Privacy Policy

Effective Date: April 9, 2026 · Last Updated: October 12, 2026

PescaBite (“we,” “our,” or “us”) is a fishing intelligence app for US anglers in all 50 states. This Privacy Policy explains how we collect, use, and protect your information when you use the PescaBite mobile app and website.

1. Information We Collect

Account Information

When you create an account, we collect your email address. You can sign in with Apple, Google, or an email and password. If you use Apple or Google, authentication is handled by them and we never see a password. If you use email and password, the password is handled by our authentication provider (Supabase) and stored only as a salted hash; we never see or store your plaintext password.

You do not need to sign in to use PescaBite. When you finish setting up the app, we create an anonymous account for your device. It has no email address, name, or password; it is a random identifier that lets the app talk to our servers. If you later sign in with Apple, Google, or email, that anonymous account is upgraded in place, so the catches, favorites, and settings you already have come with you. Where an in-place upgrade is not possible (for example, you sign in to an account you already had), the catches logged on this device are moved into the account you signed in to, and the waters you starred on this device are added to that account's favorites. Signing out removes the favorites from the device; favorites already saved to your account stay there.

Location Data

With your permission, we access your device location to show nearby waterbodies, display relevant regulations, and provide localized bite scores. Location used for these lookups is not stored on our servers, sold, or shared with third parties. Separately, if you log a catch, that catch’s coordinates are saved as part of your private catch log (see below), visible only to you.

Catch Log Data

If you use the catch log, we store your entries (species, location name and coordinates, measurements, photos, and notes) in your private account. This data is protected by Row-Level Security, so only you can access your catches. We never share, aggregate, or make your catch data visible to other users.

Catch Photos

Photos you add to your catch log are compressed to under 200KB and stored in cloud storage, in a folder tied to your account. Other users cannot browse, list, or search your photos, and the app never shows them to anyone but you. Catch photos are kept in private, access-controlled storage: a photo cannot be opened from a plain web address, and every view requires a short-lived link that is issued only to you while you are signed in to your account.

Push Notification Token

If you enable push notifications, we store your device’s push token to deliver stocking alerts and weekly reports. You can disable notifications at any time in the app settings.

Crash Reports and Diagnostics

The app sends crash reports and performance diagnostics to Sentry so we can find and fix bugs. These reports include your device model, operating system version, and a random installation identifier. They are configured so that your identity is stripped before sending, and they never include your catch log, your catch photos, or your location.

Usage Analytics

To understand how people discover, come back to, and pay for PescaBite, the app records a small set of product events: opening the app (at most once per visit: when you open it or return to it after 30 minutes or more away), finishing setup, viewing the PescaBite Pro screen (and which screen it was opened from), starting a purchase and whether it succeeded, was cancelled, or failed, creating an account (and whether it was with Apple, Google, or email, never the address itself), seeing or accepting a prompt to save your log to an account, logging a first catch, and being asked to sign in or upgrade before using Identify Fish. Each event is stored as its own record with the app version, the platform (iOS or Android), and a random identifier created for this installation of the app. The app-open event also carries one number: how many whole days have passed since that identifier was created (0 to 7, or “8 or more”), so we can tell whether people come back the day after they install and a week later. Like every event, it is dated when our server receives it; it carries no other time, no screen, and no location or state.

These records are pseudonymous, not anonymous: the installation identifier lets us see that one installation did several things, but it is not linked to your account, email, or name. The records contain no location, no waterbody, and no catch details. They are sent without your sign-in session. When you delete your account, the app discards its installation identifier and starts a new one, and app-open events from the new identifier carry no day count. Records already sent are deleted automatically after 180 days.

We also record subscription events that RevenueCat reports to us (for example, a trial started or a renewal), limited to the event type, product, whether it was a trial, the store, and whether it was a test purchase. These carry no account, installation, or price information.

Most Google Play and App Store links on our website and in our social media posts carry a campaign tag that names the link (for example, which page or which platform it was on). The tag is fixed text written into the link itself and carries no information about you. It lets Google Play Console and App Store Connect show us, as totals, how many store visits and installs each link led to. The tag describes the link, not you: we see only those aggregate counts, and they are not linked to your account or to the installation identifier above, and the app itself does not read this tag. App Store Connect shows these totals only once they pass Apple’s privacy threshold, and only for people who chose to share analytics with app developers. Your visit to a store page itself is handled under Google’s or Apple’s own privacy policy.

The Mapbox map component also collects anonymized map-usage telemetry under Mapbox’s own privacy policy.

When a search for a waterbody returns no results, we record the search text so we know which waters to add next. These records carry no account, device, or location identifier, and searches that do find a water are not recorded at all. Text that looks like an email address, phone number, or web address is discarded on your device and never sent.

2. How We Use Your Information

3. What We Never Do

4. Data Storage and Security

Your data is stored on Supabase (hosted on AWS) with encryption at rest and in transit. Row-Level Security (RLS) ensures that database queries can only return your own data. Catch photos are stored as described under “Catch Photos” above.

5. Third-Party Services

We use the following third-party services:

6. Data Retention

We retain your account data and catch log for as long as your account is active. You can delete your account and all associated data at any time from the app’s settings, or by contacting us. Product events (see “Usage Analytics”) are deleted 180 days after they are recorded. Environmental data (USGS readings, weather, stocking events) is public data and retained for app functionality.

7. Children’s Privacy

PescaBite is not directed at children under 13. We do not knowingly collect information from children under 13. If you believe a child has provided us with personal information, please contact us.

8. Your Rights

You have the right to:

9. Changes to This Policy

We may update this policy from time to time. We will notify you of material changes through the app or by email.

10. Contact

Questions about this privacy policy? Contact us at support@pescabite.com.