Privacy Policy

Version 2.0 — Effective as of October 1, 2026

This Privacy Policy describes how FISHMAN LLC (“FishMan”, “we”) collects, uses, shares, and protects your personal data when you use the FishMan mobile application (the “Application”) and the fishman-app.com website.

We are committed to complying with the General Data Protection Regulation (GDPR — EU Regulation 2016/679), the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), the Brazilian Lei Geral de Proteção de Dados (LGPD), as well as local privacy laws applicable in all countries where the Application is available.

Our commitment: we do not sell your personal data. We never sell, rent, or trade it for money or any other consideration, and we never pass it on to data brokers. Your catches, your spots, your photos, and your location are never put up for sale. Our revenue comes exclusively from Pro subscriptions, battle credits, and advertising shown in the free version.

In full transparency: displaying advertising and measuring our acquisition campaigns involves sending certain data to Google AdMob, TikTok, and Meta (see §5). Your advertising identifier (IDFA / Advertising ID) is shared only with your explicit consent — consent form in the EEA and the United Kingdom, App Tracking Transparency authorisation on iOS. Pseudonymised conversion events (install, sign-up, subscription) are also sent to these partners to measure how our campaigns perform. Those advertising partners may process this data for their own purposes: under the CCPA/CPRA this constitutes “sharing” — not a sale — and you may opt out at any time (see §9). All our other providers act as processors on our behalf alone and are not permitted to use your data for their own purposes.

1. Data Controller

The data controller is FISHMAN LLC, a limited liability company organized under the laws of the State of Delaware (USA).

Company name: FISHMAN LLC
Legal form: Limited Liability Company organized under the laws of the State of Delaware (USA)
Registration: Delaware Division of Corporations, File Number 10734943
Registered office: 262 Chapman Rd, Ste 240, Newark, DE 19702, USA
Dedicated data protection email: contact@fishman-app.com

As of October 1, 2026, FISHMAN LLC succeeds the previous publisher of the Application (an individual entrepreneur under Georgian law) as data controller. Your data was transferred to FISHMAN LLC as part of this change of publisher, without any change to the purposes for which it was collected.

2. Data Protection Officer (DPO)

Although appointing a DPO is not formally required for FishMan, a dedicated point of contact is available:

Email: contact@fishman-app.com

3. Data Collected

We collect the following categories of data:

3.1 Account data

Email address,
Pseudonym,
Password (hashed and salted via Firebase Authentication, never accessible in plain text),
Profile picture (optional),
Account creation date,
Country / preferred language, city and postal code (optional),
Phone number (optional), verified by SMS through Firebase Authentication, when you link it to your Account (see 3.10),
Optional answers to the onboarding questionnaire (age range, experience level, how you heard about FishMan, fishing preferences),
Whether or not you agreed to receive our news.

3.2 Fishing data

Catches (species, size, weight, photo, date, location, associated weather),
Fishing sessions (date, duration, starting position, spot, catches, conditions), private by default,
Spots created or favorited, spot photos,
Reported equipment inventory (rods, reels, lures, etc.),
Comments, reactions, follows.

3.3 Photographs and metadata

Catch photos and profile pictures uploaded by the User,
EXIF metadata associated with photos (date, embedded geolocation, device model) — used to pre-fill catch information when the User wishes, and removed from public copies when spot privacy requires it.

3.4 Geolocation

The User’s GPS position when consulting the map or recording a catch,
The position of a created spot,
The starting position of a fishing session (visible to other Users only if you make the session public),
Nearby alerts: if this option is on (it is on by default and can be turned off in the Application settings), your position rounded to about 1 km is saved on your profile so that we can notify you of new spots published near you,
Public Battles: the GPS position and time of each scored catch (accessible only to you and to administrators, for anti-fraud checks) and, for regional Battles, your live position if the “Show me on the map” option is on (see 3.8).

The Application does not access your location in the background: no trail of your movements is recorded during a session.

Geolocation is never enabled without the User’s explicit consent, collected via operating system permissions (iOS / Android). It can be revoked at any time in the device settings.

3.5 Purchase and subscription data

Anonymized purchase identifier (transmitted by RevenueCat / Apple / Google),
Pro subscription status (active, suspended, cancelled),
History of Pro transactions associated with the Account,
Purchases of battle credits (consumable products) and the associated credit balance on the Account.

No banking data (card number, CVV, IBAN) is collected or stored by FishMan: payments are entirely managed by Apple or Google depending on the Store concerned.

3.6 Technical data

Device model, operating system and version, Application version,
Advertising identifier (IDFA on iOS, AAID on Android), subject to consent,
IP address (collected temporarily for security, fraud prevention, and language personalization purposes),
Technical and performance logs,
Anonymized crash reports (Crashlytics).

3.7 Usage data

Features used, frequency of use, navigation paths within the Application (page views, session duration),
Gamification data (XP, level, unlocked trophies).

3.8 Battle mode data (multiplayer tournaments)

Battle mode is a social feature by design: it lets you run a timed fishing game between 2 and 8 players. When you create or join a battle, we process:

Your nickname and profile picture, visible to all other participants of the session (lobby, live leaderboard, final podium),
The catches scanned during the game (species, photo, points, timestamp), added to the real-time leaderboard and visible to the other players,
Your score, rank and game statistics (battles_played, battles_won),
The session code (and the corresponding QR code / anglers://battle/... invitation link) that you share: anyone holding this code can join the session while it is open. These codes have a limited lifetime and are invalidated when the battle ends.

This sharing between players results from your decision to create or join a session; you can leave a battle at any time.

Public Battles. For Public Battles organized by FishMan, the list of registered players (username, profile photo) and the leaderboard are visible to all signed-in Users. For regional Battles, the “Show me on the map” option (on by default, can be turned off at any time in the Battle) shares your live GPS position (updated about every 45 seconds or 60 meters) with the other registered participants only; these positions are deleted at the end of the Battle.

If, at the end of a battle, you generate and share a score image to another app (TikTok / Instagram story or post, or the system share sheet), that sharing is initiated by you and governed by the privacy policy of the receiving third-party app. This image may contain your nickname, profile picture, best catch and the leaderboard.

3.9 Messaging (private messages and groups)

When you use messaging with your Friends, we process:

The content of your messages (text, share cards) and their timestamps,
The members and name of groups (up to 30 members),
Read receipts (time each member read the conversation), shown in direct conversations,
Your list of blocked Users.

Messages are accessible only to the members of the conversation. We do not read them and do not use them for advertising or to train AI models. New-message push notifications may show a preview of the message (up to 140 characters) on the recipient’s lock screen. Messages are not end-to-end encrypted: they are encrypted in transit and at rest on Google Firebase servers.

3.10 Contacts and phone number (“Find your friends”)

If you allow it (system permission to access contacts):

The phone numbers and email addresses in your address book are hashed on your device (SHA-256) before being sent: they never leave your phone in clear. Our servers only keep a fingerprint re-hashed with a secret key (HMAC-SHA-256), from which the original contact details cannot be recovered,
These fingerprints are used only to suggest the FishMan Users in your contacts and to let them know that you joined FishMan. They are never used for advertising,
At most 5,000 contacts are processed; syncing happens at most once a day and each sync replaces the previous one (contacts removed from your address book are erased).

If you link a verified phone number to your Account, or if your email address is verified, Users who have that number or address in their contacts can find you in the Application. Your number is never shown to other Users.

You can disconnect your contacts (immediate deletion of the fingerprints) and remove your phone number at any time from Settings > Messaging.

People in your address book who do not use FishMan cannot be identified by us: their fingerprint is not matched to any account and is not used for any other purpose.

When you share Content (including by sending it in a conversation), a public web page is created at fishman-app.com/s/… with a frozen copy of the Content: for a catch, the species, photos, size, weight, technique, date and your username / profile photo (except for catches in incognito mode); for a session, the region, statistics, photos and weather; for a battle, the players’ usernames, photos and scores; for a spot, its name, photo, region and species. These pages never contain GPS coordinates or the name of a private spot.

Your public profile (fishman-app.com/@username) may show, depending on your visibility settings: username, photo, city and postal code, level, statistics, up to 8 public catches, gear and fishing areas rounded to about 11 km.

These pages are accessible to anyone with the link and may be indexed by search engines. You can ask for a share link to be removed by writing to contact@fishman-app.com.

3.12 Product analytics and session recording (PostHog)

We use PostHog to understand how the Application is used and to improve it: usage events (screens viewed, features used, subscription flow), linked to your pseudonymous Account identifier (never your email) and to profile properties (Pro status, language, sign-up method, onboarding answers, offer variant shown).

A small share of sessions (about 10%, plus sessions where a purchase error or abnormal interaction occurs) may be visually recorded (session replay). All text, all images, the map and the camera are masked in these recordings, which are used solely to detect and fix usability issues and bugs.

The website’s public pages (share links, profiles) also record anonymous page-view events, linked to a random visitor identifier.

3.13 Emails

We send you transactional emails related to your Account and subscription (welcome, Pro or trial activation, cancellation, refund, billing issue) through our provider Resend. These emails are necessary for the performance of the contract.

We only send you news or commercial offers if you agreed to it at sign-up. You can withdraw this consent at any time by writing to contact@fishman-app.com.

3.14 Categories of data we DO NOT collect

Health data,
Sexual orientation, political, religious, or philosophical opinions,
Racial or ethnic origin,
Biometric data,
Bank card numbers or detailed financial data.

4. Purposes and Legal Bases of Processing

In accordance with Article 6 of the GDPR, each processing operation is based on an identified legal basis:

Purpose	Legal basis (GDPR)
Account creation and management	Contract performance (Art. 6.1.b)
Provision of Pro services	Contract performance (Art. 6.1.b)
Battle mode: multiplayer sessions, real-time leaderboard, sharing nickname/photo/score between players	Contract performance + consent (you create/join a session)
Purchase and management of battle credits	Contract performance (Art. 6.1.b)
Public Battles: registration, leaderboard, anti-fraud checks on catches	Contract performance (Art. 6.1.b) + legitimate interest (fair play) — Art. 6.1.f
Sharing your live position during a regional Battle	Consent — Art. 6.1.a (“Show me on the map” option, can be withdrawn at any time)
Public fishing sessions	Consent — Art. 6.1.a (you choose to make the session public)
Messaging between Friends	Contract performance (Art. 6.1.b)
Finding friends through contacts	Consent — Art. 6.1.a (contacts permission)
“X is on FishMan” notification sent to your contacts already registered, matching by verified number / email	Legitimate interest (helping people who know each other connect) — Art. 6.1.f; you can object by removing your number / writing to us
Phone number verification	Contract performance (Art. 6.1.b)
Share links and public profile	Contract performance (Art. 6.1.b) — sharing initiated by you, adjustable visibility
Nearby alerts (new spots near you)	Legitimate interest — Art. 6.1.f; can be turned off at any time
Transactional emails	Contract performance (Art. 6.1.b)
News and offers emails	Consent — Art. 6.1.a
Promotional offers and offer tests (introductory price, welcome offer)	Legitimate interest — Art. 6.1.f
Product analytics and masked session recording (PostHog)	Legitimate interest (service improvement, bug fixing) — Art. 6.1.f, with pseudonymized data and masking; consent where local regulations require it
Automated moderation of public photos (detection of minors)	Legitimate interest (protection of minors) + legal obligation — Art. 6.1.f and 6.1.c
Sharing a score image to a third-party social network	Consent — Art. 6.1.a (action initiated by the User)
Measurement and attribution of our advertising campaigns (TikTok)	Consent — Art. 6.1.a; otherwise aggregated attribution without identifier
Map and spot display	Consent (geolocation) — Art. 6.1.a
Species identification (AI Scan)	Contract performance
AI Coach	Contract performance
Personalized weather per spot	Consent (geolocation)
Push notifications	Consent — Art. 6.1.a
Targeted advertising (free version)	Consent — Art. 6.1.a
Audience measurement and usage statistics	Consent or legitimate interest (anonymization) — Art. 6.1.f
Security, fraud prevention	Legitimate interest — Art. 6.1.f
Content moderation	Legitimate interest — Art. 6.1.f
Compliance with legal obligations (accounting, judicial)	Legal obligation — Art. 6.1.c
Improvement of AI models proprietary to the Application	Legitimate interest, after pseudonymization
Response to GDPR rights requests	Legal obligation — Art. 6.1.c

5. Recipients and Data Processors

We never sell your personal data. We share certain data with processors strictly necessary for the operation of the Application, under Data Processing Agreements (DPA) compliant with Article 28 of the GDPR.

Processor	Service provided	Location	Safeguards
Google Ireland Ltd. (Firebase)	Authentication (including SMS phone verification), database (Firestore), Cloud Functions, notifications (FCM), Gemini AI (AI Scan, AI Coach, battle scoring, photo moderation), Crashlytics, Analytics, App Check, Remote Config, Storage	Ireland / EU + United States	Google DPA + EU Standard Contractual Clauses (SCCs)
RevenueCat, Inc.	Management of Pro subscriptions, offers and battle credits	United States	RevenueCat DPA + SCCs
PostHog, Inc.	Product analytics, masked session recordings	United States	PostHog DPA + SCCs
Resend, Inc.	Sending transactional emails (email address, first name / username)	United States	Resend DPA + SCCs
Google Ireland Ltd. (AdMob)	Advertising delivery (free version)	Ireland / United States	Google DPA + SCCs + user consent
TikTok Information Technologies UK Ltd. (TikTok Business / Events SDK)	Measurement and attribution of our advertising campaigns (installs, sign-ups, subscriptions; Account identifier and SHA-256 hashed email at sign-up)	Ireland / United Kingdom / United States	TikTok DPA + SCCs + user consent (ATT)
Meta Platforms Ireland Ltd. (Meta / Facebook App Events SDK)	Measurement and attribution of our advertising campaigns (installs, sign-ups, subscriptions, purchase amount) — iOS only	Ireland / United States	Meta Data Processing Terms + SCCs + user consent (ATT)
MapTiler AG	Cartographic tiles (receives the IP address and the map area displayed)	Switzerland	Switzerland adequacy decision
Environmental data providers: Open-Meteo (weather, air quality, geocoding), api-maree.fr and Fisheries and Oceans Canada (tides), Hub’Eau (water quality), iNaturalist and GBIF (species observations)	Weather, tide and species data for the place viewed	EU / Canada / United States	Receive only the coordinates of the place viewed and the technical IP address, never an Account identifier
OpenStreetMap Foundation	Cartographic data (ODbL license)	United Kingdom	UK adequacy decision
Apple Distribution International Ltd.	iOS distribution, payment collection	Ireland	Apple App Store terms + DPA
Google LLC (Google Play)	Android distribution, payment collection	United States	Google Play terms + SCCs
Google Firebase Hosting	fishman-app.com website hosting	Google Ireland (EU) + United States	Google DPA + SCCs

All our processors are bound contractually and undertake a level of protection compliant with the GDPR.

6. Transfers Outside the European Union

As FISHMAN LLC is established in the United States, your data is processed in the United States as well as by our processors located outside the EU (Google, RevenueCat, PostHog, Resend, TikTok, Meta). These transfers are framed by:

The Standard Contractual Clauses adopted by the European Commission (Decision 2021/914),
The EU-U.S. Data Privacy Framework for certified processors,
Additional technical measures (in-transit and at-rest encryption, pseudonymization),
Transfer Impact Assessments conducted on a case-by-case basis.

7. Retention Periods

Data category	Retention period
Active account	For the entire duration of use
Account inactive for 3 years	Deletion or anonymization
Account deleted by the User	Deletion within 30 days, except for legal retention obligations
Billing and transaction data	10 years (accounting obligations)
Technical and security logs	12 months maximum
Advertising data (identifiers, targeting)	13 months maximum
Public photos and Content	As long as the User does not delete them (then 30 days)
Customer support data	3 years after last contact
Messages and conversations	For the lifetime of the Account
Contact fingerprints	Replaced at each sync; deleted as soon as contacts are disconnected or the Account is deleted
Live positions during a regional Battle	Deleted at the end of the Battle
In-app notifications	60 days
Usage events and session recordings (PostHog)	According to PostHog’s retention policy, at most 24 months for events and 90 days for recordings

8. Security

We implement technical and organizational measures appropriate to the risks:

TLS 1.3 encryption for all client/server exchanges,
Passwords hashed and salted (Firebase Authentication, bcrypt algorithm),
AES-256 encryption for sensitive stored data,
Restricted and logged access to data,
Regular and redundant backups,
Periodic security testing,
Incident response plan and procedure for notifying breaches to the competent supervisory authority within 72 hours and to data subjects when necessary (Art. 33 and 34 GDPR).

8.1 Internal Governance and Compliance

The Publisher maintains the following governance documentation, in accordance with Articles 24, 30, 32, and 35 of the GDPR:

A Record of Processing Activities (RoPA) listing all processing operations, their purposes, legal bases, categories of data subjects, retention periods, and recipients,
A Data Protection Impact Assessment (DPIA) for processing presenting a high risk, in particular AI Scan, geolocation, and profiling features,
A breach management policy specifying the internal procedure for detection, qualification, and notification within 72 hours to the competent supervisory authority,
A retention policy reviewed annually,
An annual review of processors verifying the maintenance of an adequate level of protection (DPA, certifications, international transfers),
A documented procedure for handling rights requests.

These internal documents are available upon reasoned request from competent supervisory authorities.

9. Your Rights

In accordance with the GDPR, the CCPA, the LGPD, and equivalent laws, you have the following rights over your personal data:

Right of access (Art. 15 GDPR): obtain confirmation that data concerning you is being processed and obtain a copy,
Right to rectification (Art. 16): correct inaccurate or incomplete data,
Right to erasure or “right to be forgotten” (Art. 17),
Right to restriction of processing (Art. 18),
Right to object (Art. 21): object to processing based on legitimate interest or used for direct marketing,
Right to data portability (Art. 20): receive your data in a structured, commonly used, machine-readable format,
Right to withdraw consent at any time, without affecting the lawfulness of prior processing,
Right to define post-mortem directives on the fate of your data after death (French Law No. 2016-1321),
Right not to be subject to a solely automated decision with legal effect (Art. 22).

For California residents (CCPA / CPRA): you also have the right to know what categories of data are collected, sold, or shared (we do not sell any data), the right to deletion, the right to limit the use of sensitive data, and the right not to be discriminated against for exercising your rights.

You also have the right to opt out of the sharing of your data for cross-context behavioural advertising (Do Not Sell or Share My Personal Information). The sharing described in §5 with our advertising partners is not a sale, but does fall under “sharing” within the meaning of the CPRA. To exercise it: decline tracking at the App Tracking Transparency prompt on iOS — or at any time via iOS Settings > Privacy & Security > Tracking —, turn off ads personalisation in your Android device’s Google settings, or email us at contact@fishman-app.com and we will action your request within one (1) month.

9.1 How to exercise your rights

From the Application: Settings > Privacy > My data; Settings > Messaging (contacts, phone number, blocked accounts),
By email: contact@fishman-app.com — response within one (1) month, extendable by two months for complex requests,
By postal mail: FISHMAN LLC, c/o Republic Registered Agent LLC, 262 Chapman Rd, Ste 240, Newark, DE 19702, USA.

A proof of identity may be required if there is reasonable doubt about the identity of the requester, in accordance with Article 12.6 of the GDPR.

9.2 Complaint to a supervisory authority

If you believe your rights are not respected, you may lodge a complaint with the competent supervisory authority:

France: Commission Nationale de l’Informatique et des Libertés (CNIL) — https://www.cnil.fr/en/plaintes
Other EU countries: national data protection authority — EDPB directory: https://edpb.europa.eu/about-edpb/about-edpb/members_en
United Kingdom: Information Commissioner’s Office (ICO) — https://ico.org.uk
United States (California): California Privacy Protection Agency — https://cppa.ca.gov

10. Minors

The Application is not intended for children under 16 years of age in the EEA, under 13 years of age in the United States (COPPA), or under the equivalent minimum age applicable in each country.

We do not knowingly collect data from children below this age. If you are a parent or legal representative and find that your child has provided data without authorization, contact us at contact@fishman-app.com to delete it.

11. Automated Decisions and Profiling

The Application uses automated models for:

Species identification (AI Scan) — purely indicative result, with no legal effect,
Battle catch scoring (species validation, confidence threshold, duplicate detection),
Automated moderation of public photos (catches, spots), which detects in particular the faces of minors: a photo flagged with high confidence is removed automatically, other cases go to human review. You can contest a removal by writing to contact@fishman-app.com and obtain a human review,
Automated moderation of reported Content — human review is guaranteed before any final sanction (suspension, account deletion).

None of these decisions produce legal effects or significantly affect you within the meaning of Article 22 of the GDPR.

12. Cookies and Trackers

The Application and the fishman-app.com website use trackers under the conditions described in our Cookie Policy: https://fishman-app.com/legal/cookies.

13. Modifications to the Policy

We may modify this Privacy Policy to reflect regulatory, technical, or commercial developments. Any substantial modification will be notified by email to the address associated with the Account and/or by in-app notification at least 30 days before taking effect.

The date of last update appears at the top of the document.

14. Contact

Dedicated data protection email: contact@fishman-app.com
Postal address: FISHMAN LLC, c/o Republic Registered Agent LLC, 262 Chapman Rd, Ste 240, Newark, DE 19702, USA

Legal Notices

Publisher

The Application and the fishman-app.com website are published by FISHMAN LLC, a limited liability company organized under the laws of the State of Delaware (USA).

Company name: FISHMAN LLC
Legal form: Limited Liability Company organized under the laws of the State of Delaware (USA)
Registration: Delaware Division of Corporations, File Number 10734943
Registered office: 262 Chapman Rd, Ste 240, Newark, DE 19702, USA
Registered agent: Republic Registered Agent LLC, 262 Chapman Rd, Ste 240, Newark, DE 19702, USA
Email: contact@fishman-app.com
Website: https://fishman-app.com

Hosting

Application (backend): Google Firebase / Google Cloud Platform — Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
Public pages (share links, profiles): Google Firebase Hosting and Cloud Functions — Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.
Website: Google Firebase Hosting / Google Cloud Platform — Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

Intellectual Property

All elements of the Application and the fishman-app.com website (texts, images, logos, graphics, icons, sounds, videos, source code) are the exclusive property of FISHMAN LLC or its partners. Any reproduction, representation, modification, publication, transmission, or full or partial exploitation without prior written authorization is prohibited and constitutes infringement subject to penalties under intellectual property law.

The FishMan trademark and logo belong to FISHMAN LLC.

Credits

Weather: Open-Meteo (CC BY 4.0). Tides: api-maree.fr, Fisheries and Oceans Canada. Species observations: iNaturalist, GBIF.
AI: Google Gemini.
Typeface: Urbanist (Google Fonts, OFL license).