Privacy Policy
CatchMap ("the app") is built with the smallest possible amount of personal data. This page describes exactly what data the app handles, why, and what your rights are.
1. What we collect
- Anonymous device identifier — a UUID stored only on your device. Used to reconcile your catch log with our server if you later link an email. Not shared with any advertiser.
- Email address (optional) — only if you choose "Link Email" in Settings to sync catches across devices. Delivered via a one‑time code we send you.
- Catch log content — the fish species, weight, length, technique, notes, photograph and coordinates you enter for each catch. Written to your device first, then optionally to our Supabase backend for cross‑device sync. Row‑level security restricts your rows to you.
- AI Fish ID photos — the image bytes for a single identification request. Sent to our Cloudflare Worker proxy which forwards to OpenAI's Vision API. Not stored on our side; OpenAI's standard retention applies.
- Finn chat messages — the questions you type to Finn, the last few turns of that conversation and your app language. Sent through our Cloudflare Worker to OpenAI to generate the answer. Not stored on our side; OpenAI's standard retention applies.
- Coarse location — used only while the app is open, only to center the map and to record the location of a catch you log. Never in the background. You can revoke at any time in iOS Settings.
- Crash diagnostics (Sentry) — stack traces and device model when the app crashes. No account, message, or identifier is attached to a crash. Off in Debug builds.
- Purchase state (RevenueCat) — the fact of your active subscription tier, tied to your Apple ID by Apple. Used to unlock Pro features across your devices.
2. What we do NOT collect
- No advertising identifier (IDFA). No ad SDKs. No cross‑site trackers.
- No contact list, calendar, health, or browser history.
- No microphone recordings.
- No background location.
3. How we use it
- To show a map centred near you and to store the water body associated with a catch.
- To run the AI Fish ID request on the photo you deliberately submit.
- To reconcile your catch log across your devices when you have linked an email.
- To fix crashes and to authorize your Pro subscription.
We do not sell your data. We do not build a profile of you. We do not share your data with third parties except the processors listed below, and only to the extent required to run the app you asked for.
4. Processors and where data lives
- Supabase — hosts your catches, avatars and email account (if you linked one). Region: US East. Data is encrypted at rest and in transit.
- Cloudflare Workers — proxies AI requests. Holds no user account data; only rate‑limit counters keyed to your device id.
- OpenAI — receives the single Fish‑ID photo of a given request and returns candidate species. See OpenAI's own privacy policy for retention.
- RevenueCat — validates subscription entitlements against Apple.
- Sentry — receives crash reports (no account linkage).
- Apple App Store — handles billing for your subscription; we never see your card details.
5. Your rights
- Delete your account (email + catches on the server) by writing to support@catchmap.app. We respond within 30 days.
- Export your catches: currently on request via the same email address; an in‑app export lands in a future update.
- Withdraw location or photo permissions at any time in iOS Settings; the app degrades gracefully.
- Cancel your subscription in your Apple ID settings — Apple handles the flow.
6. Children
CatchMap is not directed at children under 13 (or the local equivalent). We do not knowingly collect data from children. If you believe a child has provided us data, please write to support@catchmap.app and we will delete it.
7. Changes to this policy
Material changes are posted here with a new effective date and surfaced in‑app at the next launch. Continued use after the update means you accept the new terms.
8. Contact
Emre Begen · Wipo AI · support@catchmap.app