Wersja polska · English version
Pora na Ryby Privacy Policy
Version of 5 November 2026. This is an English translation of the Polish policy; both versions have the same content.
This policy applies to the Pora na Ryby mobile app (Android) and the website poranaryby.pl (together: “the service”). Pora na Ryby is a free app with a map of fishing waters in Poland, a bite forecast and a private catch log.
1. Data controller
The controller of your personal data and the developer of the app is Paweł Dzieża (“we”, “us”). Contact for any personal-data matter: kontakt@poranaryby.pl.
2. What data we process, why, and for how long
| Data | Purpose and legal basis (GDPR) | Retention |
|---|---|---|
| Account: e-mail address, display name, password hash (Argon2id), Google/Apple account ID when you use social sign-in, date you accepted the Terms | Creating and running your account, syncing your catch log — Art. 6(1)(b) (contract) | Until the account is deleted |
| Catch log: species, size, date, fishing water, method, bait, notes, photos, weather; optionally the catch location (GPS) | Keeping your catch log — Art. 6(1)(b). Entries are private and visible only to you. | Until the entry or the account is deleted |
| Device location (only while the app is open) | Showing nearby fishing waters and the forecast — Art. 6(1)(b). For the weather forecast we send coordinates rounded to about 2 km. We do not store your location on the server (except catch locations that you save yourself). | Not stored |
| Spots saved in the app: name, note, species, position, assigned fishing water | Remembering your spots — Art. 6(1)(b). A spot is private until you share it. A shared spot is visible to signed-in anglers: pin, name, note and species, without your name or e-mail address. | Until the spot or the account is deleted |
| Bite reports: fishing water, time, species, position used to match the fishing water | Community feature — Art. 6(1)(b). Publicly we show only aggregated statistics (at least 3 reports from at least 2 people within 24 h). | Until the account is deleted |
| Notifications: Firebase Cloud Messaging device token, app version, chosen notification types and the list of favourite fishing waters stored on the phone | Sending notifications you turn on (good conditions on a favourite water, new app version, a reported bug fixed) — Art. 6(1)(a) (consent given in the phone system and in the app). Turn them off in the app: Account → Notifications. | Until notifications are turned off, the app is uninstalled or the account is deleted |
| App bug report: description, app version, phone model, OS version, text of recent error messages (without location), optionally e-mail | Fixing bugs — Art. 6(1)(f) (legitimate interest) | Up to 12 months |
| Photo sent for species recognition | Recognising the species on our server — Art. 6(1)(b). The photo is not shared with third parties. It is used to improve the model only with your consent (Art. 6(1)(a)), which you can withdraw at any time. | 24 hours; with consent — until it is withdrawn |
| Sign-up for app testing: Google account e-mail, optionally the area where you fish, and the text of your consent | Adding you to the Google Play testers group — Art. 6(1)(a) (consent), which you can withdraw by writing to the contact address. | Until closed testing ends or consent is withdrawn |
| Fishery listing submitted by its owner (“Dodaj swoje łowisko”): fishery details (name, type, town and municipality, place on the map, species, prices and rules, regulations link, opening hours, description, the fishery’s website, phone and e-mail), your first name and e-mail, and the text of your consent | Reviewing the submission and replying — Art. 6(1)(b) (steps taken at your request). Publishing the fishery details — Art. 6(1)(a) (consent), which you can withdraw by writing to the contact address; we then remove the listing. Your name and e-mail are never published. | Rejected: up to 12 months after the decision. Published: for as long as the listing is published, and your name and e-mail up to 12 months after it is removed |
| Reports of errors in our data (content, optionally e-mail) | Correcting information — Art. 6(1)(f) (legitimate interest) | Up to 12 months after handling |
| Technical data: IP address, server logs (without location parameters) | Security and abuse prevention — Art. 6(1)(f) | Up to 14 days |
| Page-view counter: the address of the page viewed and the name of the site you came from (e.g. google.com). We keep only a daily count, with no cookies, IP address or identifier — it cannot tell who you are | Improving the service — Art. 6(1)(f) (legitimate interest) | Aggregate numbers, no personal data |
3. Google user data (Sign in with Google)
This section explains how Pora na Ryby accesses, uses, stores, shares and deletes data received from Google when you choose “Continue with Google” in the app or on poranaryby.pl.
3.1 Data we access
After you consent on Google’s screen, we request only the basic sign-in scopes openid, email and profile. From them we receive:
- your Google account ID (the unique, non-public “sub” identifier),
- your e-mail address,
- whether Google has verified that e-mail address,
- your name as shown in your Google profile.
We do not request any other scopes and have no access to your Gmail, contacts, files, calendar, Drive, location history or any other Google data.
3.2 How we use it
- The Google account ID is used only to create your Pora na Ryby account and sign you in to it.
- The e-mail address identifies your account and is used for account messages (e.g. password reset); the verified flag tells us whether Google has confirmed the address.
- Your name is suggested as your display name; you can change it at any time.
- We do not use Google user data for advertising, profiling, selling, credit decisions, or to develop, improve or train AI/ML models.
3.3 How we store and protect it
The Google account ID, e-mail address and display name are stored with your account in our database on servers in the European Union (Hetzner Online GmbH, Germany), over encrypted (TLS) connections. We do not store Google access tokens.
3.4 Sharing
We do not sell, rent or share Google user data with anyone. It is not transferred to third parties except our EU hosting provider acting as processor under a data processing agreement, or where required by law. Other users never see your e-mail address.
3.5 Retention and deletion
Google user data is kept until you delete your account. Deleting the account (in the app: Account → “Delete account”, or on the account deletion page) permanently deletes the Google account ID, e-mail and name from our database; backups are overwritten within 14 days. You can also revoke the app’s access at any time in your Google Account (Security → Third-party apps and services) or ask us to delete your data at kontakt@poranaryby.pl.
3.6 Limited Use
Pora na Ryby’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
4. Who processes data on our behalf
- Hetzner Online GmbH (Germany) — server hosting in the European Union, under a data processing agreement (DPA).
- Resend, Inc. (USA) — sending transactional e-mails (e-mail confirmation and password reset) and notifying us of new fishery submissions, under a data processing agreement (DPA).
- Google / Apple — only if you choose to sign in with those accounts (we receive the account ID and e-mail address, see section 3).
- Google Ireland Ltd (Firebase Cloud Messaging) — delivers notifications to your phone; it receives the device token and the notification text, not your e-mail address.
- Google Ireland Ltd (Google Workspace and Google Play) — if you sign up for testing, your e-mail address is added to the testers group through which Google Play provides the test version.
Map tiles are loaded by the app and the website directly from OpenFreeMap servers — the provider then sees your IP address and the map area you view. Our server fetches weather forecasts from Open-Meteo and aerial imagery (orthophoto maps) from the Polish GUGiK Geoportal and stores them itself; in both cases without your personal data.
5. Your rights
- access to your data and a copy — in the app: Account → “Export my data” (JSON file),
- rectification, restriction of processing, objection,
- erasure — in the app: Account → “Delete account”, or on the account deletion page,
- data portability, withdrawal of consent at any time,
- a complaint to the Polish supervisory authority, Prezes UODO (uodo.gov.pl).
6. Security
Connections are encrypted (TLS). Passwords are stored only as Argon2id hashes. The app keeps sign-in tokens in the system’s secure storage. We strip metadata (including GPS coordinates) from photos — on the phone and again on the server.
Database and photo backups are made daily and kept for 14 days on servers in the European Union. Data deleted from the service disappears from backups after that time at the latest.
7. Cookies and browser storage
The website does not use tracking or advertising cookies. After you sign in on the website we set one strictly necessary session cookie (no personal data, not accessible to scripts). In browser storage we keep your chosen theme, wind unit, recently selected fishing waters and spots added on the website map. This data is not sent to our server; you can remove it by clearing site data in your browser.
We count page views ourselves, on our own server, without cookies or third-party tools. If your browser sends a "Do Not Track" or "Global Privacy Control" signal, your views are not counted at all.
8. Age
An account may be created by persons aged 16 or over.
9. Changes
We will announce material changes to this policy in the app and on this page.