Last updated 10 October 2026
Privacy policy
Castabout is a fly-fishing app for finding water and checking conditions, with account and fishing-record features being developed. It’s operated by Brillyance, based in Australia (“we”, “us”). This policy explains what information we collect, how we use it and your choices.
You can browse waters, species, flies and conditions without an account. We don’t sell or rent your personal information or use it for advertising.
Information we collect
The information collected depends on the features available in your version of Castabout and how you use them.
- Account information: when you sign in, we receive identifiers from your sign-in provider, your email address and any name the provider supplies. Apple can provide a private relay email address if you choose to hide your email. We don’t receive your Apple or Google password. For accounts provided with email/password access, Supabase processes the email address and password to authenticate you.
- Information you provide: messages you send us and, where the relevant features are available, profile preferences, favourites, journal entries, catch records, photos and locations you choose to save with a catch. Fishing records and photos are private by default.
- Usage and technical information: pages and features used, searches and filters, device and app information, and identifiers used to understand usage. When you sign in, we send your Castabout account ID and email address to PostHog to link usage to your account and understand how the app is used. Our service providers also receive technical information such as your IP address when your device requests content. Browsing without an account does not prevent these requests or usage measurement.
- Device location: with your permission, Castabout uses your location to show your position and nearby waters. If permission has already been granted, it can obtain your location when you return to Explore, and it updates your position on the map while the map is open. It does not track your device location in the background.
- Approximate location: if you haven’t shared your device location, Castabout asks our web host for an approximate location derived from your IP address (country, state or province, and a point accurate to about 10 km) so the map and nearby waters start in the right place. It is used on your device and not saved to your account.
You choose what to include in messages and fishing records. Avoid adding someone else’s personal information unless you have a lawful reason to do so.
How we use information
We use information to:
- Provide sign-in and the features you choose to use.
- Store and retrieve account information and any fishing records you add.
- Respond to support requests and communicate about your account or material service changes.
- Understand how Castabout is used, improve features and investigate technical problems.
- Protect accounts, prevent misuse and meet applicable legal obligations.
We do not use your private fishing records or photos in advertising, and we do not use analytics to track you across unrelated apps or websites.
Cookies and device storage
Castabout stores information on your device to keep you signed in, remember settings and cache content. The website uses browser storage, including local storage and IndexedDB; the native apps use on-device storage. Analytics also uses stored identifiers and event information.
You can clear website data through your browser settings. Doing so can sign you out and remove saved settings or cached content. Clearing local data does not delete information held in your online account. Some features may not work if you block storage.
External services, including Apple and Google sign-in, have their own policies about cookies and similar technologies when you use their services.
Service providers and overseas processing
We use providers for hosting, authentication, analytics, app delivery, maps and weather. They receive information needed for those functions. Our account database is hosted in Sydney, Australia. Other processing takes place outside Australia, including in the United States and Norway, and through providers’ global networks.
| Provider | Role and relevant information | Location |
|---|---|---|
| Supabase | Authentication and account database; storage for fishing records as those features become available | Sydney, Australia, for the project database |
| Cloudflare | Website, content and map delivery; receives technical request information | Global network |
| PostHog | Product usage analytics, including page views, searches and feature interactions, linked to your account ID and email when signed in | US cloud |
| Expo (650 Industries) | App update delivery; receives technical request information | US-based provider; delivery infrastructure may be global |
| Apple and Google | Sign-in information and authentication | US-based providers with global operations |
| Esri | Satellite imagery; receives technical requests such as IP address and requested imagery | US-based provider |
| MET Norway | Weather forecasts; receives technical requests including IP address and the requested forecast location | Norway |
| Google Fonts | Fonts on our legal pages; receives browser requests | Google’s global infrastructure |
The locations above describe known hosting or provider locations. Logs, support access and subprocessors can involve other countries. Our use of overseas providers is subject to any safeguards required by applicable privacy law.
Other disclosures
We do not publish your private fishing records to other users. Any future sharing feature will require you to choose to share.
We may disclose relevant information where required by law, to respond to a valid legal request, or where permitted by law and reasonably necessary to investigate fraud, protect accounts or address a threat to safety. We limit such disclosures to what is necessary for the purpose.
If Castabout is sold or transferred, information needed to continue the service may be transferred to the new operator, subject to applicable law and appropriate confidentiality and security safeguards. We will notify you of a change of operator and any material change in how your information is handled, and obtain consent where required. This is not permission to sell your information to advertisers.
How long we keep information
Retention depends on the information and why it is needed. Account information and saved records support your account; support correspondence is retained to resolve enquiries; technical and usage records support security, troubleshooting and product improvement. Applicable legal requirements can also affect retention.
Usage analytics are kept for up to one year under our analytics provider’s retention period. Signed-in activity is linked to your Castabout account ID and email address. Signing out stops subsequent activity being recorded under that account; it does not delete earlier analytics. In-app account deletion does not automatically delete PostHog records. To request their deletion, contact privacy@castabout.app. Analytics do not store your IP address.
When information is no longer needed for those purposes, we delete it or de-identify it. Deleting an account does not necessarily erase every copy immediately: limited records may need to be retained for legal or security reasons, and backup copies follow their retention cycle. Retained information remains subject to access restrictions. You can contact us for information about retention or to request deletion.
Your choices and requests
You can browse without an account and change location permissions in your device or browser settings. Declining location access does not prevent you from browsing the catalogue.
You can delete your account at any time in the app: open Profile, then Delete account. This permanently deletes your account and the information saved to it. How to delete your account explains the steps, including how to ask us if you can no longer sign in.
To request access to, correction of or deletion of your personal information, contact privacy@castabout.app. We may need to verify your identity before acting, using only information reasonably needed for that check. We’ll respond within the time required by applicable law and explain any lawful reason we cannot fulfil a request, together with available complaint options.
Security
We use access controls and encrypted connections to protect personal information. Private account records are restricted from access by other users. Authorised administrative or provider access can still be necessary to operate the service, investigate problems or meet legal obligations.
No online service can guarantee absolute security. Keep your devices and sign-in account secure, and contact us if you suspect unauthorised access. We will notify affected people and regulators about a breach when applicable law requires it.
External websites
Castabout links to websites such as official fishing rules and access information. Those sites handle information under their own privacy policies. This policy describes Brillyance’s handling of information through Castabout.
Children
The app isn’t directed at children under 13, or under 14 in Quebec, and we don’t knowingly collect their personal information. If you believe a child has created an account, contact us so we can investigate and arrange deletion where appropriate.
Privacy contact and complaints
For privacy enquiries or concerns about how Brillyance handles your personal information in Castabout, contact privacy@castabout.app.
If you’re not satisfied with our response, you may contact the relevant privacy regulator for advice or to lodge a complaint. Which regulator can consider your complaint depends on the privacy laws that apply.
Changes
We’ll update this policy when our practices change and show the date at the top. For significant changes, we’ll provide notice in the app or by email before they take effect where practical. Where a new use of information requires consent, we’ll ask for it; updating this policy does not by itself provide that consent.