Privacy policy

1. Data controller

The data controller is The Carp Seekers. Contact for any data matters: [email protected].

2. What we process

• Account: email address, full name, nickname, registration and sign-in dates. Passwords are handled only by Google Firebase — we never see them.
• Registration details: date of birth, town and country. Not shown to other users.
• Profile: bio, profile photo and contacts (YouTube, Facebook, phone) with visibility you choose.
• Content you add: catches (weight, species, bait, rig, venue, peg, notes, photos, weather forecast), sessions, gallery photos, comments, likes, messages, friend requests, reports and blocks, venue ratings and reviews, peg notes, known fish names, classified ads and guides.
• Activity: “online” status, visit and sign-in times — for security and administrator statistics.
• Device: a push notification identifier (Android app) or a browser/iPhone notification subscription, if you allow notifications. Bite alerts only use the location of your favourite catalogue venues, not your own location.
• Location: only when you allow it, to fetch the weather. Coordinates are not stored in your profile or published.

3. Who can see your data

• Gallery photos and albums are visible to all signed-in members.
• Catches follow the visibility you set: only you, friends, or all signed-in members. The venue name is shown to others only if you allow it; the peg always stays private.
• Others see your nickname or full name with your posts, as chosen in your profile.
• Date of birth, town, country and email are not shown to other users. The administrator can see them.
• Venue reviews, peg notes, classified ads and published guides are visible to all signed-in users. Venue statistics only count catches with the venue name shared and never show pegs.
• Blocked users cannot see your content, and you cannot see theirs.

4. Purposes and legal bases

• Running your account and the service (Art. 6(1)(b) GDPR).
• Location and push notifications — based on your consent, which you can withdraw at any time in your phone or browser settings (Art. 6(1)(a)).
• Security, abuse prevention, report moderation and backups — legitimate interests (Art. 6(1)(f)).

5. Where data is stored and who receives it

Data and photos are stored on the administrator’s server in the United Kingdom. We use:

• Google Firebase (Google) — sign-in, email verification and push notifications.
• Cloudflare — secure connection and routing traffic to the server.
• Open-Meteo — weather forecasts and town search (only rounded coordinates or a town name are sent).
• postcodes.io — locating UK venues from postcodes (no user data).
• OpenStreetMap — the map in the venue catalogue.

Some of these providers may process data outside the UK/EEA under standard contractual clauses. We do not sell data or use it for advertising.

6. Retention

We keep data until you delete your account. On deletion your data is removed from the app immediately and from backups once they are overwritten (we keep a limited number of recent backups). Technical push delivery records are deleted after 90 days.

7. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data. You can delete your account and all data yourself: My profile → Delete account. For anything else, email [email protected].

You can complain to a supervisory authority: the UK Information Commissioner’s Office (ico.org.uk) or, in Poland, UODO (uodo.gov.pl).

8. Cookies and device storage

We use only strictly necessary cookies: the sign-in session (__Host-carp-firebase) and a device identifier for notifications (__Host-carp-push). No advertising or analytics cookies.

Your device stores your language, consent for automatic location, and catches added offline (until they are sent).

9. Age

The app is intended for people aged 16 and over.

10. Changes

We will announce material changes in the app. The current version is always available on this page.