Website Privacy Policy

This translation is provided for information only. The binding text is the Turkish version.

This Privacy Policy explains which data is collected on the Piscatorium website, for what purpose it is used, to whom it is transferred, how long it is kept and what rights you have in this regard. There is a separate policy for the mobile app: Mobile App Privacy Policy.

The legal bases under Law No. 6698 on the Protection of Personal Data (KVKK) in force in Türkiye and the application procedure are set out separately in the KVKK Data Protection Notice. If you are connecting from outside Türkiye, see section 10 for the rights specific to your country.

1. Scope

Piscatorium is a website and mobile app published to provide information about weather and sea conditions, fishing grounds, fish species and recreational fishing regulations. This policy covers the website. Because the same account can be used on the site and in the app, the sections on the account, catch logs, the community, transfers, security, account deletion and rights are the same in both policies.

No account is needed just to read the site, and no location permission is asked for. When you open an account, log a catch or use the community features, the data collected grows; below, it is written out separately which of these comes into play when.

2. Data collected

2.1 For everyone

• Session cookie. Needed to verify forms against forgery (CSRF). The site does not work without it.
• Server access logs. IP address, browser information and the requested address; kept by the hosting infrastructure. Their purpose is debugging and abuse detection.
• Analytics. If analytics is on, page usage is measured; if it is off, the analytics code is never sent to your browser. The cookie table below shows this live.

2.2 If you join the waiting list

• Your email address. Used only to send the announcement. It is not added to a marketing list and is not given to third parties.
• IP address and browser information. Kept in order to tell automated sign-up attempts apart; not used for any other purpose.

2.3 If you open an account

• Name, email address and password hash. The password itself is never kept in the clear anywhere. No verification link is sent to your email address when you sign up. Only when you link a social sign-in account to an existing account opened with the same email address, and the provider has not verified that address, is an email sent so that you can confirm linking the accounts.
• Your profile address. It is a short name derived from your name and appears in the public address of your profile.
• Your profile photo, if you upload one. It is re-encoded on upload and its embedded metadata (including GPS) is dropped. You can turn off showing it on your profile.
• The version of the text you accepted and the time of acceptance. Kept as proof of consent.
• If you signed in with Google, Facebook or Apple, the name, email address and account ID coming from that service.

Your profile is public. Your name, your profile photo and the catch logs you share publicly can be seen by everyone, including visitors who are not signed in. There is currently no setting that hides the profile completely.

2.4 If you log a catch

• Location. The location of each catch log is held at three separate levels of precision: the exact coordinates you enter, an approximate point derived from them, and the option of not being shown at all. When you share the log, you decide which one is visible; the default is hidden.
• Photos. They are re-encoded on the server and all embedded metadata is dropped — including GPS coordinates, device model and serial number. The profile photo goes through the same process.
• Date, time, species, length and weight, technique, tackle and your notes, as well as the weather, sea and moon/sun data at the moment of the log.

2.5 If you use the community features

Your comments, your likes, the people you follow, the people you block and the reports you send are recorded. Commenting and liking are only possible on catch logs shared publicly.

2.6 Administrator accounts

The name, email address and password hash of panel users are stored.

3. What the data is used for

• To open your account, verify your identity and provide the service
• To run the fishing log, map and community features
• To ensure security; to detect fake entries, automated access and abuse
• To review content reports and carry out moderation
• Only with your explicit consent: to carry out analytics on the website and to send the announcement to the waiting list
• To fulfil legal obligations

Your data is not sold. Your catch logs, photos and notes are not used for advertising, marketing or profiling purposes and are not shared with third parties for these purposes.

4. Cookies

This list is not fixed: it is generated from the site’s current configuration. If analytics is off, the analytics cookie does not appear in the list and is never sent to your browser either.

When you sign in, a session persistence cookie is also set; it keeps you signed in when you close and reopen your browser and lives for at most 400 days. You can also manage your cookie preferences in your browser or device settings.

5. Third parties

No data is sent out on your behalf. The following services come into play as required for the site to work:

The list above shows the services actually loaded on the site at that moment. In addition, the following providers are used on the site: content delivery network and security provider (Cloudflare), email delivery provider (Mailgun, European Union region) and social sign-in providers (Google, Meta, Apple). The data each of them receives and its purpose are set out in a table in the transfer section of the KVKK Data Protection Notice. The measurement, crash reporting, notification, advertising and subscription services integrated into the mobile app are described in the Mobile App Privacy Policy.

If you buy Pro on the website, the order, payment and invoicing are handled by Paddle.com as merchant of record. You enter your card details directly on Paddle’s checkout; they never reach us. Paddle receives your email address, country and order details, and the subscription platform (RevenueCat) that serves the checkout page and links the subscription to your account receives your account ID. Paddle processes this data as a separate controller under its own privacy notice.

The AI narration and assistant (on the website, for members) run on the Claude API of Anthropic, PBC (USA). Anthropic receives only what is needed for the answer: the forecast results for the spot you chose, weather and sea conditions, species and regulation details, the question you type to the assistant and the earlier messages of the same conversation; with Pro, for the personal narration, a summary of your own catches at that spot (date, species, count, conditions that day). Your name, email address, account ID and the exact location of your catches are not sent. Anthropic processes this data to generate the response under its own privacy policy and does not use it to train its models; the answers are estimates, not facts.

Weather and sea data is not obtained directly from a third party: our server collects it and serves it to your browser from our own address. The fonts also come from our own server; no font request goes out.

6. Retention periods

• Your account and content: until you delete your account.
• Catch photo files: at most thirty days after the account is deleted.
• Waiting list: until the announcement is sent; afterwards deleted on request.
• Session records: dropped after 120 minutes of inactivity.
• Session persistence cookie: at most 400 days.
• Server access logs: for the hosting infrastructure’s own cycle.
• Administrator accounts: until the account is closed.

7. Transfer abroad

Some of the providers listed above are located abroad; the transfer is unavoidable in order to receive the service and is carried out within the scope of Article 9 of Law No. 6698. No special categories of personal data are transferred abroad. For transfers from the European Economic Area, the Standard Contractual Clauses approved by the European Commission or other appropriate safeguards are relied on to the extent required.

8. Security

Appropriate technical and administrative measures are taken to protect personal data: passwords are stored only as an irreversible hash, traffic is carried over an encrypted connection (HTTPS), the embedded metadata of uploaded photos is dropped, access to the data is limited to a small number of people who need it for their duties, and backups are made.

Nevertheless, no method of transmission over the internet or of electronic storage provides absolute security. You are responsible for keeping your account password confidential and for the security of your device.

9. Deleting your account

You can delete your account in two ways: from the account screen in the mobile app, or without the app by signing in at piscatorium.com and using the delete section of the Account page. If your account has no password (accounts opened with Google, Facebook or Apple), you confirm the deletion by typing your account’s email address instead. If you cannot sign in, write to the address on the contact page from the email address registered in your account. The action cannot be undone. Your account and your content are closed to access, your profile photo is removed from disk immediately and your catch photos within thirty days at the latest; your likes, follows, notifications and comments are permanently deleted. If you signed in with Apple, the app’s authorization in your Apple account is also revoked. Details are in the KVKK Data Protection Notice.

10. Your rights depending on your country

10.1 Türkiye

Your rights under Article 11 of Law No. 6698 and the application procedure are set out in detail in the KVKK Data Protection Notice. Your application is concluded within thirty days at the latest.

10.2 European Economic Area, United Kingdom and Switzerland

If you are in these countries, you have the right to access your personal data, to request its rectification, erasure or the restriction of its processing, to object to its processing and to receive your data in a portable format. Where processing is based on consent, you can withdraw your consent at any time. You also have the right to lodge a complaint with the data protection authority of the country you are in.

10.3 California residents

Under the CCPA and CPRA you may have the rights to know, to correct, to delete and to non-discrimination. We do not sell your personal information and do not share it for behavioral advertising purposes.

10.4 Other countries

If you use the service from outside Türkiye, your data may be transferred to and processed in the countries where our service providers are located, including Türkiye, the European Union and the United States of America.

Whichever country you are in, you can submit your requests by writing to the address on the contact page. So that your identity can be verified, you must send your application from the email address registered in your account.

11. Children

The service is not directed at children. To open an account and share content, you must be at least 18 years old or have the consent of your parent or guardian. This rule applies even if the age limit set for consent to online services in your country is lower. When we learn that data belonging to a person under the age limit is being processed, the relevant record is deleted.

12. Changes and languages

This policy may be updated in line with changes to the service or to legislation. In the case of significant changes, additional notice may be given within the app.

Versions of this text in other languages are provided for convenience only. In the event of any conflict between a translation and the Turkish text, the Turkish text prevails.

Last updated: 08 October 2026