Last updated 27 September 2026 · Draft
Draft for review, not legal advice. Have this reviewed before you publish it. Placeholders are in
[square brackets]. Items marked ⚠️ are open questions to resolve before launch.
Privacy policy
Castabout is a fly-fishing app for finding water, checking conditions and keeping a fishing journal, on the web, iPhone and Android. It’s run by [your legal name], an individual developer based in Australia (“we”, “us”). This policy explains what personal information we collect, why, who processes it, and the choices you have.
We collect as little as we can. You can browse waters, species, flies and conditions without an account.
What we collect
When you sign in with Apple or Google, we receive your email address, and your name if you choose to share it. With Sign in with Apple you can hide your email; we then receive a private relay address from Apple. We never see or store a password.
What you add to the app
- Profile settings: display name, home region, units, notification choices.
- Favourites: the waters and flies you save to lists.
- Journal entries: which water you fished, when, for how long, and your notes.
- Catch records: species, length, weight, whether it was released, the fly used, the time, and the catch location if you add one.
- Photos you choose to attach to a catch. Before a photo is uploaded, the app removes its embedded metadata, including GPS location. The location saved with a catch is stored separately and is private by default.
Device and usage information
- A push notification token, if you allow notifications, so we can send the alerts you’ve turned on.
- Usage analytics: which screens and features are used and basic device information (platform, app version, language, approximate country). We use this to improve the app. We don’t sell it, don’t use it for advertising, and don’t track you across other apps or websites.
- Error reports when the app crashes, so we can fix problems.
Location from your device is used only when you ask for it: to show waters near you, or to fill in where you caught a fish. The app doesn’t track your location in the background.
What we don’t collect: payment details, contacts, or anything from other apps.
Why we use it
| Purpose | Information used |
|---|---|
| Keep your account and sync your favourites and journal across devices | Account, profile, favourites, journal and catch records, photos |
| Send notifications you’ve turned on (season openings, changes at your saved waters) | Push token, favourites, notification settings |
| Send account emails (welcome, account deletion confirmation, an opt-in digest) | Email address |
| Understand how the app is used and fix problems | Usage analytics, error reports |
| Keep the service secure and prevent misuse | Account and technical logs |
We don’t use your information for advertising, and we don’t sell or rent it to anyone.
Who processes it for us
We use these providers to run the app. Each processes information only to provide its service to us.
| Provider | What it does | Where data is held |
|---|---|---|
| Supabase | Accounts, database and photo storage | Sydney, Australia (AWS) |
| Cloudflare | Hosts the website and app content; delivers maps | Global network |
| PostHog | Usage analytics and error reports | United States |
| Resend | Sends account emails | United States |
| Expo (650 Industries) | Delivers app updates and relays push notifications | United States |
| Apple and Google | Sign-in, and push notification delivery to your device | United States and their global networks |
| Esri | Satellite imagery on water cards and pages, and the map’s Satellite view; receives your IP address with each imagery request | United States |
Some of these providers store or process information outside your country (see Overseas storage below).
Your choices and rights
In the app, under Profile, you can:
- See and change your profile and settings at any time.
- Export your data as a file containing your journal, catches and photos.
- Delete your account. This permanently removes your account, profile, favourites, journal, catches and photos. Deletion from backups happens within [30] days.
You can also turn off notifications, deny or revoke location, camera and photo access in your device settings, and use the app without signing in.
You can ask us for a copy of your information, ask us to correct it, or complain about how we’ve handled it, by emailing privacy@castabout.app. We’ll respond within 30 days.
Overseas storage
Your account data is stored in Australia. Some providers above process information in other countries, mainly the United States. We choose providers that protect personal information to a standard comparable to the privacy laws that apply to you.
- Australia: the Australian Privacy Principles (APP 8).
- New Zealand: the Privacy Act 2020 (IPP 12).
- Canada: PIPEDA and provincial laws.
Quebec residents: we assess the privacy implications before your information is communicated outside Quebec, as the Act respecting the protection of personal information in the private sector requires. ⚠️ Complete and keep the written assessment before the Canadian launch.
How long we keep it
We keep your account information until you delete your account. Usage analytics are kept for [12] months. Technical logs are kept for up to [7] days. Backups are kept for up to [7] days.
Security
Only you can read your journal, catches and photos: access is enforced by the database itself, not just the app. Data is encrypted in transit. Photos are stored privately and shown only through short-lived links. If a data breach is likely to cause serious harm, we’ll notify you and the relevant regulator as required by Australian, New Zealand and Canadian law.
Children
The app isn’t directed at children under 13, or under 14 in Quebec, and we don’t knowingly collect their information. If you believe a child has created an account, contact us and we’ll delete it.
Person responsible and contact
The person responsible for protecting personal information is [your legal name], contactable at privacy@castabout.app.
If you’re not satisfied with our response, you can complain to:
- Australia: the Office of the Australian Information Commissioner.
- New Zealand: the Office of the Privacy Commissioner.
- Canada: the Office of the Privacy Commissioner of Canada, or in Quebec, the Commission d’accès à l’information.
Changes
We’ll update this policy when our practices change and show the date at the top. For significant changes, we’ll tell you in the app before they take effect.
⚠️ Open questions before launch
- PostHog identification. The region is decided (US cloud). Still to decide: whether analytics identify signed-in users. Quebec’s Law 25 requires features that can identify, locate or profile a person to be off by default. Consider anonymous analytics until the user opts in, at least for Quebec.
- Backup and analytics retention periods. Confirm them against the actual Supabase plan and PostHog settings.
- Quebec privacy impact assessment. Write it before the Canadian launch.
- Privacy contact email. Set it up once the domain exists.