Privacy Policy

1The short version

• No ads, no tracking across other apps or websites, no selling of your data and no third-party analytics tools.
• Location stays off until you turn it on. We store exact catch locations only in encrypted form and show them only to you. Publicly, at most a rough region (about 10 km) or a water name you typed yourself is shown.
• We remove photo metadata (EXIF, including GPS) on your device and again on the server.
• For every catch you decide who sees it: only you, your followers or everyone.
• You can export your data in the app at any time and delete your account with all its content.

2Controller

The controller responsible for data processing under the General Data Protection Regulation (GDPR) is:

Holofish is developed and run by a private individual. Where this text says “we” or “us”, it means Lenny David Enderle. We are not required to appoint a data protection officer. For any privacy question, reach us directly at the email address above.

3What data we process

Account and sign-in

So you can start right away, the app creates an anonymous account the first time you open it. To do this it generates a random device ID; on the server we only store a hash of it. Your account has an internal user ID, a display name and an @handle (assigned automatically at first) as well as sign-in tokens, which we also store only as hashes.

If you secure your account, we also process:

• Email sign-in: your email address. We send you a one-time code that is valid for 10 minutes and that we store only as a hash. The emails are sent by the email service Resend.
• Sign in with Apple: the user identifier Apple creates for Holofish, your email address (including a private relay address from Apple if you choose “Hide My Email”) and, if you share it, your name.

You can add to your profile if you like: display name, @handle, bio, profile photo, country and home region. We also store your settings, such as language, units, visibility of new catches and notifications.

Catches and photos

For every catch we store the photo as an original and as a thumbnail, plus images derived from it: the cut-out fish, the pixel sprite, the colour palette and the collectible card. On iPhones with a LiDAR sensor the app can also record depth data to measure length more accurately. The app removes photo metadata (EXIF), including GPS coordinates, device model and capture time, on your device; our server removes it again before storing the photo.

A catch also includes the species (recognised or chosen by you), length, weight (and how it was determined), notes, bait, fishing method, water name, water type, time of the catch and time zone. From this the app calculates the tier, experience points (XP), achievements, records and your statistics.

The app only uploads photos you take or pick for a catch. It only accesses the camera and photo library if you allow it in iOS.

Location

Location access is optional and off by default. Only when you turn on Settings › Privacy › Save location and iOS grants access do we store the exact coordinates of a catch. We encrypt them with AES-GCM before they go into the database and show them only to you, for example on your catch map. Others can see at most a rough region (a cell of about 10 km) or a water name you type yourself. You choose what is shown when sharing under “Location when sharing”.

For the weather and bite forecast, if you have allowed location access, the app sends a position rounded to about 5 km to our server. The server uses it to request the forecast from the Norwegian Meteorological Institute (MET Norway, api.met.no). MET Norway only receives the rounded position from our server, not your IP address and nothing linked to your account. We do not store the rounded position in your account; the forecast for that grid cell is cached for at most 30 minutes.

For the map view the app uses Apple Maps. Your iPhone loads the map data directly from Apple.

Species recognition and moderation with AI

When you photograph a catch, an AI recognises the species. For this we use models that run inside Cloudflare's infrastructure (Cloudflare Workers AI):

• a vision model from Google (Gemma) for species recognition and for checking profile photos and the catch photos you choose to show to others, before anyone else sees them,
• Meta Llama Guard for checking texts such as comments, names and bios for insults, hate and other prohibited content,
• BAAI bge-m3 to match the recognised features against the species in the lexicon.

If the recognition is uncertain, the catch photo (without metadata) may also be sent to Anthropic (Claude) via Cloudflare AI Gateway for a second opinion. AI Gateway may log and cache such requests briefly for cost control and troubleshooting.

We do not use your photos to train AI models. The providers process them only on our behalf, as processors. The recognition result is a suggestion that you can correct at any time. We do not make decisions that have legal effects on you or similarly significantly affect you based solely on automated processing (Art. 22 GDPR).

Community

When you use the community, we process your comments, “Petri Heil” reactions, who you follow and who follows you, who you block, your reports (with the reason and the reported content) and the visibility of each catch. For each catch you decide whether it is private, visible to your followers only or public. Your original photo is only shown publicly if you turn on Settings › Privacy › Show original photos publicly; otherwise others only see the card and the images derived from it. A catch photo you choose to show is only visible to others after it has passed the AI check described above; if it does not fit our community rules, it stays private.

Public catches, your profile (display name, @handle, bio, profile photo, level) and your positions in leaderboards, records and tournaments can be seen by all Holofish users. Public catches and profiles also have a share page on the web that can be opened without the app. If you share a catch that is not public, the app creates a signed link: anyone with that link can see the catch.

Holofish Plus and purchases

You buy Holofish Plus through Apple's App Store. Apple handles the payment; we never see payment details such as card numbers. We use RevenueCat to manage subscriptions. RevenueCat receives your internal user ID and Apple's purchase receipts (for example product, time of purchase, term, price and country) and tells us whether and until when Plus is active. We store your subscription status and expiry date.

Notifications

Only if you allow notifications do we store your device's push token. Notifications are delivered through Expo's push service (650 Industries) and the Apple Push Notification service. These services receive the token and the text of the notification, for example that someone commented on your catch. You choose which notifications you get in the app; you can turn them off completely in the iOS settings.

Protection against manipulation (App Attest)

To keep records and leaderboards fair, we use Apple App Attest to check that catches come from a genuine, unmodified Holofish app. For this we store the key ID and the public key that the app creates through App Attest. We do not use an advertising ID (IDFA).

Usage events and server logs

To understand which features are used and where things go wrong, we record simple events such as “catch created” or “card revealed”. We do this ourselves with Cloudflare Analytics Engine, without third-party analytics or advertising tools. The events are linked to your user ID, we evaluate them in aggregate, and they are deleted automatically after three months at the latest. We also count per day how many catches, recognitions and comments an account creates, to limit abuse and costs.

When the app or your browser calls our server, Cloudflare processes technically necessary data such as IP address, time, requested address, technical details about the app or browser and error messages. We need these logs for operation, security and troubleshooting. We also use the IP address to limit too many requests in a short time. The logs are deleted automatically after a few days, at the latest after 30 days.

These web pages

The legal pages and the share pages set no cookies, load no fonts, scripts or content from third parties and use no tracking. Only the server logs described above are created.

Contact by email

If you write to us, we process your email address and your message to reply to you.

4Purposes and legal bases

Contract (Art. 6(1)(b) GDPR)

To provide the app to you: account and sign-in, saving catches, recognising species, creating cards, Dex, XP and statistics, community features, weather forecast, Holofish Plus and support.

Consent (Art. 6(1)(a) GDPR)

For location, notifications, access to camera and photos (controlled through the iOS permissions) and the public display of your original photos. You can withdraw consent at any time with effect for the future, in the app or in the iOS settings.

Legitimate interests (Art. 6(1)(f) GDPR)

For security and abuse prevention (server logs, rate limiting, App Attest), for moderating content to protect the community and for aggregated usage statistics that help us improve the app. Our interest is a safe, fair and stable app; we use as little data as possible for this.

Legal obligations (Art. 6(1)(c) GDPR)

Where the law requires us to process or keep data, for example to answer requests from authorities or to act on reports of illegal content.

5Do you have to provide data?

You are not legally or contractually required to give us any data. Without certain data, however, some features do not work: without a photo there is no catch and no card, without an email address no email sign-in, and without location access no catch locations and no weather forecast for your spot.

6Who receives your data

We only pass your data to the following service providers, which we need to run Holofish. Unless stated otherwise, they process the data as processors and only on our instructions (Art. 28 GDPR).

Cloudflare, Inc. (USA)

Server hosting, database, photo storage, caches and queues, AI models (Workers AI and AI Gateway), usage events (Analytics Engine) and server logs.

Anthropic, PBC (USA)

Second opinion when species recognition is uncertain. Receives the catch photo without metadata and the list of candidate species.

RevenueCat, Inc. (USA)

Management of Holofish Plus. Receives your internal user ID and Apple's purchase receipts.

650 Industries, Inc. (Expo, USA)

Delivery of notifications. Receives the push token and the text of the notification.

Resend (USA)

Sending the emails with your sign-in code. Receives your email address and the code.

Apple

App Store and purchases, Sign in with Apple, App Attest, notifications (Apple Push Notification service) and the map view (Apple Maps). Apple is itself responsible for the App Store, payments and your Apple ID; Apple's privacy policy applies to these.

MET Norway (Norway)

Weather forecast. Receives from our server only the position rounded to about 5 km, with no link to your account.

Other users see your content according to your visibility settings. We only disclose data to authorities where we are legally required to. We do not sell data and do not share it for advertising.

7Transfers outside the EU

Some service providers are based in the USA or process data there. We base transfers to the USA on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which are part of the data processing agreements with the providers. Cloudflare runs a global network: your requests are usually handled in a data centre near you, but data may also be processed in other countries. Norway is part of the European Economic Area. You can request a copy of the safeguards from us by email.

8How long we keep data

• We keep account data, catches, photos and community content for as long as your account exists. You can change or delete individual catches, comments and profile details yourself at any time.
• When you delete your account (Settings › Data › Delete account), we immediately remove all account data, catches, photos and community content from the database and storage. Copies in backups and server logs expire after 30 days at the latest, usage events after three months at the latest.
• Sign-in codes are valid for 10 minutes and useless after that.
• Server logs are deleted after a few days, at the latest after 30 days.
• The weather forecast for a rounded position is cached for at most 30 minutes.
• We delete emails to us once your request has been dealt with, unless we have to keep them longer for legal reasons.

Deleting your account does not end a Plus subscription. Cancel it separately in your Apple ID settings. Your purchase history with Apple is not affected. The subscription data at RevenueCat is only linked to a pseudonymous user ID; on request we will have it deleted there.

9Your rights

You have the right to

• access the data we hold about you (Art. 15 GDPR),
• have incorrect data corrected (Art. 16 GDPR),
• have your data erased (Art. 17 GDPR),
• have processing restricted (Art. 18 GDPR),
• receive your data in a common, machine-readable format (Art. 20 GDPR); the app has an export as a JSON file under Settings › Data › Export my data,
• object to processing (Art. 21 GDPR, see below),
• withdraw consent at any time with effect for the future (Art. 7(3) GDPR),
• lodge a complaint with a data protection supervisory authority (Art. 77 GDPR).

You can do a lot directly in the app: edit your profile, delete catches, change visibility, export your data and delete your account. For anything else, write to us at hallo@holofish.app. So that nobody can request someone else's data, we may ask you to send your request from the email address of your account or to confirm in another way that the account is yours.

The supervisory authority responsible for us is the Comissão Nacional de Proteção de Dados (CNPD) in Lisbon, Portugal, www.cnpd.pt. You can also contact the supervisory authority in the EU country where you live or work.

10Children and teenagers

Holofish is meant for anglers aged 13 and older. If you are under 16, you need your parents' consent where the law of your country requires it. If we learn that a child under 13 has created an account, we delete it.

11Security

All connections between the app, the web pages and the server are encrypted with TLS. We store exact catch locations encrypted, and device IDs, sign-in tokens and sign-in codes only as hashes. We remove photo metadata twice. Only we and people we have bound to confidentiality for this purpose have access to administration and moderation.

12Changes

When the app or the law changes, we update this privacy policy. The date at the top shows the current version. We will let you know about significant changes in the app. You will also find the Terms of Use and the Legal Notice here.