Privacy Policy

This policy explains how CatchBag (“CatchBag”, “we”, “us”) collects, uses, and protects your personal information when you use the CatchBag website at catchbag.co.nz, the CatchBag web portal, and the CatchBag mobile app. We handle personal information in line with the New Zealand Privacy Act 2020.

Privacy questions or requests: support@catchbag.co.nz.

Information you provide:

• your email address (the only required field — it’s how you sign in);
• profile details you choose to add: display name, first and last name, date of birth, gender, and your gear list;
• your phone number, if you join an event (organisers need it to run the event);
• catch logs: species, measurements, notes, and photos;
• trip plans, checklists, and event entries;
• messages, photos, and voice audio you send to the Mr. Hook AI assistant; and
• messages you send to support.

Information collected automatically when you use certain features:

• GPS location — the coordinates of catches you log, and continuous location while you record a trip, including background location on iOS (see section 4);
• motion data on iOS, used to record your trip path efficiently;
• a push notification token for your device, if you enable notifications;
• crash reports and device diagnostics (via Firebase Crashlytics) to help us fix bugs;
• sign-in and activity history; and
• your device’s memory size — used only to recommend which offline AI model your device can run, nothing else.

What we don’t collect: CatchBag has no advertising trackers and no third-party analytics. We don’t collect advertising identifiers, and we don’t sell your data — to anyone, ever.

We use your information to:

• provide the Service: your catch history, maps, trips, events, leaderboards, and stats;
• sign you in (emailing your login code) and keep your session secure;
• send notifications you’ve enabled and important service emails;
• provide the AI, weather, and mapping features you use;
• respond to support requests; and
• diagnose crashes and improve reliability.

• Catch locations: when you log a catch, its coordinates can be recorded so it appears on your map and history.
• Trip tracking: when you start recording a trip, the app records your GPS path continuously until you stop it — including in the background on iOS, so tracking continues with the app closed. On Android, tracking runs as a visible foreground service. A consent sheet is shown before tracking starts.
• Sharing your live path: on group trips you choose, via an explicit toggle, whether other trip participants can see your live location. This is off unless you turn it on.
• Storage: recorded tracks are uploaded to our servers and stored so we can show your trip maps, stats, and summaries.
• Community map: catches you log can appear on the community catch map visible to other signed-in users.

You can turn off location access at any time in your device settings; features that need it (catch coordinates, trip tracking) simply won’t work while it’s off.

• Cloud chat and species ID: messages you send to Mr. Hook, and photos you upload for species identification or analysis, are processed by OpenAI, our AI provider, to generate a response.
• Voice: in a voice conversation, your audio streams directly from your device to OpenAI in real time.
• Voice dictation: audio sent for transcription is transcribed and not retained — the recording is deleted from your device after upload, and we don’t store the audio on our servers.
• Offline mode: the optional downloadable AI model runs entirely on your device. Conversations with it are processed locally and sent nowhere.
• Conversation history: we store your Mr. Hook conversations so you can revisit them and they sync across your devices.

• Other signed-in users can see catches on the community catch map and community rankings such as Catch of the Week.
• Event participants can see your display name and your event catches on that event’s leaderboard.
• Event organisers can see your name and phone number when you register for their event.
• Trip members can see your live location on a group trip if you opt in (section 4).
• Anyone with an invite link: trip and event invite links (including QR codes) show a public preview — name, dates, location, cover image, and the creator’s name — without needing to log in.

We share personal information only with the providers that make the Service work:

• OpenAI (US) — processes AI chat messages, uploaded photos, and voice audio;
• Amazon Web Services (Sydney, Australia) — stores uploaded photos;
• Google Firebase (US) — delivers push notifications and collects crash reports;
• Resend (US) — sends login codes and service emails;
• Mapbox (US) — powers map search and geocoding;
• weather providers — receive coordinates of the area you request weather for;
• LINZ / Koordinates (NZ) — serve nautical chart and aerial map tiles; and
• Sortd — powers in-app support chat.

Some of these providers store or process information outside New Zealand (mainly Australia and the United States). Where we disclose personal information overseas, we take reasonable steps to ensure it’s protected by safeguards comparable to the New Zealand Privacy Act. We may also disclose information where the law requires it.

The website uses a secure, httpOnly session cookie to keep you signed in (expires after 30 days) and a small cookie remembering which CatchBag site you use. That’s it — there are no advertising or analytics cookies, which is why you won’t see a cookie consent banner.

• We keep your information for as long as your account exists.
• To delete your account, visit catchbag.co.nz/delete-account and confirm your email — deletion is immediate and removes all of your account data from our systems. You can also email support@catchbag.co.nz from your account email and we’ll do it for you.
• Data stored on your device — offline catch logs, offline AI conversations, cached maps, and downloaded AI models — is removed by uninstalling the app.

Under the Privacy Act 2020 you can ask us for a copy of the personal information we hold about you, and ask us to correct it. Email support@catchbag.co.nz and we’ll respond as soon as we reasonably can. You can also update most profile details yourself in the app.

If you’re not happy with how we’ve handled your information, you can complain to the Office of the Privacy Commissioner at privacy.org.nz.

The Service is for people aged 18 and over, and we don’t knowingly collect personal information from anyone younger. If you believe someone under 18 has created an account, let us know and we’ll remove it.

Your information is encrypted in transit, sessions use secure httpOnly cookies, and sign-in uses short-lived one-time codes rather than stored passwords. Access to production data is restricted. No system is perfectly secure, but we take reasonable steps to protect your information and will act quickly if something goes wrong.

We may update this policy as CatchBag evolves; the “Last updated” date at the top shows the current version, and we’ll flag significant changes in the app or by email. This policy should be read together with our Terms of Service. Contact us anytime at support@catchbag.co.nz.