Privacy policy

Last updated: 2026-07-08

FishMap respects your privacy. This policy explains what personal data we collect, why we need it, what legal basis we rely on, and the rights you have under the EU General Data Protection Regulation (GDPR).

1. Data controller

The data controller is FishMap (operated by Filip Nyman). Contact us at hej@fishmap.se with questions about your data or this policy.

2. Data we collect

  • Account data: email address, hashed password and your chosen username.
  • Content you upload: catches (species, weight, length, method, GPS, water, photos), tips, fishing sessions and comments.
  • Profile info: home region/country (optional), avatar (optional), XP, achievements and catch stats.
  • Communication preferences: your marketing email opt-in and a unique unsubscribe token used in email unsubscribe links.
  • Donations / support: if you choose to support FishMap through Stripe, card and payment details are handled by Stripe. We never store card numbers — only Stripe's customer and payment IDs and the fact that a payment succeeded.
  • Technical data: browser type, device, approximate region from IP and timestamps in server logs.
  • Cookies & local storage: login session cookie, theme preference, cookie consent, your saved favourite lakes, last-selected map layers and small UI settings (e.g. trip planner radius).

3. Why we process your data (purposes and legal basis)

  • Provide the service (account, map, catches) — legal basis: contract (Art. 6(1)(b) GDPR).
  • Display catches, leaderboards and tips publicly — contract; this is the core of the service you signed up for.
  • Send transactional email (verification, password reset, donation receipts) — contract.
  • Send tenure-based product emails (e.g. onboarding tips after 1 day/week/month) — legitimate interest for existing users, with an unsubscribe link in every message. Pure marketing emails require explicit consent.
  • Process donations via Stripe — contract and legal obligation (accounting).
  • Security, operations and debugging — legitimate interest (Art. 6(1)(f)).
  • Improve the service via analytics — only with your consent (Art. 6(1)(a)) via the cookie banner.

4. What is public

Username, catches (including GPS coordinates and photos), tips and achievements are public on the map, leaderboards and your profile. Email, password, marketing consent and private session notes are never public.

5. Recipients and processors

We use the following processors to deliver the service:

  • Lovable Cloud / Supabase — database, authentication and file storage, hosted in the EU.
  • Lovable / Cloudflare — web hosting, CDN and edge runtime.
  • Stripe — payments for donations/support (handles card and payment data as an independent controller).
  • Resend — delivery of transactional and product emails.
  • Google Ireland Ltd / Google LLC — Google Analytics 4 for aggregated usage stats (only with analytics consent) and Google AdSense for advertising (only with marketing consent). Google acts as an independent controller for each service.
  • Weather and map data providers — SMHI, Open-Meteo, NWS, Esri, OpenStreetMap and others receive requests with the coordinates you choose to view; no personal data is shared.

We never sell your data. Aside from ad serving via Google AdSense, we do not share your data with third parties for marketing.

Some pages contain affiliate links to fishing tackle retailers (e.g. Sportfish, via the Rakuten Advertising network) — such links are always clearly marked. If you click through and make a purchase, FishMap may earn a commission. Clicking such a link does not share any personal data from FishMap — you simply navigate to an external site, which has its own privacy policy.

6. Retention

  • Account and content data: as long as your account exists.
  • When you delete your account, all personal data, catches, tips and photos are removed immediately.
  • Payment transactions (donations): retained as long as accounting law requires (typically 7 years).
  • Server logs: 30 days max.

7. Your rights

Under GDPR you have the right to:

  • request a copy of your data (access and portability),
  • have inaccurate data corrected,
  • delete your account and data (the "right to be forgotten"),
  • object to or restrict certain processing,
  • withdraw your consent at any time (marketing emails can be unsubscribed via the link in every message or from your profile),
  • file a complaint with the Swedish Authority for Privacy Protection (IMY) at imy.se.

You can export or delete your data directly from your profile.

8. Cookies and local storage

We use as few cookies as possible, grouped in three categories:

  • Necessary (always on): login session, CSRF protection, cookie consent, theme preference, favourite lakes and other UI settings stored locally in your browser.
  • Analytics (requires consent): aggregated usage stats. We use Google Analytics 4 (provider: Google Ireland Ltd, Google LLC). The script is only loaded if you consent to analytics cookies. IP addresses are anonymised and we do not share the data with third parties for marketing. Transfers to the US rely on the EU-US Data Privacy Framework and the EU Commission's Standard Contractual Clauses. Cookies used: _ga, _ga_<ID>, _gid (up to 24 months).
  • Marketing (requires consent): we serve ads via Google AdSense (provider: Google Ireland Ltd, Google LLC) and measure ad performance. The script only loads if you consent to marketing cookies — without consent, no ads are shown at all. Google and its partners may set cookies to serve ads based on prior visits to this and other sites. You can opt out of personalised advertising at any time at google.com/settings/ads or read more about how Google uses data at policies.google.com/technologies/partner-sites.

9. Fishing Buddy (optional social feature)

Fishing Buddy lets adult users (18+) find each other via a swipe-based card deck. The feature is always optional and can be enabled or turned off at any time.

  • Legal basis: your active consent (Art. 6(1)(a) GDPR).
  • What we store: that you have opted in, a timestamp for the 18+ confirmation, your choices for what may be shared on a match (email/Instagram), a short bio, favourite species/method, experience level, whether you have a boat, what you are looking for and a rounded location.
  • Location: your device rounds your GPS to ~5 km before it leaves the browser. We never store precise GPS, and others only see a distance in km — never coordinates, a map or an address.
  • What others see about you: your username, avatar, bio and the info you filled in on the buddy profile — only while your profile is active (not paused).
  • What happens on a match: when two people like each other, the contact channels each of them has ticked (email and/or Instagram) are shown — only between the two matched users. We never email out contact details, and we never share contact info without a match.
  • Block and report: you can always block a user or report inappropriate behaviour. Blocked users disappear from your deck and cannot match you again.
  • Pause or delete: pausing hides your profile from others without deleting it; deleting removes your profile, swipes and matches immediately.

10. Security

Passwords are stored hashed. All traffic is encrypted with HTTPS. Database access is protected by Row Level Security so each user can only modify their own data.

11. Children

FishMap is not intended for children under 13. Fishing Buddy additionally requires you to be at least 18.

12. International transfers

Data is primarily processed inside the EU/EEA. Some processors (Cloudflare, Stripe, Resend) may process data in the US or other countries outside the EEA; such transfers rely on the EU Commission's Standard Contractual Clauses (SCC) together with supplementary safeguards. FishMap also operates the English-language site getfishmap.com for users outside Sweden; the same controller and safeguards apply there.

13. Changes

We may update this policy. Material changes are announced in-app.

14. Contact

Questions about your data? Email hej@fishmap.se.