1. In short
This Privacy Policy explains which personal data My Fish (brand "myfish.uno") processes, why, with whom it is shared and what your rights are. It applies to the service on its three channels: the web (myfish.uno), the App Store app and the Google Play app.
The essentials:
- we do not sell your data and we do not show targeted advertising;
- we do not ask for an email address to create an account;
- your sessions are private by default;
- you can download your data and delete your account yourself, free of charge.
2. Data controller
The controller of your data is:
Company name: IM'IN OÜ
Registered office: Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145 (Estonia)
Registration number: 17314352
Contact address: support@imin.uno
We apply the General Data Protection Regulation (GDPR).
3. The data we process
Account: your username, your password (kept only in hashed form, never in clear text), the fingerprint of your recovery code, language, time zone, the dates the account was created and last active, and the sign-in tokens of your devices (kept as a fingerprint, with a device label). Where applicable, the suspension of your account by our team, with its date and reason.
Profile (optional): display name, bio, avatar or profile photo, country, region, favourite species.
Fishing log: your sessions (date, duration, place and GPS coordinates, technique, bait, gear, notes, photos, recorded weather), your catches (species, length, weight, time, photo, notes, position), your spots (name, GPS coordinates, description, characteristics, photos, personal note, visibility level), your lab experiments and trials, and the statistics derived from them.
Game and social life: XP, level, trophies, leaderboards, challenge entries, teams and results, friends and friend requests, referral code and the link with the person who invited you, notifications received in the app.
Premium: your subscriber status, the purchase platform (Apple, Google or Stripe), the technical identifiers of the subscription and of the customer on that platform, the period dates, and the history of free Premium days. We never receive or keep your bank card number. If you take up the welcome offer, we also keep a fingerprint that prevents it from being granted twice: your username, the app's installation identifier and, if there is one, the device's original identifier at RevenueCat, each kept only as a one-way cryptographic fingerprint that cannot be reversed (section 10).
Missions and measuring how things work: events linked to missions and to the Premium offer (for example "offer seen", "invitation sent", "spot submitted"), with your country, language and status at the time of the event.
Partner clicks: when you open a partner link, we count the click with the date, country and Premium status, without an account identifier. To avoid counting the same click twice, we keep an encrypted fingerprint that changes every day and cannot be used to find you.
Reports and exchanges: the reports you file and the messages you send to support.
Technical data: IP address (used for security and to limit abuse), technical server logs (date, address called, response code), and app error reports (technical error message, without your content).
We do not ask you for any sensitive data (health, opinions, etc.): do not put any in your notes or photos.
4. Why we use it, and on what legal basis
Providing the service (performance of the contract between us): creating and securing your account, saving and displaying your log, the map, friends, leaderboards and challenges, managing Premium and free days, answering your requests.
Your consent: access to your device's location, camera and photos, and sending push notifications. You can withdraw this consent at any time in your device settings.
Our legitimate interest: protecting the service against fraud, cheating and abuse; moderating content; measuring in an overall way the use of the service, missions and partner links in order to improve it and to calculate the commissions owed by partners; automatically translating public content so that it can be read in your language. You can object to this (section 11).
Our legal obligations: keeping accounting records relating to subscriptions and answering requests from the authorities where the law requires it.
We take no decision producing legal effects concerning you by fully automated means, and we do no advertising profiling.
5. Location
The app reads your device's position only when it is open and you use a feature that needs it: centring the map around you, placing a spot or a session, getting the weather or the fishing score for the place. It does not track your position in the background.
Coordinates are saved precisely when you create a spot, a session or a catch, because that is the very purpose of the log. They are shown to others only according to the visibility you have chosen (section 7).
For the weather, we send the weather provider a rounded position (about one kilometre), without an account identifier.
You can refuse or withdraw access to location in your device settings: you will still be able to place your locations by hand on the map.
6. Your photos
The photos you add to a spot, a session, a catch or your profile are stored on our server. They are served through signed, temporary links: a link works for one image only and for a limited time, then stops working on its own.
A photo is visible to the same people as the content it is attached to. Avoid posting photos in which other people are recognisable without their agreement. When a photo or video is no longer used by any content (you removed it, or you deleted the catch, session or spot), its file is automatically erased from storage after a safety delay of at least 7 days; this clean-up covers files uploaded since it was put in place. When you delete your account, the photo and video files of your content, and any file registered in your name, are erased from storage, except a file still used by another account's content.
7. What other users see
Always visible to other signed-in users: your username, display name, avatar or profile photo, bio, country, level and position in the leaderboards. Your username can be found through the friend search.
Depending on your choice:
- your sessions and their catches: private by default; you can open them to your friends, your close friends or everyone, and hide certain details;
- your spots: public (visible on the map to everyone, with their position), friends-only, or private; a spot's personal note is never shown to others;
- challenges: by taking part, your username, your ranking and the catches counted for the challenge (with their photo) are visible to the other participants, and to everyone for a public challenge.
Public texts (a spot's description, a bio) may be automatically translated for readers of another language.
8. Who your data is passed to
We do not sell your data. It is hosted on a server rented from Hetzner Online GmbH (a German company, Gunzenhausen, Germany) and administered by us, where the database and the photos are located. Some data is passed to the following providers, solely for the task indicated:
- Hetzner Online GmbH (Gunzenhausen, Germany): rental of the server that hosts the service (database and photos);
- Apple (App Store) and Google (Google Play): distribution of the app and payment for subscriptions bought in the app;
- RevenueCat: technical management of subscriptions bought in the app (receives your account's internal identifier and the subscription status);
- Stripe: payment for subscriptions bought on the web (receives your account's internal identifier, your username and the payment details you enter with it);
- MET Norway (Norwegian Meteorological Institute) and Visual Crossing: weather (they receive a rounded position, without an account identifier);
- OpenAI: automatic translation of public texts entered by users (receives the text to translate, without an account identifier);
- map backgrounds: Apple Maps on iPhone, Google Maps on Android, OpenStreetMap, CARTO and Esri on the web (your device asks them directly for the images of the area displayed, which passes them your IP address);
- OpenStreetMap (Overpass service): search for points of interest around the area displayed (receives the map area, without an account identifier).
When you open a partner link or directions, you leave My Fish: the destination site or app applies its own policy.
We may also disclose data to the authorities where the law obliges us to.
9. Transfers outside the European Union
Some of the providers listed in section 8 are established outside the European Union, in particular in the United States (Apple, Google, RevenueCat, Stripe, OpenAI, Visual Crossing, CARTO, Esri). Where personal data is transferred to them, the transfer is covered by the safeguards provided for by the GDPR: an adequacy decision of the European Commission where one exists (for example the EU–US Data Privacy Framework for companies that have joined it) or standard contractual clauses.
You can ask us for details of these safeguards at support@imin.uno.
10. How long we keep data
- Your account and your content (profile, sessions, catches, spots, photos, trophies, friends): for as long as your account exists. There is no automatic expiry: your log is yours. You can delete an item at any time.
- Sign-in tokens: each is valid for 30 days at most, and a single session never lasts more than 180 days; they are revoked as soon as you sign out of a device or change your password. Their trace (fingerprint and device label) is erased about 30 days after they are revoked, or 31 days after they were last used.
- Photo access links: limited duration (1 hour).
- Cached weather data: no personal identifier, purged regularly.
- Cached automatic translations: kept without an account identifier; those of a session's notes are erased when the session stops being public, and those of your texts (bio, notes) when you delete your account.
- Partner click counters: kept as statistics, without an account identifier.
- Records relating to paid subscriptions: for the period required by accounting and tax law (up to 7 years under Estonian law).
- Technical logs and backups: kept for a limited time, then overwritten in the normal course of operation.
You delete your account from the app, confirming with your password; the deletion is then immediate and permanent:
- erased: your profile, your password and recovery code, all your sign-ins, your referral code and your Stripe customer identifier, your photos and videos (the files themselves, except the photos of your public spots, which stay with them, and a file still used by another account's content), your XP, levels, trophies, leagues, titles and statistics, your friendships, your notifications, your reports, your ideas and votes, your lab experiments, the history of your free Premium days and missions, and the translations of your texts;
- emptied and marked as deleted: your sessions and catches (their notes, GPS positions, place names, photos, videos, equipment, baits and technique are erased; only data such as dates, duration, species, size, weight, readings such as wind or water temperature, and the session's spot remain), and your private or friends-only spots (removed from the map and the app, without your personal note or your photos; their name, position and description remain in the database);
- kept, without your identity: the public spots you created (they stay in the map's catalogue, attached to the MY FISH account, with their photos but without your personal note, because other anglers have recorded their own sessions there; write to us if you want them removed as well), your past entries in challenges, attached to an anonymous account, your places in the rankings of finished challenges (without your username, name or photos), and an anonymous record that replaces your account (without your username, name or photo, with no usable password; it keeps the account's creation date and the subscription status);
- your former username cannot be taken by anyone for 90 days, after which it becomes available again;
- if you took up the welcome offer, its fingerprint (your former username, the app's installation identifier and, if there is one, the device's original identifier at RevenueCat — each as a one-way cryptographic fingerprint, no longer linked to your account) is kept with no time limit, solely so that the offer is not granted a second time;
- the log of administrative actions concerning your account (for example a suspension and its reason) is kept;
- kept for as long as the law requires: records relating to a paid subscription;
- earlier backups may still contain your data until they are overwritten; they are never used to restore a deleted account.
11. Your rights and how to use them
You have the following rights over your data:
- Access and portability: in the app, the "Download my data" button, at the bottom of this Privacy Policy, gives you in a single file everything your account holds (profile, spots, sessions, catches, trophies, XP, statistics, friends). It is free and open to every account.
- Rectification: everything you entered can be edited in the app (profile, sessions, catches, spots).
- Erasure: you can delete a piece of content, or your whole account by confirming with your password, from your profile in the app, without having to write to us; if you can no longer sign in, the page myfish.uno/delete-account explains how to ask us.
- Restriction and objection: you can ask us to restrict processing, or object to processing based on our legitimate interest, by writing to support@imin.uno.
- Withdrawal of consent: location, camera, photos and notifications can be switched off at any time in your device settings.
For any request, write to support@imin.uno and give your username. As we do not have your email address, we may ask you to prove that the account is yours. We reply within one month.
Complaint: you can lodge a complaint with the Estonian data protection authority (Andmekaitse Inspektsioon, www.aki.ee) or with the authority of your country of residence — in France, the CNIL (www.cnil.fr).
12. Minors
My Fish is not intended for children under 13, and we do not knowingly collect data about them. Between 13 and the age set by the law of your country for consenting alone (up to 16 in the European Union), the agreement of a parent or legal guardian is required.
If you think a child has created an account without that agreement, write to support@imin.uno: we will delete the account.
13. Security
We protect your data with appropriate measures, in particular: encrypted connections (HTTPS), passwords and recovery codes kept only in hashed form, sign-in tokens kept in your phone's secure storage, photos served through signed, temporary links, limits on sign-in attempts, and masking of secret information in logs.
No system is infallible. Choose a unique password, keep your recovery code in a safe place and tell us if in doubt. If a data breach posed a high risk to you, we would inform you as the law requires.
14. Storage on your device, cookies and audience measurement
On your device, the app saves: your sign-in tokens (in the phone's secure storage; in the browser's local storage on the web), your preferences (language, settings, steps already seen), a copy of data already loaded for fast and offline display, entries waiting to be sent when you have no network, and an installation identifier (a randomly drawn number, sent to our server only when you claim the welcome offer). Your tokens, the copy of your data and your entries not yet sent are erased from the device when you sign out. The rest is erased if you uninstall the app; on iPhone, what is kept in the phone's secure storage may remain there.
We use no advertising cookies or advertising trackers, and we share no data with advertising networks.
On the web version of the app, we measure page traffic with the Rybbit tool, installed on our own server: these statistics are not passed to any third party and are used only to improve the service.
Map backgrounds displayed on the web are loaded from their providers' servers (section 8).
15. Push notifications
The app can send you push notifications, if you accept them. They are limited to three families: when someone addresses you (for example a friend request or an invitation), what concerns your challenges, and what concerns your account (for example your Premium).
To send them to you, we keep a technical token that identifies your device with Apple's or Google's notification service. It is deleted with your account.
You can turn notifications off at any time, in the app or in your device settings.
16. Changes to this policy
We may update this policy, for example when a feature or a provider changes. The date of the last update is shown at the top of the document. For a significant change, we inform you in advance in the app or on myfish.uno.
17. Contact us
For any question about your data or to exercise your rights: support@imin.uno
IM'IN OÜ, Harju maakond, Tallinn, Kesklinna linnaosa, Tornimäe tn 5, 10145, Estonia.