Privacy policy

SIGMAJUNCTION DOO operates Shoalmap and is the data controller for the personal data described here. Contact: hello@shoalmap.com.

Account. Your email address and a user ID, managed by our sign-in providers (Amazon Cognito; Google Identity Platform for accounts created before our move to AWS). Sign-in is with email/password or Google. Legal basis: performing our contract with you.

Subscription. Your plan, Paddle (web) or RevenueCat / app-store (mobile) customer and subscription IDs and subscription status, so we know which features you paid for. Web payments are processed by Paddle as Merchant of Record — your card details never reach us. See Paddle's privacy policy. Legal basis: contract.

Preferences and saved waters. Language, units, preferred fishing styles, your favourites list and alert settings, stored until you change them or delete the account.

Catch log. Catches you record: species, size, date, the water and its location, notes and optional photos (stored in Amazon S3, EU). A catch is private unless you choose to share it; shared catches appear to other anglers as an anonymised pin under the public name you pick — never your email. Legal basis: contract.

Locations you search. Coordinates you pick (or your device location, only if you allow the browser prompt) are processed to find nearby waters and weather. Search areas are cached server-side briefly by area — not linked to your account history. We do not build a movement profile.

Usage metering. On the free plan we record which waters you opened reports for on a given day (to enforce the daily limit). Legal basis: contract.

Notifications. If you turn on alerts, your browser or device push token, so we can send them. Turning alerts off deletes it.

Offers by email. As a Shoalmap account holder you may get occasional emails about our own plans — for example a gift code for a free month of Pro+, or a reminder before complimentary access ends. Legal basis: our legitimate interest in telling customers about our own, similar services. Every such email has a one-click unsubscribe link, and you can switch them off anytime in your profile (Emails). Account, payment and security emails are not affected.

Messages to us. What you send through the contact form or by email, to answer you.

Analytics and session recordings — only with your consent. If you accept optional cookies, Google Analytics measures page views and feature use, and Smartlook records how pages are used (clicks, scrolling, page changes) so we can find and fix problems. Text you type into form fields is masked, and recording is off on sign-in and admin pages. Legal basis: your consent, which you can withdraw at any time.

Essential (always on): the session cookie that keeps you signed in (__session, httpOnly, 7 days) with a companion flag that only tells the page you are signed in (sm-signed-in, 7 days); your language choice (sm-locale, 1 year); and your cookie choice itself (sm-consent, 6 months).

Optional (only after you accept): Google Analytics / Google Tag Manager cookies (_ga, _ga_*, up to 2 years) and Smartlook cookies (SL_C_*, up to 1 year). No advertising or cross-site tracking cookies are used.

You choose in the banner shown on your first visit, and can change your mind at any time with the Cookie settings link in the footer of every page.

We share only what each provider needs to do its job:

• Amazon Web Services (Frankfurt, EU) — hosting, database, photo storage and sign-in (Cognito).
• Google— Identity Platform (sign-in for older accounts) and Gemini (fishing reports are generated from a water's name and coordinates, and catch photos you ask us to identify — never from your identity); Google Analytics / Tag Manager only with your consent.
• Smartlook (EU data region) — session recordings, only with your consent.
• Paddle — web checkout, billing, taxes and receipts (Merchant of Record); RevenueCat, Apple and Google — mobile in-app purchases.
• Resend — email delivery (sign-in links, receipts of account actions, and the offers described above).
• Expoand your browser's push service — delivering the alerts you turn on.
• Open-Meteo — weather and marine forecasts for the searched coordinates.
• OpenStreetMap/Overpass — water lookup for the searched area; Komoot Photon — place-name search; CARTO — map tiles loaded by your browser.

Some of these providers are based in the United States; transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

Account, subscription, preferences, favourites and catch-log data (including photos) are kept while your account exists. Daily metering entries are only meaningful for the current day. Generated fishing reports are cached per water (not per person). Server logs are kept briefly for security and debugging.

You can access, correct, export or erase your data, object to or restrict processing, and complain to your data-protection authority. Where processing is based on consent (analytics, session recordings), you can withdraw it at any time via Cookie settings. The fastest way to erase everything is in the app: Account → Delete account — it cancels any subscription, deletes your profile, favourites, catches and photos and metering data, and removes your sign-in record. For anything else, email hello@shoalmap.com.

Shoalmap is not directed at children under 16 and we do not knowingly collect their data.

If this policy changes materially we will give notice in the app or by email before the change takes effect.