Draft — not a binding policy
This text has not been reviewed by a lawyer. It is published so the behaviour it describes can be checked against the implementation, and it must not be relied on as a binding privacy policy. Legal review is a blocking task before any app store submission.
It is written from the implemented data model and the declared SDK set, and it must be re-verified against the final release build before submission.
The default is on-device
The core experience — lake selection, condition entry, plan generation, gear locker, cached plans, and catch logging — works entirely in guest mode, with no account and no server-side user record. Data leaves your device only when you create an account and enable sync.
There is no advertising SDK, no analytics SDK, no crash-reporting SDK, no attribution SDK, no advertising identifier access, and no cross-app tracking of any kind.
What is collected
| Category | Collected | Where it lives | Linked to you | Purpose |
|---|---|---|---|---|
| Email address | Only if you create an account | Authentication provider | Yes | Sign-in and account recovery |
| Preferences (units, privacy defaults, wind thresholds) | Yes | Device storage; server only if sync is on | Yes when synced | App functionality |
| Coarse location | Only when you tap a location action | Device; sent to the API to resolve conditions | No | Find nearby lakes, fetch weather and water data |
| Precise location | Only when you log a catch location or pick a lake precisely | Device storage; server only if sync is on | Owner-only | Your private catch records |
| Saved lakes and gear locker | Yes | Device storage; server if sync is on | Yes when synced | App functionality |
| Catch logs and photos | Yes; photos only if you attach one | Device; private object storage if sync is on | Owner-only | Your own records |
| Recommendation requests and plans | Yes | Server | Pseudonymous for guests | Auditability, caching, support |
| Exposure events (plan shown, product shown, rigged, minutes fished, bites, landed) | Yes | Server | Pseudonymous | Quality data for future evaluation |
| Diagnostic logs | Yes | Server | No — scrubbed | Debugging |
Location
- Foreground only. No background location permission is requested anywhere.
- Permission is requested in context, when you tap a location-dependent action, with an explanation shown before the system prompt.
- Coarse precision by default. Precise location is requested only where the feature genuinely needs it.
- Denying permission never blocks the app. Manual lake selection and manual coordinate entry remain fully available.
Exact catch coordinates
These are treated as the most sensitive thing the app holds, because an angler's productive spots are personal. They are private by default and owner-restricted at the authorization layer, stored in a separate table from the catch record, and excluded from every aggregate or analytics payload. Shared or exported summaries carry no coordinates, or a generalised zone, unless you explicitly opt in for that share.
What is never logged
Structured logs and API error responses are scrubbed of location at any precision, email addresses, user identifiers, free-form notes, and photo references. Logs carry a correlation identifier and nothing that identifies a person.
Who else receives data
| Recipient | Data sent | Notes |
|---|---|---|
| National Weather Service (NOAA) | Lake coordinates only | Public API; identifying user agent per their policy; no user identifier |
| USGS Water Data | Lake coordinates only | Public API; no user identifier |
| Authentication and sync provider | Authentication data and synced user data | Only if you create an account |
| Map provider (Apple Maps on iOS, Google Maps on Android) | Map tile requests | Platform-standard |
Coordinates sent to weather and water providers are lake coordinates, not your device position, and carry no user identifier. There is no data broker, no ad network, and no analytics vendor in this list.
The optional AI assistant
The assistant is disabled by default, and every listed assistant capability works without it through deterministic parsing and templates. If an operator configures a provider key, the assistant may send your message text and the structured session state to that provider. It must not send catch coordinates, your email, or photos. Enabling it is a per-deployment decision that must be reflected in store privacy declarations first.
Your controls
- Export your data — Settings, Export data. The archive covers profile, preferences, gear, catches, private locations, photo references, waypoints, saved lakes, and feedback.
- Delete your account — Settings, Delete account, or the web deletion page if you have uninstalled the app or lost access to your device.
- Clear local guest data — Settings, Clear local data. For a guest, that is the complete extent of your data.
- Revoke location — in your operating system settings. The app degrades to manual entry.
Retention
The app does not expire your content: gear, catches, and waypoints persist until you delete them or delete your account. Deletion means deletion, not deactivation — see the deletion page for exactly what is removed, what is retained, and the timing.
Children
The app is not directed at children and no child-specific data is knowingly collected.
Known gaps
These are open and tracked, not hidden:
- This map must be re-verified against the final mobile SDK set — a transitive dependency could introduce collection not listed here.
- The iOS privacy manifest and required-reason API declarations must be generated and verified for the shipped SDK set.
- Legal review of this text against the data map.
- The placeholder policy URL must be replaced with a real, reachable one.
Contact
Privacy questions go to support@deadstarlabs.com.