Privacy Policy

Last updated: May 15, 2026

FishInsight is a free service built by UITL (User In The Loop). We believe in being straightforward about what we collect and why. This policy covers your use of fishinsight.ai.

Your Crew Data Is Yours

When you post a catch, photo, comment, or location to a crew, here's our promise:

• Visible only to your crew. Crew posts, photos, comments, and locations are shown to members of that crew. Nobody else — no other crew, no anonymous visitor, no public feed.
• Your spots stay your spots. We do not aggregate, sell, license, or redistribute crew content to third parties. We do not surface your honey holes in public fishing reports, area summaries, or marketing.
• We do not train AI on your crew content. Your posts, photos, and comments are not used to train, fine-tune, or improve any AI model — ours or anyone else's.
• A note on catches logged via Can I Keep This Fish?: if you also log a catch using our keep/release tool, that catch follows a separate, layered policy — see “Catches You Log” below. Crew posts and KTF logs are different data classes. Posts you make directly to a crew stay crew-only. Catches you log via KTF can optionally be shared to a crew, and may contribute to anonymous area-level statistics unless you opt out.
• You control location precision. Crew posts default to a ~1 mile blur on locations. You can change the default per crew, and override it per post. Exact coordinates are never inferred or unblurred by anyone outside your crew.
• One honest exception: when you attach a fish photo to a crew post, we automatically send that photo to Google's Gemini API once to suggest species and size. On our side, we don't store the photo with Google or send it elsewhere — it's sent solely to answer the species-ID question. How Google itself handles the inbound API request is governed by Google's Gemini API terms. To skip the AI step entirely, post without a photo — species, size, and other catch details work without one. (Photo or not, your post stays visible only to your crew.)
• You can delete it anytime. Remove individual posts from the crew feed, or email us to delete your account and everything tied to it.

Catches You Log

When you use Can I Keep This Fish? (or any future catch-logging tool), the catch becomes part of your personal account. Here's exactly what happens to it.

Three layers, three different rules

Layer 1 — Your personal log. Photo, exact location, species, date, kept-or-released, and the regulation we showed you at the time are saved to your account. Only you see this data. You can delete any catch from your log at any time, which removes it from layers 2 and 3 as well.

Layer 2 — Crew share (only if you choose). If you're a member of one or more crews, you can optionally share a logged catch with a specific crew at the moment you confirm it. When you do, the catch becomes a regular crew post — same rules as anything else in your crew (see “Your Crew Data Is Yours” above). Locations follow your crew's precision settings (default ~1 mile blur). Sharing is per-catch and OFF by default — we never auto-share.

Layer 3 — De-identified area aggregate. With your permission (toggleable per catch and globally in settings), the species and outcomeof your catch are added to FishInsight's anonymous area-level statistics. This is what powers heatmaps, “what's biting” insights, and predictions for other anglers.

What gets used in layer 3:

• Species (e.g., “Lingcod”)
• Marine Area number (e.g., “MA 9”)
• Outcome (kept or released)
• Day bucket (today / this week — never an exact timestamp)

What does NOT get used in layer 3:

• Your photo — photos never leave layers 1 and 2
• Your exact coordinates — only the Marine Area number
• Your name, crew membership, or any identifying detail
• Anything that could be tied back to you

Inference safeguards

Even de-identified data can leak information if mishandled. We've designed layer 3 with these defenses:

• Minimum 3 anglers: a public data point only appears once at least 3 different users have contributed to it. Prevents anyone from inferring a single user's catches.
• Time bucketing: stats show “today” or “this week” — never a specific time. Prevents timing-based inference.
• No coordinates ever: layer 3 only knows your Marine Area, not where in it you fished.
• Photos stay private: even for internal model improvement, photos do not leave layers 1 and 2.

Your controls

• Per-catch opt-out: at the moment you confirm a catch, you can untick “Contribute to area aggregate.”
• Global opt-out: in account settings, you can turn off aggregate contribution entirely. Existing logged catches are removed from layer 3 immediately.
• Catch deletion: deleting a catch from your personal log cascades — it's removed from any crew share AND from the aggregate.
• Account deletion: emailing us to delete your account removes all three layers.

How long we keep catch data

Today, we keep your logged catches (including photos) for as long as your account is active. We may introduce an automatic retention policy in the future — for example, auto-purging photos older than a certain age — to manage storage and reduce data we're holding. If we do, we will tell you before any default change takes effect, and you'll always be able to delete catches yourself in the meantime. Aggregate (layer 3) data, being de-identified and area-level, is not subject to per-user retention.

One honest exception (same as the crew section)

When you scan a fish, the photo goes briefly to Google's Gemini API to identify the species. We don't store the photo with Google or send it elsewhere. Google's handling of the inbound API request is governed by Google's Gemini API terms. To skip AI identification entirely, type the species manually instead of taking a photo — the regulation lookup still works.

What We Collect

Email address — provided when you sign in with Google or use a magic link. This is the only personal information we ask for.

Page views and usage data — we track which pages you visit, which areas you check, and how you use the report. This data is aggregated and used to improve the service.

Authentication session — we store a JWT session cookie (fi_session) that is httpOnly, secure, and expires after 30 days.

Catch logs (if you use Can I Keep This Fish?) — fish photos, species identification results, location coordinates, kept-or-released outcomes, and the regulations applicable at the time. Stored to your account with layered visibility per the “Catches You Log” section above.

Why We Collect It

Your email lets us identify your account so you can access the full fishing report. Usage analytics help us understand which features are useful and where to invest our time. We do not build advertising profiles or sell your information.

Third-Party Services

We use the following services to run FishInsight:

• Google OAuth — for sign-in. Google receives your authentication request but we do not share your FishInsight usage data with Google.
• Vercel — hosts the application. Subject to Vercel's privacy policy.
• Neon — PostgreSQL database for account and report data.
• Brevo — sends magic link emails. Your email address is shared with Brevo solely for delivery.
• Amazon Associates — gear links in our reports are affiliate links (tag: uitlventures-20). See below.

Amazon Affiliate Links

Some gear and bait links in our fishing reports point to Amazon via our Associates affiliate tag. We earn a small commission on purchases made through these links. This does not affect our recommendations — bait and gear suggestions come from AI analysis of actual catch data and local fishing reports, not from affiliate partnerships.

Cookies

We use a single authentication cookie (fi_session). It is httpOnly (not accessible to JavaScript), secure (only sent over HTTPS), and expires after 30 days. We do not use tracking cookies or third-party advertising cookies.

WDFW Data

Emergency regulation alerts are sourced directly from the Washington Department of Fish & Wildlife (WDFW) public RSS feed. We display this data as-is. For official regulation information, always visit wdfw.wa.gov.

AI-Generated Content

Fishing reports are generated by AI and may contain errors. We pull from real data sources (WDFW, NOAA, creel surveys, local reports, YouTube fishing channels) but the AI can misinterpret or hallucinate details. Always verify regulations at wdfw.wa.gov before fishing.

Data Retention

Your account data (email, display name) is retained as long as your account is active. Page view data is aggregated and not tied to individual users after processing. Catch logs are retained as long as your account is active; deleting individual catches removes them across all layers (see “Catches You Log” for the future-purge clause). If you want your account deleted, email us and we will remove it within 30 days.

We Never Sell Your Data

We do not sell, rent, or share your personal information with third parties for their marketing purposes. Period. This applies to crew posts, catch logs, account data, and any aggregated statistics derived from them. We never sell, license, or share your data — identifiable or otherwise — with marketers, data brokers, or other third parties.

Contact

Questions about this policy? Email us at fishinsight@uitl.ai.