BiteCast Privacy Policy

The controller responsible for processing personal data in connection with the BiteCast website and app is:

We are not legally required to appoint a data protection officer. Please use the contact details above for privacy questions or to exercise your rights.

This policy applies to bitecast.de and the BiteCast mobile app.

BiteCast is a digital catch log with community features. You can record catches, upload photos, use automated fish identification, publish posts and comments, subscribe to paid plans and optionally save catch locations.

• Art. 6(1)(a) GDPR (consent) – for example location access, PostHog analytics, push notifications and Google Ads conversion tracking on the website.
• Art. 6(1)(b) GDPR (contract) – for example your account, catch log, community features and subscriptions.
• Art. 6(1)(f) GDPR (legitimate interests) – for example technical operation, IT security and abuse prevention.
• Section 25(1) TDDDG – non-essential storage of or access to information on your device, only with consent.
• Section 25(2) no. 2 TDDDG – strictly necessary access, such as session and login information.

You may withdraw consent at any time with future effect. Processing carried out before withdrawal remains lawful.

The website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Vercel processes data such as your IP address, access time, requested pages, transferred data, browser, operating system, device information and referrer URL.

We also use Vercel Web Analytics for privacy-conscious audience measurement. Page views, technical device information, referring page and approximate location may be processed. We do not use this data to create personal advertising profiles.

A Nextras live counter sends only the requested path, timestamp and, where available, the domain of the external referrer to our dashboard. It does not set a persistent user ID, send your IP address to the dashboard or connect the event to an account. It is used only for a current aggregate visitor count; events are not retained permanently. “Do Not Track” is respected.

Processing is based on Art. 6(1)(f) GDPR. Our legitimate interests are the secure, stable operation and improvement of our website. Vercel acts as our processor under Art. 28 GDPR. See section 19 for transfers to the United States.

Most app features require an account. You can register using email, Sign in with Apple or Sign in with Google. We process:

• name or display name, email address and date of birth;
• user ID, login method and technical login/security data; and
• optional profile information such as a photo, bio and preferred fishing methods.

Apple provides your name and email address. If you hide your email, we receive an Apple relay address. Google may provide your name, email and profile photo. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, is responsible for Google's own processing.

We use date of birth only to check age requirements, not for advertising or profiling. The legal basis is Art. 6(1)(b) GDPR and, for age checks and security, Art. 6(1)(f) GDPR.

We use Supabase Inc. for authentication, database services, file storage and synchronisation. Project data is stored in North EU (Stockholm, Sweden).

• account and authentication information;
• catch log entries, including location data;
• photos, community posts, comments, reactions and reports;
• profile information and technical logs such as IP addresses and timestamps.

Supabase processes this data on our behalf under an Art. 28 GDPR data processing agreement. The legal bases are Art. 6(1)(b) GDPR for app functions and Art. 6(1)(f) GDPR for secure operation.

When you record a catch, we may process:

• fish species, length, weight and other fish details;
• date, time, water body and optional catch coordinates;
• method, bait, rig, equipment, notes and free text;
• weather/environmental data, photos and visibility setting; and
• creation/modification times and the link to your user ID.

We use this data to provide your catch log, statistics and, if you choose, community posts. The legal basis is Art. 6(1)(b) GDPR and, for location data, additionally Art. 6(1)(a) GDPR.

We process the image, file size, format, upload time and its association with an account, catch or post. EXIF metadata, including possible GPS coordinates, is removed automatically before upload.

Photos are stored in Supabase object storage. Private catch photos are available only to you; community photos are visible to other users. We do not routinely view photos. Access occurs only for troubleshooting, support or review of reported violations.

If you use fish identification, the selected photo is sent to Google. The legal basis is Art. 6(1)(b) GDPR and, for moderation and abuse checks, Art. 6(1)(f) GDPR.

Fish identification is optional and starts only when you request it. The selected photo is sent to the Google Gemini API to estimate the fish species.

Recipients are Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and its affiliates, in particular Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We use a standard Gemini API configuration without restriction to an EU processing region. Processing outside the EU/EEA may therefore occur.

• the selected image and the app's prompt;
• request time, IP address of the requesting system and model parameters; and
• the model's response.

We use a paid service with active cloud billing. Under the applicable terms, Google does not use API inputs and outputs to train or improve its AI models. Limited processing or retention may still occur to provide and secure the service, prevent abuse and comply with law.

The legal basis is Art. 6(1)(b) GDPR and, where separately requested, Art. 6(1)(a) GDPR. If you do not want this transfer, do not use the feature; the rest of the catch log remains available.

Do not upload identifiable people without consent or sensitive, confidential or third-party content. AI results may be wrong and do not replace expert identification, especially for closed seasons, minimum sizes or protected species. There is no decision under Art. 22 GDPR.

11.1 Collection on your device

Location access is optional and requires your permission. It is used for catch locations, weather, place and water-body names, and nearby points of interest. The legal basis is Art. 6(1)(a) GDPR and section 25(1) TDDDG. You may withdraw access and delete stored locations.

11.2 Weather: Open-Meteo

The app requests weather directly from OpenMeteo GmbH, Hintere Schilligmatte 6, 6463 Bürglen (UR), Switzerland. Coordinates, device IP address, time, requested parameters and time zone are transferred, but no account data, name or photos. The legal bases are Art. 6(1)(b) and, for location access, Art. 6(1)(a) GDPR. The EU recognises Switzerland as providing adequate protection. Privacy information

11.3 Place names and addresses: Nominatim

We use nominatim.openstreetmap.org, operated by the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom. Coordinates or search term, IP address, time, language and user agent are transferred. The United Kingdom benefits from an EU adequacy decision. The legal bases are Art. 6(1)(b) and Art. 6(1)(a) GDPR. Privacy policy

11.4 Nearby water and map data: Overpass API

We use https://overpass-api.de/api/interpreter, a public, volunteer-run instance of the open-source Overpass API project (started by Roland Olbricht; source code at github.com/drolbr/Overpass-API). Because requests can be routed to different volunteer-run mirror servers depending on load, we cannot name a single responsible operator with a contact address; we will update this section once we switch to a fixed, named instance. Coordinates or a bounding box, IP address, query, timestamp and user agent are transferred; account data, names and photos are not. The legal bases are Art. 6(1)(b) and Art. 6(1)(a) GDPR.

11.5 Map display

Maps are displayed using OpenFreeMap based on OpenStreetMap data. OpenFreeMap is run by Zsolt Ero (contact: zsolt@openfreemap.org) as an open-source project. The displayed map area and device IP address are transferred to the provider.

11.6 Community visibility

Before publishing, you choose one of three options: exact coordinates, a water-body name detected automatically or entered by you, or secret with no location displayed. The app warns you before exact coordinates are published. Other users may save or redistribute published location information.

Your display name, profile photo, posts, comments, photos, selected catch details, chosen location information, publication time, reactions and follower relationships may be visible to other users.

Users can report content. To review reports, we process the content, author and reporter IDs, and reason. We may remove content or suspend accounts. The legal bases are Art. 6(1)(f) GDPR and, where required, Art. 6(1)(c) GDPR. Community features are provided under Art. 6(1)(b) GDPR.

Do not publish third-party personal data or content you do not have rights to. Public content can be saved and redistributed, so complete deletion from the internet cannot be guaranteed.

We use PostHog only in the app. The provider is PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. Data is processed in the EU Cloud in Frankfurt.

PostHog assigns a pseudonymous device or installation ID. Once you sign in, it is linked to your account user ID. Data includes these IDs, app and OS version, device model, language, time zone, event times, feature events, viewed screens, interactions and technical errors. IP collection and Session Replay are disabled.

Photos, catch entries, comments and community content are not sent for analytics. We do not use PostHog for personalised advertising.

Analytics requires consent under Art. 6(1)(a) GDPR and section 25(1) TDDDG. You can withdraw it in the app; the app remains fully usable without analytics. Data is kept only as long as needed for analysis and product improvement and is then deleted. PostHog acts as our processor under Art. 28 GDPR. Privacy policy

Subscriptions are purchased through Apple In-App Purchases. Apple alone processes payment data; we cannot view it.

We use RevenueCat, Inc., 1100 Mission St, San Francisco, CA 94103, USA to manage subscriptions. It processes the app user ID, purchase/subscription status, term, renewal, cancellation, receipts and technical device data to unlock features, restore purchases and prevent abuse. The legal bases are Art. 6(1)(b) and (f) GDPR. RevenueCat is our processor under Art. 28 GDPR.

We use Resend (Plus Five Five, Inc.), 2261 Market Street #5039, San Francisco, CA 94114, USA for transactional email and support. Email address, name, message content, delivery and error data are processed for registration confirmations, password resets, account information and support replies. The legal bases are Art. 6(1)(b) and (f) GDPR. Resend is our processor under Art. 28 GDPR.

With your permission, we send information about app features, community activity or news. Device token and notification content are processed through Apple Push Notification Service (Apple Inc. / Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland). The legal basis is Art. 6(1)(a) GDPR. You can disable notifications in the app or device settings.

BiteCast may include labelled Amazon affiliate links. When you click one, you leave BiteCast. Amazon then processes data independently, including your IP address, and may set cookies or identifiers to attribute an order to our partner account.

We receive no payment data or full account details, only aggregate settlement information. The legal basis is Art. 6(1)(f) GDPR. As an Amazon Associate, Nextras earns from qualifying purchases.

• Camera – take catch photos;
• Photo library – select existing photos;
• Location – catch locations and weather/place/water data; and
• Notifications – push notifications.

Denying permission only makes the relevant feature unavailable.

We disclose data only with consent, where needed for the contract or where legally required. Some providers process data outside the EU/EEA, particularly in the United States.

Transfers rely on an adequacy decision (the EU-US Data Privacy Framework where the provider is certified, or the decisions for Switzerland and the United Kingdom) or safeguards under Art. 46 GDPR, especially EU Standard Contractual Clauses and supplementary measures. Equivalent protection and the exclusion of government access cannot always be guaranteed. Request a copy of safeguards at legal@nextras.de.

We retain data only for as long as its purpose or the law requires:

• account data until account deletion;
• catch, photo and community data until you delete it or your account;
• public posts may be anonymised to preserve existing discussions;
• we do not separately store Gemini images at Google; Google's limited retention terms apply;
• Open-Meteo, Nominatim and Overpass requests are not permanently stored; results may become part of a catch entry;
• support requests until completion unless retention law applies;
• PostHog data only as long as needed for analysis and improvement;
• Supabase server logs under the service's applicable standard retention settings;
• the Nextras live counter does not permanently retain personal visit events; and
• billing and tax records for up to ten years.

Request account deletion in the app or contact legal@nextras.de.

We do not use automated decision-making or profiling under Art. 22 GDPR that has legal or similarly significant effects. AI fish identification provides only a non-binding suggestion that you can edit or reject.

The minimum age to use BiteCast under our terms (German, authoritative) is 16. This is separate from the age rating shown in the App Store, which varies by the country or region of your App Store account (currently 13+ in 171 countries or regions, 16+ in two countries or regions, A16 in Brazil and 15+ in South Korea). That rating is a content classification set by the platform, not a usage or consent age under the GDPR, so it does not need to match our minimum age of 16. The minimum age of 16 is the only age that governs use of BiteCast; we merely check periodically that the rating shown in App Store Connect is displayed correctly.

We collect date of birth during registration to check this requirement. If you have not turned 16, do not use the app or create an account. We will delete accounts we learn were created contrary to this rule.

We implement Art. 32 GDPR measures against loss, manipulation and unauthorised access, including TLS/HTTPS, database access controls, role and permission systems, and encryption of stored data by the provider.

Subject to the legal requirements, you have rights to:

• access (Art. 15 GDPR);
• rectification (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to legitimate-interest processing (Art. 21 GDPR); and
• withdraw consent with future effect (Art. 7(3) GDPR).

Contact legal@nextras.de. Location, analytics, push, content visibility and account deletion can also be managed in the app or device settings.

You may complain to a data protection authority, in particular where you live or work or where an alleged infringement occurred. Our competent authority is:

With your consent, the website uses the Google tag (gtag.js) for Google Ads conversion tracking. This measures whether a click on one of our ads led to a further action, such as visiting a specific page or installing the app. A cookie or comparable identifier is stored on your device for this purpose.

On your first visit we show a cookie banner. The script is loaded and executed only if you actively consent there; if you decline or make no choice, no data is transmitted to Google through this tag and the website remains fully usable. The cookieless Nextras live counter and Vercel Web Analytics described in Section 5 are unaffected and continue to operate independently of this choice.

The recipient is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and its affiliates, in particular Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. We process the click/conversion identifier, timestamp, visited page, IP address, and device and browser information.

The legal basis is Art. 6(1)(a) GDPR in conjunction with section 25(1) TDDDG. You can withdraw consent at any time with future effect via “Cookie settings” in the footer, which reopens the banner so you can change your choice. See Section 19 for transfers to the United States and the applicable safeguards.

We update this policy when app features, providers or legal requirements change. The current published version applies. We will notify you in the app or by email of material changes.