Privacy Notice

What we collect and why

• Account details — email address, display name and login credentials, to create and secure your account and to contact you about your subscription. Legal basis: performance of our contract with you.
• Fishing data — catches, weights, notes, photos, fishing spots, stands and GPS coordinates you save, to provide the log, maps and insights you signed up for. Legal basis: performance of our contract.
• Subscription and entitlement records — plan status, trial dates, renewal dates and who shares your subscription, to give you the right level of access. Legal basis: contract and legal obligation.
• Support messages — anything you send us through the in-app "found a problem" form, to answer you and fix bugs. Legal basis: legitimate interests.
• Technical and usage data — device type, browser, IP address, app version, error logs, onboarding steps completed and sign-in activity, for security, fraud prevention, troubleshooting and improving the app. Legal basis: legitimate interests.
• Email we send you — transactional email only: email confirmation and password resets, shared-subscription invites, free tester access details, payment problem notices and important service notices. We do not send marketing email and there is no mailing list to unsubscribe from. Legal basis: performance of our contract.

Payment card details are collected and processed by Paddle, not by us — we never see or store your card number.

Who we share it with

• Paddle, our Merchant of Record and reseller, for the sale of the subscription, payments, subscription management, invoicing and tax compliance.
• Service providers (subprocessors) — our hosting, database, storage and email delivery providers, which process data on our instructions to run the app.
• The angler who shares your subscription — if you invite a second angler, they can see the spots, stands and catches covered by that subscription. Only invite someone you want to share your fishing data with.
• Professional advisers — legal and accounting advisers where needed.
• Authorities — where we are required to disclose by law.

We do not sell your personal information. Some of our providers store data outside New Zealand; where that happens we use providers that offer comparable safeguards to New Zealand privacy law, backed by contractual protections.

How long we keep it

We keep your account and fishing data while your account is open. If you cancel or your access lapses, we keep it for up to 24 months — two whitebait seasons — so your history is still there if you come back. After that an automated clean-up job runs daily and deletes your catches, spots, stands, sessions, photos and analytics, and anonymises your profile. Ask us and we will delete it sooner.

Error reports and security audit entries are deleted automatically 90 days after they are recorded; short-lived abuse-protection records are cleared after seven days. Billing and tax records are kept for seven years as New Zealand law requires.

Security

Data is encrypted in transit, photos are stored in private buckets that are not publicly readable, and every table is protected by row-level access rules so only you and any angler on your subscription can read your records. Access to production systems is restricted to the developer operating the service.

Your rights

You can ask us to access, correct, export or delete your personal information, or object to a particular use. Email jimmyrobinson08@gmail.com and we will respond within 20 working days. If you are not satisfied you can complain to the New Zealand Office of the Privacy Commissioner at privacy.org.nz. If you are in the UK or EEA you also have GDPR rights of access, rectification, erasure, restriction, portability and objection, and may complain to your local supervisory authority.

Cookies, on-device storage and tracking

Whitebait Log does not use advertising cookies, third-party analytics or cross-site tracking, and there is no tracking pixel or ad network in the app. We do not need a cookie consent banner because nothing we store on your device is used for advertising or profiling. What we do use is:

• Sign-in storage (essential) — your login session is held in your browser's local storage, not in a cookie, so you stay signed in between visits. It also records a device identifier so you can see and log out individual devices.
• App preferences (essential) — small entries remembering your last fishing spot and monitoring site, forecast view, setup progress, dismissed prompts, and your email address if you tick "remember me on this phone".
• Offline store (essential) — catches, spots, stands and river readings saved on your device so the app works with no signal, plus a queue of changes waiting to sync. This clears once everything has synced or when you clear app storage.
• Offline app cache (essential) — a service worker stores the app files so it opens without coverage. It caches no personal data.
• Paddle checkout (functional) — when you open the checkout we load Paddle's script from cdn.paddle.com and Paddle may set its own cookies to run and secure the payment. Those are governed by Paddle's own privacy notice.
• Map tiles — maps are drawn with tiles from OpenStreetMap, so your device's IP address is visible to them when a map loads. No account or fishing data is sent with the request.

We do keep our own first-party usage records inside the app's database — sign-in activity, onboarding steps completed, error reports and sync logs — described under "Technical and usage data" above. These are not shared with any advertiser or analytics company.

Clearing your browser or app storage removes everything held on your device, including any catches that have not yet synced.

Location permission

The app asks for your device location only when you tap "use my location" to pin a fishing spot or a catch. We store the coordinates you choose to save, we never track your location in the background, and you can decline the permission and drop pins on the map by hand instead.

Contact

4M Asset Hire Ltd, 18 Gorton Street, Gore 9710, New Zealand — jimmyrobinson08@gmail.com.