Version 2026-10-06-v6 · FishMap public beta · designed for the UK GDPR, Data Protection Act 2018 and PECR as amended by the Data (Use and Access) Act 2025.
FishMap is operated by an individual UK data controller. For privacy, data-rights and support enquiries, contact fishmapsupport@gmail.com. The controller's legal name and postal correspondence details are available on request through this address.
Depending on the features you use, FishMap may process your email address through authentication; username and profile fields; age band (13–17 or 18+); catches and sessions; favourites; custom fishing locations; account-scoped app preferences such as theme, map style and saved favourite details; optional precise coordinates attached to your own catch/session; profile photo and catch photos; posts, comments, reactions, follows, friendships, friend-sharing preferences, sanitised friend-comparison summaries, groups, blocks, private friend messages and reports; support/privacy requests; and security/technical logs produced by hosting providers.
FishMap deliberately separates precise catch/session coordinates from social content. Exact coordinates are private account data and are not included in community posts or friend-comparison snapshots. Friend comparison is opt-in and uses separate sanitised summaries; venue names require a separate opt-in.
| Purpose | Typical lawful basis |
|---|---|
| Create and operate your account, automatically sync your journal/preferences while signed in, friendships, optional friend comparisons, private friend chat, groups and features you request | Contract / steps at your request |
| Security, abuse prevention, service integrity and proportionate moderation | Legitimate interests; legal obligation where applicable |
| Age band and enhanced privacy safeguards for younger users | Legitimate interests in protecting users and complying with applicable child-data duties |
| Optional product marketing | Consent; off by default and withdrawable |
| Optional page and feature-use analytics | Consent; off by default and withdrawable |
| Responding to privacy/data-rights requests | Legal obligation and/or legitimate interests |
Device/browser permission to use geolocation is separate from the data-protection lawful basis. FishMap only requests device location when you use a location-related feature.
Profiles start private. Exact catch locations are hidden from social features. Users aged 13–17 receive enhanced privacy prompts and high-privacy defaults. Friend comparison is off by default and venue-name sharing has its own switch. Private friend messaging is available only between accepted 18+ friends during the public beta. FishMap does not include targeted advertising or behavioural advertising profiles.
FishMap uses local browser/device storage for essential app functionality, preferences, offline caching and authentication. Optional Google Analytics records page views and limited feature-use events only after analytics consent. A separate optional advertising-measurement choice enables Google Ads cookies and signup measurement to understand which adverts lead to new accounts. Existing analytics consent does not enable advertising measurement. Google tags load only after you accept a measurement option. Ad personalisation and Google Signals remain disabled. FishMap does not send account IDs, email addresses, catch details, photos or private notes as measurement event parameters. Google may receive network/device information, page URLs and advertising click identifiers when measurement is enabled. Signup measurement is not sent for users selecting the 13–17 age band.
Advertising-measurement preferences apply to this browser/device. You can change your choices here or in Profile & account → Privacy. Withdrawal stops future FishMap measurement events for the declined purpose and clears the relevant first-party measurement cookies; it does not erase data already received by Google.
FishMap uses Supabase for authentication/database/storage, Netlify for hosting/server functions and, according to your choices, Google Analytics 4 and Google Ads for optional measurement. Mapping, imagery, weather and location-search services may also receive normal network information such as your IP address when their resources are requested. The production service must maintain appropriate processor arrangements.
Where information is transferred outside the UK, FishMap will rely on an applicable UK adequacy regulation or another lawful safeguard, such as the UK International Data Transfer Agreement/Addendum, where required.
Account/journal data, friendship records and private friend messages are kept while your account remains active unless you delete the account or another retention rule applies. Resolved support and moderation records are configured for deletion after 12 months; resolved data-protection complaints after 24 months; notifications after 180 days. Active account deletion removes database records and private stored media; infrastructure backups may persist until the provider's normal backup cycle expires. Legal/security records may be retained longer where necessary and lawful.
Depending on the processing, UK data-protection law may give you rights to be informed, access information, correct it, erase it, restrict processing, object, and receive portable data. FishMap includes profile correction, machine-readable export and account-deletion tools. You can withdraw optional marketing/analytics consent as easily as you give it. Rights are not absolute in every circumstance.
FishMap does not permit account creation by children under 13. Because the service may be used by people under 18, it is designed around the ICO Children's Code: high privacy by default, minimised collection, no automatic social location disclosure and no nudges to weaken privacy. Parents/carers and younger users can use the support/privacy channel for questions.
FishMap administrators can access aggregate user counts, limited profile identifiers needed for administration, public community content, reports and information a user deliberately submits to support. The database does not give admins a blanket read policy for private catches, sessions, custom locations, precise catch coordinates or private message inboxes. If a participant reports a private message, only that reported message is copied into the moderation report for review. Passwords are handled by the authentication provider and are never readable by FishMap administrators.
Fishability, Catch Score and Session Score are recreational planning/statistics features. They are not used to make legal or similarly significant decisions about people.
You can make a data-protection complaint in the app under Profile & account → Privacy & support → Data protection complaint, or email fishmapsupport@gmail.com. FishMap will investigate appropriately and communicate the outcome without undue delay. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint/.
FishMap is currently a public beta. Beta status does not reduce your privacy rights. Material privacy changes will be presented clearly, and choices requiring consent will not be silently enabled after an update.
If you choose to report inaccurate venue information, FishMap stores the location being reported, the correction you submit, a snapshot of the venue information shown at the time, your account identifier, the review status and any administrator review note. FishMap uses this to verify and improve venue data. An approved report adds one Contribution Point to your profile. Contribution Points may be visible wherever your FishMap profile is visible; the report text and review material are not made public.