Privacy Policy

This Privacy Policy explains how FishTrip (“FishTrip,” “we,” “us”) collects, uses, and protects your personal data when you use the FishTrip mobile application and the services available at fishtrip.fun (together, the “Service”).

1. Who we are

Controller:Gregor Willenberg
Gellertstrasse 14
13127 Berlin Germany
Email: privacy@fishtrip.fun

2. What data we collect

3. How we use your data

• Provide the core service — creating trips, catches, gallery, leaderboard, weather, voice messages.
• Authenticate you and keep your session secure.
• Deliver push notifications about your trips (new catches, voice messages, invitations).
• Recognise fish species in catch photos using the Fishial Recognition API (see §5).
• Provide the interactive map, ranked leaderboards, and personal statistics.
• Diagnose crashes, prevent abuse, and improve reliability.
• Comply with legal obligations.

4. Legal basis (GDPR)

• Performance of a contract (Art. 6(1)(b)) — account creation, storing your trips and catches, and delivering the Service you signed up for.
• Consent (Art. 6(1)(a)) — access to location, camera, microphone, photo library, and push notifications. You can withdraw consent at any time in your device settings.
• Legitimate interests (Art. 6(1)(f)) — protecting the Service from abuse, diagnostics, and improving product quality.
• Legal obligation (Art. 6(1)(c)) — retention required by applicable law.

5. Third-party services

We share only the minimum data needed to make the Service work.

We do not currently share your personal data with any other party for advertising or marketing purposes. See §7 below.

6. Reports and moderation data

FishTrip is a social platform, so we run a moderation programme to review user-generated content when it is flagged by other users. This section explains what data we collect through that programme, how we use it, and how long we keep it. The programme itself is described in §7 of our Terms of Service.

What we collect when you file a report

• Your account identifier (the reporter).
• The identifier of the reported content (catch, photo, comment, voice message, or user) and the identifier of that content's author.
• The reason you selected from the list of predefined categories.
• The free-text description you optionally added (up to 500 characters).
• A server timestamp and the IP address of the request.

Legal basis: performance of the Service and our legitimate interest in keeping the community safe (Art. 6(1)(b) and (f) GDPR), and — for reports involving child safety or illegal activity — compliance with a legal obligation (Art. 6(1)(c)).

What we collect when you block someone

We store a symmetric record linking your account identifier to the blocked user's account identifier, plus a timestamp. That record is used to hide each side's content from the other and can be reviewed and removed at any time from Settings → Blocked Users.

Who can see reports and moderation actions

• Only members of our moderation team, whose access is logged.
• Your identity as the reporter is never disclosed to the reported user or to other users. Only staff can see it.
• We do not sell moderation data and we do not use it for advertising or ranking.
• For reports involving child safety, threats to life or bodily harm, or other serious illegal activity, we may share the report and the reported content with law enforcement authorities as required by law.

Audit log

Every moderation action taken on a report — assignments, status changes, content hides, removals, warnings, suspensions, and bans — is written to an immutable audit log. We keep this log so we can demonstrate the operation of our moderation programme to platform operators (Apple, Google) and to regulators. Individual entries are minimised: they contain the acting moderator's identifier, the action, the affected content or account identifier, and a timestamp.

Retention

• Reports and the associated audit log entries are retained even after your account is deleted, but reduced to the minimum needed to keep the audit trail intact (moderation ids, action, timestamp — no free-text description tied to a deleted account).
• Blocked-user entries are deleted when either party deletes their account or explicitly unblocks the other party.

Your rights

You retain all the rights listed in §9 of this policy over the data described in this section, including access, correction, and deletion. Requests to erase content you reported are subject to the retention rules above.

7. Advertising (planned)

FishTrip does not currently show advertising. We may introduce advertising in a future version of the Service to support ongoing development. Before we do, we will update this Privacy Policy and, where the advertising involves tracking, ask for your consent through:

• Apple’s App Tracking Transparency prompt on iOS (required for access to the IDFA and any cross-app tracking); and
• an in-app consent banner where required by the GDPR / ePrivacy Directive.

We distinguish between two kinds of advertising:

• Contextual advertising — ads chosen only by the screen or feature you are on (for example, tackle offers on the map). No personal data is used to select the ad. We may introduce contextual advertising without additional consent, as it does not rely on personal data.
• Personalised advertising — ads that are targeted using identifiers, past behaviour, or profile information. We will not use personalised advertising unless you have given specific consent through the mechanisms above, and you can withdraw consent at any time.

If we begin using an advertising network, we will list the provider(s) in §5 above and describe what data is shared. You will always be able to manage your advertising choices in the app settings, and you will always be able to opt out of personalised advertising without losing access to the core Service.

8. International transfers

Some of our providers (e.g. Apple, Google, Fishial) may process data outside the European Economic Area. Where that happens, transfers are covered by the European Commission’s Standard Contractual Clauses or an adequacy decision.

9. Data retention

• We keep your account data for as long as your account exists.
• When you delete your account, we delete or anonymise your personal data within 30 days, except where retention is required by law.
• Server-side logs are kept for up to 90 days.
• Trip and catch photos remain on our storage until you or the trip owner deletes them.

10. Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15).
• Correct inaccurate data (Art. 16).
• Erase your data (Art. 17) — you can also delete your account directly from the app.
• Restrict or object to processing (Arts. 18 and 21).
• Receive your data in a portable format (Art. 20).
• Withdraw consent at any time (Art. 7).
• Lodge a complaint with a supervisory authority.

To exercise any of these rights, email privacy@fishtrip.fun. We respond within one month.

11. Security

All traffic between the app and our servers uses TLS. Passwords are hashed using bcrypt; authentication uses JSON Web Tokens with automatic refresh. On your device, credentials are stored in the iOS Keychain or the Android Keystore. Despite these safeguards, no system is completely secure — if we become aware of a personal-data breach we will notify affected users and the relevant supervisory authority in line with Art. 33 GDPR.

12. Children

FishTrip is not directed at children under 13 (or the equivalent minimum digital-consent age in your country). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page reflects the most recent revision. Material changes will be communicated in the app or by email before they take effect.

14. Contact

Questions, requests, or complaints about this policy or your personal data:
privacy@fishtrip.fun