Privacy Policy
Last updated: 26 October 2026
1. Who we are
Agonist Development AB ("we", "us", "our") operates FisherGuy and the website fisherguy.app. We are a limited company (aktiebolag) registered with the Swedish Companies Registration Office (Bolagsverket) under org.nr 559471-7849, with its registered office at Offerdalsgatan 3, 162 64 Vällingby, Sweden.
For privacy questions: [email protected] · For general contact: [email protected]
We are the data controller under the General Data Protection Regulation (GDPR — EU Regulation 2016/679).
2. What data we collect, and why
FisherGuy is designed to collect as little data as possible. The categories below correspond exactly to the declarations in our App Store privacy label and our iOS PrivacyInfo.xcprivacy manifest.
| Data category | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Email address | Account registration, sign-in, password recovery | Contract (Art. 6.1.b) | Until account deletion |
| Precise location | Show nearby fishing spots within radius of your position | Consent (Art. 6.1.a) — only when you grant iOS permission | Not stored server-side; only used in real time |
| Photos & videos | Attach catch photos to your logbook | Consent (Art. 6.1.a) | Until you delete the catch or the account |
| User ID (internal) | Identify your account across devices, sync catches, anonymize analytics | Contract (Art. 6.1.b) | Until account deletion |
| Product interaction (anonymous) | Understand which features are used, fix bugs, improve UX | Legitimate interest (Art. 6.1.f) — pseudonymized | Up to 24 months in aggregated form |
| Crash data (anonymous) | Diagnose app crashes and ship fixes | Legitimate interest (Art. 6.1.f) | 90 days |
FisherGuy does not collect: contacts, calendars, microphone audio, advertising identifiers (IDFA), browsing history, contacts from other apps, or financial data. There is no cross-app or cross-site tracking.
3. Sub-processors
We rely on the following infrastructure providers. Each is bound by a Data Processing Agreement (DPA) under GDPR Art. 28.
| Provider | Data processed | Location |
|---|---|---|
| Cloudflare (Pages, DNS, R2 object storage) | Website hosting, catch-photo storage, edge caching | EU (Frankfurt) + global edge |
| Cloudflare (Workers, anonymous AI proxy) | Routes AI chat queries + approximate location to the AI providers listed below for signed-out users | Global edge network |
| Self-hosted backend (Senko VPS, EU) | Account data, catches, feed activity, AI proxy (signed-in users) | EU (Helsinki) |
| Apple App Store + Sign in with Apple | App distribution, subscription billing, authentication | EU + US (Standard Contractual Clauses) |
| PostHog (self-hosted on our infrastructure) | Anonymized product analytics | EU (Helsinki) |
| Anthropic, PBC (AI provider 1 of 2, primary: Claude Haiku model) | The text of your question, your region, travel mode (car or on foot), approximate location (coordinates rounded to about 1 km) and a place label. Not sent: account ID, name or email. Sent only after you acknowledge the in-app AI consent screen. See section 3a. | United States and possibly other countries outside the EU/EEA (inference may run globally); Standard Contractual Clauses |
| Cloudflare Workers AI (AI provider 2 of 2, fallback only: Meta Llama open-weight models) | The same data as above, used only if the primary provider returns an error. Sent only after you acknowledge the in-app AI consent screen. See section 3a. | Global edge network (Standard Contractual Clauses) |
| Adapty (subscription management — only if you subscribe) | Subscription receipts | EU + US (SCC) |
3a. AI providers: what is sent and what happens to it
When you ask the AI assistant for fishing-spot recommendations, our backend sends your request to a third-party AI provider. Before your first AI request the app shows a disclosure and asks for your consent; nothing is sent to an AI provider until you agree, and you can withdraw consent at any time in Settings.
- Provider 1, primary: Anthropic, PBC (Claude Haiku model). Anthropic privacy policy.
- Provider 2, fallback only: Cloudflare Workers AI (open-weight Meta Llama models), used only if Anthropic returns an error. Cloudflare privacy policy.
Data sent to the provider: the text of your question, your region/jurisdiction, your travel mode (car or on foot), your approximate location (coordinates rounded to two decimals, roughly 1 km) and a place label. We do not send your account ID, name or email address.
What we keep: while the AI feature is being tuned, our backend stores each request linked to your account: the text of your question, your region and travel mode, your approximate location (rounded to about 11 km), a summary of the answer (message and suggested spot names), response time and token counts. These records are deleted when you delete your account.
What the providers state about retention and training (their own published terms; we do not control them):
- Anthropic, Commercial Terms (effective 17 June 2025, checked 26 October 2026): "Anthropic may not train models on Customer Content from Services." Anthropic's data-retention article (checked 26 October 2026) states that it automatically deletes inputs and outputs from its backend within 30 days of receipt or generation, subject to listed exceptions such as legal compliance and Usage Policy enforcement.
- Cloudflare, Workers AI data usage (checked 26 October 2026): "Cloudflare does not use Customer Content processed by Workers AI to train AI models", and for standard inference requests it does not retain inputs or outputs after they are no longer needed to process the request.
Location of processing: Anthropic processing may take place outside the EU/EEA, including in the United States; Cloudflare Workers AI runs on Cloudflare's global network. See section 8 for the transfer safeguards. The legal basis for sending this data to the providers is your consent (GDPR Art. 6.1.a), given on the in-app AI consent screen.
4. Your rights (GDPR Art. 15–22)
Under GDPR you have the right to:
- Access the personal data we hold about you (Art. 15)
- Correct inaccurate or incomplete data (Art. 16)
- Delete your data — the "right to be forgotten" (Art. 17)
- Restrict processing (Art. 18)
- Export your data in a portable format (Art. 20)
- Object to processing based on legitimate interest (Art. 21)
- Withdraw consent at any time, without affecting prior lawful processing
To exercise any right, use Profile → Delete Account in the app, or email [email protected]. We respond within 30 days as required by Art. 12.
5. Right to lodge a complaint
You may lodge a complaint with a supervisory authority if you believe we have violated your data protection rights. You may also contact the authority in your EU country of residence.
6. Children
FisherGuy is rated 13+ on the App Store because it includes user-generated catch content and location-based fishing features. We do not knowingly collect data from children under 13. If you believe a child has provided us data, contact [email protected] and we will delete it.
7. Automated decision-making
The AI recommends fishing spots based on your queries. These are informational suggestions, not decisions with legal effect (GDPR Art. 22 does not apply). You retain full control over which spots to visit.
8. International transfers
Some sub-processors (Anthropic, Cloudflare, Apple) are based outside the EEA, and Anthropic's AI processing may run outside the EU/EEA (see section 3a). Transfers are protected by the EU Commission's Standard Contractual Clauses (SCC) and supplementary safeguards.
9. Security
We use TLS 1.3 for all network connections. Passwords are stored with bcrypt (work factor 12). JWT access tokens are short-lived (15 minutes). Refresh tokens rotate with replay detection. Backups are encrypted at rest.
10. Changes to this policy
We will update this policy when material changes occur. The "last updated" date at the top reflects the latest revision. For significant changes affecting your rights, we will notify you by email and inside the app.
11. Contact
Agonist Development AB · Offerdalsgatan 3, 162 64 Vällingby, Sweden · [email protected] · [email protected] · +46 76 344 81 84