# Privacy Policy, BC Fish Map **Last updated: October 2, 2026** BC Fish Map (the "App") is operated by **33knots** ("we", "us", "our"). Contact: **thirtythreeknots@gmail.com**. **Short version:** a fisherman's spots and catches are sacred. The App works with no account at all. Your spots, catches, sonar imports and licence copy stay **on your device** and are never uploaded. The App runs **usage analytics** through PostHog (described in Section 7): a random ID stored on your device (not tied to your name or email), no coordinates, no spot data, and no cookies. PostHog also receives your IP address. There are no ad trackers, no profiling, and we never sell your data. Beyond that, two things leave your device, and only if you choose them: an optional account (sign-in), and beta tester feedback when you press Send. --- ## 1. The core App collects nothing There is **no account and no login required to use the App**, and nothing you create in it is transmitted to us. Stored **only on your device**, in browser storage or on-device IndexedDB: - **My Spots** and your **catch log**, including any notes you add. - **Imported sonar depth logs and GPS tracks** (GPX / CSV). These stay on the device and are drawn only for you. They are never uploaded, never merged into anyone else's map, and never shared. - **My Licence**: your licence number(s) and, if you add one, a **photo of your licence**. The photo never leaves the device. That whole feature makes no network requests of any kind. - **My Species** favourites, your settings (mode, theme, alert preference), and whether you finished onboarding. - **Waters you follow**, and whether you're on **Catchable Pro** (including a redeemed promo code, checked only by its format, never sent anywhere). Following a water only decides what the App shows you first; it is never sent anywhere and never affects a verdict. - **A tide calendar year** for a station you've opened the calendar for, cached on-device (in the same on-device IndexedDB as the rest of this list) so it keeps working offline. It's public tide-prediction data, not personal, and you can remove it any time from the calendar. Clearing the App's data deletes all of it permanently. We hold no copy, so there is nothing for us to return, correct or delete. ## 2. Optional account (sign-in) Signing in is **optional** and the App is fully usable without it. It exists so your beta comments can carry your name, and for future paid features. Sign-in is handled by **Clerk**, a third-party authentication provider, using **Sign in with Apple** or **Sign in with Google**. If you sign in: - **Clerk receives** your email address and the identity information Apple or Google returns to it, and creates an account record on Clerk's systems, under **Clerk's own privacy policy**: . - **We receive** your Clerk user id and email, and use them only to attribute your feedback and, in future, your entitlements. We do not use them for marketing. - The Clerk sign-in code is loaded from the **jsDelivr** public CDN when you open the sign-in screen. If you never sign in, none of the above happens. ## 3. Beta tester feedback (Guide Class), beta testers only This section applies **only** to the invite-only beta build, and **only** when you deliberately send a comment. It does not exist in the public App. When you tap Send on a comment, this is uploaded to our **Cloudflare D1** database: - the **comment text** and the category you picked, - a **screenshot of the map** as it looked, - the **general area you tapped, rounded to about 100 m (3 decimal places), never the exact spot**, and the screen position of the tap, - which **panel was open**, the **selected species**, and a short **snippet of the verdict card** on screen, - your **browser user agent**, theme, mode and the **app version**, - your **invite code**, and your Clerk user id if you are signed in. **Nothing is sent unless you press Send.** Closing the comment window discards the capture. If you are offline the comment is held on your device and retried later, and you can clear it by clearing App data. Redeeming an invite code also stores a tester record: the **code**, your **Clerk user id** and **email** if you are signed in. We use all of this only to fix the App, and we delete it when the beta ends. ## 3a. Report a problem (everyone, public App) Every tap card and the map's long-press menu have a **"Report: something wrong here?"** button. It is public and needs no sign-in and no invite code. **Nothing is sent unless you press Send.** When you send a report, this leaves your device: - the **category** you picked (wrong regulation, boundary wrong, missing water, app bug, other) and your **free-text note**, - the **general area you tapped, rounded to about 100 m (3 decimal places), never your exact spot**, and the current **map zoom**, - the **water name, selected species, and the verdict and rule text the card was showing you** at the moment you reported it, read straight off the screen you saw, never recomputed and never anything from the regulation engine itself, - your **app version, mode (freshwater/tidal), browser user agent and the date**, - an **optional photo**, resized on your device before it is sent. If you are offline, the report is held on your device and retried automatically. A report **never changes any regulation, boundary or verdict**: it only queues for a person (Sam) to read. A human looks at the category, note, coarsened location, and the verdict/rule text you saw, decides whether the App needs a fix, and marks the report reviewed once it's been looked at; that triage step is a local, operator-only log and never edits the report, your submission, or any regulation data. We keep reports to improve the App's accuracy and delete them once they've been reviewed and are no longer useful for that. ## 4. Location Your location is used **on your device** to centre the map and work out local conditions. We never collect, transmit or store a track of where you are or where you fish. Two narrow exceptions, both about the point you are looking at rather than where you are: - Weather and tide lookups send that point's coordinates to the providers in Section 6. - In the beta, a comment you choose to send includes the coordinates of the spot you tapped (Section 3). ## 5. Closure alerts (optional, opt in) If you turn on closure and opening alerts, your browser creates an anonymous **push subscription**: a random endpoint URL and cryptographic keys. We store **only that**, so we can send you DFO closure and opening notices. It contains **no name, no email, no account link and no location**, and we store nothing alongside it. Turn alerts off to stop them; ask us and we will delete the stored subscription. We never share it. Alerts are still being switched on. Until they are, the button in the App says so and nothing is stored. ## 6. What third parties receive when the App fetches data To work, your device requests data directly from these services. Each one necessarily sees your device's **IP address** and what was requested, under **their own privacy policies**, not ours. We do not receive or store any of it. - **Esri / ArcGIS Online**: basemap, satellite and hillshade tiles. The tiles requested reveal the **map area you are viewing**. - **Fisheries and Oceans Canada (DFO)**: nautical chart tiles, tide predictions (IWLS), fishery notices and regulation pages. Tide lookups send **the coordinates of the point you are checking**. Opening the Pro tide calendar for a station makes one additional request, by **station id only, never coordinates**, to fetch that station's whole year of high/low predictions for the on-device cache described in Section 1. - **Environment and Climate Change Canada (ECCC)**: current wind/wave conditions, river levels, marine-area forecasts and marine warnings. Sends **the coordinates of the point you are checking**. - **MET Norway**: the multi-day wind forecast. Sends **the coordinates of the point you are checking**, rounded to 2 decimal places (about 1 km) before it leaves your device. - **jsDelivr**: serves the Clerk sign-in library, only if you open sign-in. - **Windy.com**: only if you tap "Open in Windy". That link deliberately carries a **rounded, roughly 1 km area**, not your precise spot. The App is **offline first**. Once loaded, the regulations and map work with no connection, which keeps these requests to a minimum. ## 7. What we do not do - **No Google Analytics, no Meta pixel, no ad-network SDK, ever.** - **No analytics event ever carries your position, map coordinates, spot names, water names or catch data.** See below. - **No advertising and no profiling.** We do not build a profile of you or track you across apps or sites. - **We never sell, rent or trade your data.** - We do not upload your spots, catches, tracks, sonar imports or licence photo. Ever. ### Usage analytics (PostHog), restored 2026-10-02 The App uses **PostHog**, a US-hosted product-analytics service, to record usage events so we can see what works and fix what breaks. Nothing is sent until you have seen the notice about it in the App (on first run, or as a one-time notice if you used the App before). The App sends only this fixed list of events: **app_opened**, **mode_switched** (salt or fresh), **card_opened** (a water card was opened), **layer_toggled** (which map layer, on or off), **species_picked** (salt or fresh), and **page views** (the page address without any query string or fragment). Each event also carries a technical set of fixed fields (library version, browser and operating-system family, device type, and the channel, beta or production). Events carry no name, email, coordinates or spot data. The App's own code drops any property that looks like a position, a map extent, a water name or a spot name before anything is sent, and keeps only a fixed list of technical fields. Events are tied to **a random ID stored on this device, not tied to your name or email**. It lives in your browser's local storage (**no cookies are set**) and it persists until you clear the App's site data, so we can tell that two events came from the same device; that makes the events pseudonymous, not anonymous. Autocapture of taps and session recording are switched off. Your browser's Do Not Track setting is honoured, in which case nothing is sent. **PostHog receives your IP address with each request**, as any web service does. We switch off PostHog's location lookup from that address, but we do not control or claim to control what PostHog does with the address on its side. The PostHog script is a pinned copy served from our own domain, not loaded from PostHog. Your spots, catches, sonar imports and licence copy are never part of this, and your GPS position is never sent to analytics. History, stated plainly: the App used PostHog from 2026-07-30, removed it on 2026-09-13, and brought it back in this narrower form on 2026-10-02. If you want the analytics data tied to your device identifier deleted, ask us at the address in Section 9. ## 7a. Where the little data we do hold is stored The optional-account and beta-feedback providers named above (**Clerk**, **Cloudflare**, **PostHog**) are companies that may store and process data **outside Canada, including in the United States**. While it is there, it can be subject to the laws of those countries. Everything the core App stores stays on your device in Canada (or wherever you are); this section only applies to the optional flows described in Sections 2, 3, 5, and 7. ## 8. Children The App is intended for a general audience and is not directed at children under 13. We do not knowingly collect personal information from children. ## 9. Deleting your data - **On your device** (spots, catches, tracks, sonar imports, licence copy and photo, settings): clear the App's data in your browser or device settings, or delete the installed app. That is a permanent deletion and we never had a copy. - **Beta feedback rows and tester record**: email **thirtythreeknots@gmail.com** from the address you signed in with, or quote your invite code, and we will delete them. - **Your account**: email the same address and we will delete your Clerk account and everything linked to it. There is **no in-app account deletion button yet**. We will add one before the App is released on any app store, because the stores require it and because you should not have to email anyone to leave. - **Push subscription**: turn alerts off, or ask us and we will delete it. ## 10. Security Data on your device is protected by your device and browser. Network requests use HTTPS. No method of transmission or storage is perfectly secure, and you use the App at your own risk. ## 11. Changes We may update this Policy. Material changes are reflected in the "Last updated" date and the changelog below. ## 12. Contact Questions about privacy? Contact **thirtythreeknots@gmail.com**. --- ## Changelog - **2026-10-02**: usage analytics through PostHog restored, with the disclosure in Section 7 (the full event list, a random device ID that is pseudonymous rather than anonymous, the IP address PostHog receives, no cookies, nothing sent before the in-app notice has been shown). The promises that stand are unchanged: spots, catches, sonar imports and licence copy never leave your device, GPS position and map coordinates are never sent to analytics, no ad trackers, no advertising, no profiling, no sale of data, no account needed. - **2026-09-28**: added Section 3a disclosing the public "Report: something wrong here?" button (R7-3): category, free-text note, coarsened tap location (same 3dp rounding as beta feedback), water/species/ verdict/rule text shown on the card, app version and an optional resized photo. Documents the human review lane (a person reads reports and marks them reviewed) and that a report never changes any regulation or verdict. - **2026-09-14**: added Catchable Pro (one local entitlement, no account, no payment provider connected yet), followed waters, and the Pro tide calendar's on-device tide-year cache to Section 1's device-only list. None of it is sent anywhere; the tide calendar's one-time yearly fetch (Section 6) is requested by station id only, same as the existing tide feature. - **2026-09-13**: **product analytics removed entirely.** PostHog, its key, its script host and its Content-Security-Policy allowance are all gone from the App, and nothing replaced them. Section 7 is now a plain "no analytics of any kind"; Section 7a no longer names PostHog. The reason is stated in Section 7: an analytics service always receives the request IP, which no client-side setting can prevent, so the only way to make the privacy claim provable rather than promised was to stop using one. - **2026-09-06**: product analytics (PostHog) opened from the invite-only beta to the whole App ahead of public launch, per an ownership decision that analytics belongs in production too. The "No analytics" promise is retired and replaced with an honest disclosure: cookieless (local-storage identifier, no cookie), no session recording, no location, no spot or species-list contents, Do Not Track respected. Section 7 rewritten; Section 7a's provider list wording updated to match. - **2026-08-29**: replaced Open-Meteo (a free tier restricted to non-commercial use) with two commercially-licensed government sources for wind/weather: Environment and Climate Change Canada (current conditions, marine-area forecasts, marine warnings) and MET Norway (the multi-day wind forecast). Section 6 updated to name the actual services contacted. - **2026-08-29**: added Section 7a disclosing that the optional account, beta-feedback, and beta-analytics providers (Clerk, Cloudflare, PostHog) may store data outside Canada, per PIPEDA openness expectations. No change to what is collected. - **2026-07-26**: rewritten so every statement matches the App as built today. Added the optional Clerk account, the Guide Class beta feedback disclosure (including the screenshot, the exact tapped coordinates and the user agent), invite-code redemption, sonar imports and the licence photo as device-only stores, and the Windy link. Corrected the CDN name (jsDelivr, not unpkg) and named Open-Meteo and DFO IWLS directly. Added a real deletion section, including the honest note that in-app account deletion is planned and not yet built. - **2026-06-24**: first version. --- > **Not legal advice.** This is a good-faith description of the App's actual data practices as built. Have it > reviewed by a qualified lawyer before commercial launch, and keep it in sync with the App: if you change > analytics, new accounts, payments or any new data flow, this Policy must be updated first.