This policy explains how your personal data is collected, processed, stored and shared when you use the Fishifu mobile app (the "App"). It has been prepared in line with the Turkish Personal Data Protection Law No. 6698 (KVKK), the EU General Data Protection Regulation (GDPR) and the Apple App Store privacy requirements.
By using the App you confirm that you have read and understood this policy. If you do not agree with the terms below, please do not use the App.
1. Data Controller
The data controller under both the KVKK and the GDPR is:
2. Personal Data We Collect
The table below states, for every category of data Fishifu collects, the purpose of collection, where it is stored, which third parties it is shared with, and the legal basis for processing.
| Data | Purpose | Storage / Sharing | Legal Basis |
|---|---|---|---|
| Location data (GPS) | Showing nearby fishing spots and attaching a location to your catch logs. | Processed on your device; stored on our servers only if you create a catch log. Never shared with third parties. | Explicit consent KVKK Art. 5(1) / GDPR Art. 6(1)(a) |
| Spot check queries (a point you pick on the map) | Calculating the fishing score for the selected point; turning queries into aggregated, anonymous statistics to identify spots frequently checked by the community. | The point's coordinates (about 10 m precision), selected species, calculated score and time are stored on our server. For weather data, the coordinates are sent directly from your device to Open-Meteo without your identity. Individual queries are never shown to any user; only areas checked by at least 5 different users may be used, in aggregate. | Legitimate interest KVKK Art. 5(2)(f) / GDPR Art. 6(1)(f) |
| Catch photos | Displaying photos in your personal catch log. | Cloudflare R2 object storage (EU / US regions). Visible only to you. | Performance of a contract KVKK Art. 5(2)(c) / GDPR Art. 6(1)(b) |
| Account details (email, name) | Creating your account, managing sessions, contacting you. | Stored in our PostgreSQL database. | Performance of a contract KVKK Art. 5(2)(c) / GDPR Art. 6(1)(b) |
| Subscription data | Managing the status of your premium subscription and keeping purchase records. | Shared with RevenueCat, Inc. (US). Payments are handled by Apple/Google. | Performance of a contract KVKK Art. 5(2)(c) / GDPR Art. 6(1)(b) |
| Push notification token | Sending weather alerts and catch score notifications. | Delivered via Apple APNs and Google FCM. Retained until you change devices or turn notifications off. | Explicit consent KVKK Art. 5(1) / GDPR Art. 6(1)(a) |
| Usage analytics | Understanding which features are used, detecting crashes, improving the product. | Google Firebase Analytics. Device identifier, app version, interaction events, approximate IP location and crash reports are collected. | Legitimate interest / Explicit consent KVKK Art. 5(2)(f) / GDPR Art. 6(1)(f) |
What we do not collect: your credit card details, plaintext passwords, health data, biometric data, political or religious beliefs, trade union membership or information about your sex life. Payment details are processed exclusively by Apple and Google and are never sent to Fishifu.
3. How We Share Your Data With Third Parties
We do not sell, rent or share your data for marketing purposes. It is shared only with the limited set of data processors below, and only so that the service can be delivered:
- Cloudflare, Inc. (US) — storage of catch photos (R2 storage).
- RevenueCat, Inc. (US) — subscription status management.
- Google LLC / Firebase (US) — app analytics and push notification infrastructure (FCM).
- Apple Inc. (US) — iOS push notification infrastructure (APNs) and subscription payments.
- Open-Meteo (Switzerland / EU) — weather data for spot checks; only coordinates are sent, never your identity.
Your data may be disclosed to competent authorities where required by a court order or applicable law.
4. International Data Transfers
The service providers listed above operate servers in the United States and the European Union. Your data is therefore transferred abroad. Under KVKK Art. 9 these transfers rely on your explicit consent or fall within transfers to countries with an adequacy decision; under the GDPR they are safeguarded by Standard Contractual Clauses (SCC).
5. Retention Periods
- Account and related data (catch logs, photos, location records): for as long as the account is active.
- After account deletion: removed from all active systems and backups within a maximum of 30 days.
- Records subject to a legal obligation (invoices, subscription records): for the period required by applicable law (typically 10 years in Türkiye).
- Spot check queries: when your account is deleted, the link to your account is removed; the location and score record without identity is kept for aggregate statistics.
- Analytics data: 14 months, per the Firebase default.
6. Your Rights Under the KVKK and the GDPR
Under KVKK Art. 11 and GDPR Art. 15-22 you have the following rights:
- To learn whether your personal data is being processed.
- To request information about processing that has taken place (right of access).
- To learn the purpose of processing and whether the data is used accordingly.
- To learn which third parties the data has been transferred to, domestically or abroad.
- To request rectification if the data is incomplete or inaccurate.
- To request erasure or destruction (right to be forgotten).
- To request transfer of your data to another controller (portability).
- To object to processing.
- To claim compensation for damage caused by unlawful processing.
To exercise these rights, send your request to [email protected] together with information that verifies your identity. Requests are resolved within 30 days at the latest.
7. Account and Data Deletion
In line with the Apple App Store requirement (§ 5.1.1(v)), you can delete your account and all of your data from inside the app via Settings → Account → Delete My Account. Alternatively you can send a request to [email protected]. Deletion requests are actioned within 30 days.
8. Children's Data
Fishifu is not designed for users under the age of 13 and does not knowingly collect data from them. For EU users this age limit is 16. If you believe we have collected data about your child, please contact us and the data will be deleted immediately.
9. Analytics and Advertising Identifiers (iOS)
Fishifu does not access the advertising identifier (IDFA) on iOS, use personal data for advertising, or track you across apps or websites owned by other companies. Firebase Analytics is configured without advertising identifier support and is used only for in-app usage measurement. You can change your usage analytics and crash reporting preference under Profile → App Settings → Privacy in the app.
10. Data Security
We apply the following technical and organisational measures to protect your data:
- All server communication is encrypted with TLS 1.3.
- Passwords are hashed with bcrypt and never stored in plaintext.
- Database access follows the principle of least privilege.
- Photos on R2 are served through signed URLs.
- Regular backups and penetration tests are performed.
No system is 100% secure, so absolute security cannot be guaranteed. If we detect a data breach we will notify you and the relevant authorities within 72 hours, as required by KVKK Art. 12(5) and GDPR Art. 33.
11. Cookies and Similar Technologies
The Fishifu mobile app does not use cookies. This website uses only cookies that are strictly necessary for functionality; there are no analytics or advertising cookies.
12. Changes to This Policy
This policy may be updated from time to time. Material changes are announced through an in-app notice or by email. The most current version is always available on this page, and the "Effective date" is shown at the top.
13. Contact and Complaints
For any question, request or complaint about this policy or the processing of your personal data:
If you are not satisfied with our response, you retain the right to lodge a complaint with the Turkish Personal Data Protection Authority (KVKK) or, if you are in the EU, with your local data protection authority.