Privacy Policy

Last updated: 11 October 2026

1. Data controller

The controller of your data is Nick Stavrou, who operates the App as a private individual, based in Greece. For any matter relating to your data you can contact anglr.app@proton.me.

2. What data we collect

We collect only the data necessary to run the App:

Anglr is a local-first app: the fishing content you create is stored primarily in a database on your own device. It is uploaded to our servers only if you have an active Premium subscription, whose cloud backup feature keeps a copy of your diary on our backend. Without Premium, your content stays on your device and is not transmitted to us.

Account details

• First and last name.
• A username you choose.
• Email address (used for sign-in and for communication/password reset).
• Password — always stored hashed, never in plain text.

Profile preferences

• Measurement units, language, time zone.
• An optional default location (name and coordinates) that you set yourself.
• Interests and preferences you declare during onboarding (e.g. fish species, water types).

Fishing data (content you create)

• Fishing spots: name, geographic coordinates, notes, depth.
• Trips/sessions: date, notes, location, weather and sea snapshots.
• Recorded GPS trails: a sequence of GPS points with time, speed, elevation.
• Catches: species, date, details you enter.
• Gear (tackle box) and planned trips.

This content lives on your device. With a Premium subscription it is also backed up to our cloud database (see section 7 for what happens when a subscription ends).

Device and security data

• Notifications are generated and scheduled locally on your device; the App does not use push notification services and no notification token is sent to us.
• Authentication events (sign-up, sign-in, password reset): our backend platform processes your IP address and basic request metadata, which may appear in short-lived service logs used solely to secure the service.

Subscription data (Premium)

• If you purchase a Premium subscription, we receive your subscription status (product, purchase and expiry dates, store transaction identifiers) from Google Play through our subscription-management provider (RevenueCat).
• Payment is processed entirely by Google Play. We never receive your card or other payment details.

3. Purposes and legal basis

• Providing the service (account, storing spots, trips, catches) — performance of a contract (Art. 6(1)(b) GDPR).
• Location and GPS trails — based on your consent and because they are necessary for the feature you request (map, recording spots/trails). While you are actively recording a trail, location is also collected in the background, with a visible ongoing notification. You can withdraw consent by stopping the recording or disabling location access in your device settings.
• Weather and marine data — we send the coordinates you choose to weather providers to show you conditions (performance of a contract).
• Notifications — reminders are scheduled locally on your device according to your in-app settings; no data leaves your device for this purpose.
• Managing your Premium subscription (activating features, verifying entitlement) — performance of a contract (Art. 6(1)(b) GDPR).
• Security and abuse prevention (authentication service logs) — legitimate interest (Art. 6(1)(f) GDPR) in protecting your account.

4. Photos

5. Third parties and recipients

We do not sell your data. We share it only with the following providers, and only to the extent needed for the corresponding feature to work:

• Supabase — our backend platform (authentication and database). It hosts your account details and, for Premium users, your cloud backup. Our database is hosted in the European Union (Frankfurt, Germany). (Policy)
• Open-Meteo — weather and marine data for the coordinates you choose. (Terms)
• OpenWeather — severe weather alerts for your selected locations; requests go through our server, so your device never contacts OpenWeather directly. To prevent abuse we keep a daily count of your alert requests (no locations), deleted with your account. (Policy)
• Fishial AI — fish species recognition; temporarily receives the image you capture, relayed through our server. (fishial.ai)
• RevenueCat — subscription management for Premium; receives an app user identifier and Google Play purchase information to validate your subscription. (Policy)
• Google Play — payment processing for Premium subscriptions, under your Google account terms. (Policy)
• OpenStreetMap and Esri — map tile providers; they receive map requests for the area you view. (OSM, Esri)

6. International transfers

Your account data and cloud backups are stored within the European Union (Frankfurt, Germany). Some of the above providers (e.g. Fishial, RevenueCat, Google) may process data outside the European Economic Area, including in the United States. In such cases the transfer relies on the appropriate safeguards provided by the GDPR (e.g. standard contractual clauses or adequacy decisions).

7. Retention period

• Account data: until you delete your account.
• Content on your device (spots, trips, trails, catches, gear): under your control — it stays until you delete it, the App, or the App's data.
• Premium cloud backup: while your subscription is active. If your Premium access ends, the cloud copy is kept for a 90-day grace period (so you can resubscribe without losing it) and is then permanently deleted. Deleting your account deletes it immediately.
• Backend service logs (e.g. authentication events): for a limited period, for security purposes.

8. Security

• Passwords are stored hashed with a strong industry-standard algorithm (bcrypt).
• Communication with our servers uses an encrypted connection (HTTPS).
• Your login credentials are kept in your device's secure storage.

9. Your rights

Under the GDPR you have the right to:

• access your data;
• rectify inaccurate data;
• erasure ("right to be forgotten");
• portability (receive your data in a structured, machine-readable format);
• restrict or object to processing;
• withdraw your consent at any time.

You can delete your account directly in the App (Account screen); this permanently removes your account and any cloud data. You can also ask by email, without the App; we complete email requests within 30 days. Both ways are explained on the Delete your account page. For any other request, contact anglr.app@proton.me. You also have the right to lodge a complaint with the Hellenic Data Protection Authority (www.dpa.gr).

10. Children

The App is not intended for children under 15, and we do not knowingly collect data from such minors. If we become aware that we have collected such data, we will delete it.

11. Changes to this policy

We may update this policy. We will post the new version on this page with an updated date. Continuing to use the App after changes constitutes acceptance of them.

12. Contact

For privacy questions: anglr.app@proton.me.