open it. You can turn push off at any time in the settings.

10. Weather, place search and maps

Weather: for the forecast and the weather at catch time, the position is first rounded to a grid of about 5 km (on your device and again on the server). Our server then asks Open-Meteo with this rounded cell only; Open-Meteo never sees your IP address. We keep forecasts per cell for at most three hours. The weather at catch time is stored with the catch.

Place search: when you search for a place or get a place name suggested for a point, our server asks OpenStreetMap's Nominatim service, with your search text or a point rounded to about 100 m. Nominatim sees our server, not you. We do not log searches.

Maps: your browser loads the map tiles directly from OpenStreetMap's servers. They see your IP address and which part of the map you load. The legal basis is our legitimate interest in showing you a map (Art. 6(1)(f) GDPR).

11. Security and abuse protection

To protect the service, we limit how often certain actions can be taken (for example waitlist requests or join attempts), and our providers' servers log access for a short time. When an account is deleted, we keep as proof only an irreversible fingerprint of the account ID with the date and result. Legal basis: Art. 6(1)(f) GDPR.

12. What is stored on your device

klubfish sets no cookies. On your device the app stores only what it needs to work:

• your sign-in session and your settings (language, units, appearance),
• a cache of the screens you last saw, so the app starts without a connection (at most 7 days, cleared when you sign out),
• catches not yet sent, until they have reached the server,
• the app's own files, so it runs offline.

This storage is strictly necessary for the service you use and therefore needs no consent. If you clear the website's data in your browser, catches not yet sent are lost.

13. Recipients and processors

We do not sell data or pass it on for advertising. To run klubfish we use these service providers, with whom we have data processing agreements or whose terms contain equivalent rules:

• Supabase Inc. (USA): database, sign-in, file storage and server functions. The data is held in a data centre in Frankfurt am Main (EU).
• Vercel Inc. (USA): hosting of the app and the website through a worldwide delivery network.
• Resend (USA): sending e-mails.
• OpenStreetMap Foundation (United Kingdom): map tiles (the tile server receives your IP address and the map area you view) and place search through Nominatim (which receives only our server, your search text or a rounded point), see section 10.
• Open-Meteo (Switzerland): weather data, only with the rounded 5 km cell, see section 10.
• your browser maker's push service, only if you turn push on, see section 9.

Other users see your data only as far as your settings and your clubs provide.

14. Transfers outside the EU

Supabase, Vercel and Resend are companies based in the USA; access to data from the USA cannot be ruled out. It is safeguarded by the EU Standard Contractual Clauses and, where the provider is certified, by the EU-U.S. Data Privacy Framework. For the United Kingdom and Switzerland the European Commission has found an adequate level of data protection.

15. How long we keep data

• Account, profile, catches, photos and memberships: as long as your account exists.
• After you ask to delete your account: 14 days to change your mind; then your profile, own catches and photos, memberships, follows, tackle box, reactions, settings, notifications and push subscriptions are deleted. Catches you logged for others stay with them, without your name. Clubs you founded continue.
• Data export: 24 hours, and it can be downloaded once.
• Weather data per cell: at most three hours.
• Join attempts: one day. Fee status: 13 months after the membership ends.
• Waitlist: until 30 days after the decision; a request not yet decided at most 6 months.
• Our providers' access logs and backups: a short time, after which they are overwritten.

16. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on our legitimate interest (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Much of this works directly in the app, under Settings › Account: “Download my data” gives you all your data as a ZIP file (catches as a table, photos, profile, memberships, settings, tackle box); “Delete account” starts the deletion. For anything else, write to privacy@klubfish.com.

You can lodge a complaint with a data protection authority. Ours is the Dutch Autoriteit Persoonsgegevens; you can also turn to the authority in your own country.

17. Minimum age

klubfish is for people aged 16 and over. When you set up your account, you confirm that you are at least 16.

18. No automated decisions

We make no automated decisions within the meaning of Art. 22 GDPR and do not build profiles of you. Records, personal bests and rankings are calculations from your catches, not decisions about you.

19. Required information

Without an e-mail address and a name we cannot set up an account. Everything else (photo, location, notes, weather, push) is optional.

20. Changes

If the way klubfish processes data changes, we update this policy and the date at the top. We tell you about significant changes in the app beforehand.