Piscatorium
Personal Data Protection Notice
Under the Turkish Personal Data Protection Law No. 6698: which data is processed on the site and in the mobile app, for what purpose and on which legal basis.
This translation is provided for information only. The binding text is the Turkish version.
1. Data controller
Piscatorium
piscatoriumapp@gmail.com
The persons authorized on behalf of the data controller and the addresses to which applications can be sent:
2. What does this text cover?
Piscatorium is a website and a mobile app. The table below covers both at once. No account is needed to read the site only; when you open an account, log a catch or move to Pro membership, the data processed grows.
3. The personal data processed and its purposes
3.1 Without an account, just browsing the site
| Data | Purpose | Legal basis (Art. 5) |
|---|---|---|
| Session and security cookie | Verifying forms against forgery (CSRF) | Legitimate interest (Art. 5/2-f) |
| Server and network access logs — IP address, browser information, requested address | Debugging, security, abuse detection | Legitimate interest (Art. 5/2-f) |
| Analytics cookies and identifiers | Measuring page usage | Explicit consent — nothing is loaded at all while analytics is off |
| Email address, IP and browser information (waiting list) | Announcements; telling automated sign-up attempts apart | Explicit consent — given as you submit the form |
3.2 When you open an account
| Data | Purpose | Legal basis (Art. 5) |
|---|---|---|
| Name, email address, password hash | Account identity and sign-in | Performance of a contract (Art. 5/2-c) |
| Profile address (a short name derived from your name) | Your public profile page | Performance of a contract (Art. 5/2-c) |
| Profile photo | Showing it on your profile | Explicit consent — uploading one is not required |
| The version of the text you accepted and the time of acceptance | Proof of your consent | Legal obligation (Art. 5/2-a) |
| “Remember me” cookie | Keeping the session open | Legitimate interest (Art. 5/2-f) |
| If you signed in with Google or Facebook: the name, email and account ID coming from that service | Opening and matching the account | Explicit consent — your choosing that route |
Your email address is not verified: we do not send a verification link to the address when you open an account. This means we do not confirm that the address belongs to you.
3.3 When you log a catch
| Data | Purpose | Legal basis (Art. 5) |
|---|---|---|
| The location of the catch — the exact coordinates | Your fishing log and the catch score calculation | Explicit consent — location consent is taken separately |
| The approximate location of the catch and the privacy radius | Blurring the spot when you share the log | Explicit consent |
| Date, time, species, technique, tackle, your notes | Fishing log | Performance of a contract (Art. 5/2-c) |
| The photos you upload | The image of the catch log | Explicit consent |
| The weather, sea and moon/sun data at the moment of the log | Catch score and comparison | Performance of a contract (Art. 5/2-c) |
The photos you upload are re-encoded on the server and all embedded metadata is dropped — the GPS coordinates, the device model and the serial number included. This holds both for catch photos and for the profile photo.
3.4 When you use the community features
| Data | Purpose | Legal basis (Art. 5) |
|---|---|---|
| Your comment, like, follow and block records | The community feed | Performance of a contract (Art. 5/2-c) |
| The content reports you send | Moderation | Legitimate interest (Art. 5/2-f) |
| Your notifications and notification preferences | Showing you notifications | Performance of a contract (Art. 5/2-c) |
| Device notification token | Sending push notifications to the phone | Explicit consent — when you grant notification permission |
3.5 When you move to Pro membership
| Data | Purpose | Legal basis (Art. 5) |
|---|---|---|
| Subscription status, start and end date, store identifier | Unlocking the Pro features | Performance of a contract (Art. 5/2-c) |
| Your user identifier sent to the subscription infrastructure | Matching the subscription with your account | Performance of a contract (Art. 5/2-c) |
Your card details never reach us. Payment is completed in the system of the store you downloaded the app from (App Store or Google Play).
4. The permissions the mobile app asks for
- Location — only while the app is open. To show where you are on the map and to add a location to a catch log. Your location is not tracked in the background.
- Photos — to pick a catch photo and a profile photo.
- Notifications — to send you notifications. If you decline, the app keeps working and you see the notifications inside the app.
All three can be declined and can be withdrawn later from the device settings.
5. Special categories of personal data
Special categories of personal data such as health, biometrics, religion and political opinion we do not process in any way and we do not ask for them. Please do not put such data into the text and images you upload.
6. Method of collection
The data is collected entirely by electronic means: the forms you fill in directly (sign-up, catch log, comment, waiting list), the permissions you grant in the mobile app, and the records created automatically while you use the site (cookies, server logs).
7. Transfer
Personal data is not sold and not transferred to third parties for marketing purposes. The service providers below see some of the data as a requirement of running the site and the app:
Google Analytics 4
- What for:
- How much each page is read
- Data it sees:
- Cookie identifier, pages visited, device and approximate location
GA4 does not store your full IP address. The admin panel is excluded from measurement.
Microsoft Clarity
- What for:
- Heatmaps and session recording — clicks, scrolling and mouse movement
- Data it sees:
- Cookie identifier, pages visited, click and scroll activity, device and browser information, IP address
Text on the page is masked by default; what you type into form fields is not recorded. The admin panel is excluded from measurement.
Ahrefs Web Analytics
- What for:
- Page view and referring site measurement
- Data it sees:
- IP address, page visited, referring address, browser information
Does not use cookies. The admin panel is excluded from measurement.
Esri (World Imagery)
- What for:
- Satellite imagery tiles on the map
- Data it sees:
- Your IP address and which map tile you are viewing
The tile request goes directly from your browser; our server does not relay it.
OpenStreetMap
- What for:
- The street base layer of the map
- Data it sees:
- IP address and tile requests
Only when you select the “Street” base layer.
EMODnet Bathymetry
- What for:
- Sea depth layer
- Data it sees:
- IP address and tile requests
Only when you turn on the depth layer.
Some of these providers are located abroad; the transfer is unavoidable in order to receive the service and is carried out within the scope of Art. 9 of the KVKK.
Weather and sea data
Our own server fetches this data and we serve it from our own address. Your browser never talks to the data provider; none of your information is sent outside. The fonts are hosted on our own server too, so no font request goes out.
Map imagery
The satellite and street imagery on the map is made up of image tiles your browser downloads itself, as on every web map. We send no personal information to the provider in that request — only your device’s IP address and which tile was requested are visible, as in every request on the internet. Your name, your email or any other information of yours is not part of those requests.
Advertising
Ads are shown to free users in the mobile app. The ads are not personalized: we do not send an interest profile to the ad network. The ad network still sees your device’s advertising identifier and IP address. No ads are shown with Pro membership.
8. Retention period
- Account data: until you delete your account.
- Your catch logs, your photos and your community content: until you delete your account.
- Catch photo files: removed from disk within thirty days at the latest after the account is deleted.
- Waiting list records: until the announcement is sent; deleted immediately on request.
- Session data: after 120 minutes of inactivity.
- “Remember me” cookie: at most 400 days.
- Server access logs: for the hosting infrastructure’s own cycle.
- Administrator accounts: until the account is closed.
9. What happens when you delete your account?
Account deletion is done from the account screen in the app and cannot be undone. After the deletion request:
- Your account and your content (your catch logs, your rod setups) are closed to access and appear on no surface.
- Your profile photo is deleted from disk immediately.
- Your catch photos are removed from disk within thirty days at the latest.
- Your likes, your follow relationships, your notifications, your comments and your device notification tokens are permanently deleted.
- In moderation records such as the feedback and the location reports you sent the row remains, but its link to you is severed.
10. Your rights (Art. 11)
Pursuant to Article 11 of the Law:
- To learn whether your personal data is being processed,
- To request information about it if it has been processed,
- To learn the purpose of the processing and whether the data is used in accordance with that purpose,
- To know the third parties in Türkiye or abroad to whom the data is transferred,
- To request correction if the data has been processed incompletely or inaccurately,
- To request erasure or destruction within the framework of the conditions set out in the Law,
- To request that the correction, erasure and destruction operations be notified to the third parties to whom the data was transferred,
- To object to a result to your detriment arising from analysis of the data exclusively by automated systems,
- To claim compensation for the damage if you suffer damage due to unlawful processing
— these are the rights you have.
11. Applications
You can send your requests to any of the addresses above. Your application is concluded within thirty days at the latest. So that your identity can be verified, you have to send your application from your registered email address.
Last updated:
