Privacy policy
This policy explains what personal data the Phyler apps collect, why we collect it, who we share it with and what your rights are. It covers every Phyler app, currently Phyler - Fish, and this website.
We have tried to write it in plain English. If anything is unclear, email privacy@phylerapp.com.
Who we are
Phyler is run by [CONTROLLER NAME], [POSTAL ADDRESS], who is the “data controller” for your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).
- Email: privacy@phylerapp.com
What we collect
When you create an account
- Your sign-in details. When you sign in with Google or Apple we receive your email address, your name if you share it, and an account identifier from that provider. We never see your Google or Apple password.
- Your date of birth. We ask for it once, when you sign up, and it can’t be changed afterwards in the app. We use it to work out which age group you are in, because that decides which features you can use (see Children and young people). Other users never see your date of birth, and neither do our admin tools, which only show your age group.
- Your profile. Username, display name, avatar (a photo or an emoji), and anything you choose to add, such as a short bio, a general location, your preferred species or fishing style.
When you use the app
- Photos of your catches. Photos you take or pick from your library to log a catch, including any you add using “Add past catches”.
- Catch details. Species, length, date and time caught, notes, and where it was caught (see below).
- Finger measurements. If you calibrate your finger widths, we store them so the app can estimate a fish’s length from a photo.
- Location. If you allow location access, we record where a catch was logged. When you log a catch you choose how precisely its location is shown: at the waterway, at the region, or not at all. If you choose “not at all”, we don’t store coordinates for that catch. We also keep the location of your most recent catch, so “nearby” features work if your phone can’t get a GPS fix. Location from a photo’s embedded data (EXIF) is used only to pre-fill that catch, and only if you keep it.
- Social activity. Posts you share, captions, comments, reactions, the people you follow and who follows you, groups you join or create, and notifications about this activity.
- Usage records. How many AI identifications you have used, any credits you hold, your account tier, and a log of each AI request (which feature, when, and its technical cost). We use these to apply fair-use limits and to control our costs.
From your device
- Technical data. Like any online service, our servers receive your IP address and basic request information when the app talks to them. We use this to run the service, keep it secure and apply rate limits.
We don’t collect your contacts, we don’t use your microphone, and the app doesn’t show ads or use your device’s advertising identifier.
How we use it and why
UK law requires a “lawful basis” for each use of personal data. Ours are:
| What we do | Lawful basis |
|---|---|
| Run your account, store your catches and collection, and show you your history | Contract (providing the app you signed up for) |
| Identify species and estimate length from your photos using AI | Contract |
| Show your shared posts to followers and groups, and handle follows, comments and reactions | Contract |
| Check your age, keep under-13s out, and apply age-appropriate settings | Legal obligation, and legitimate interests (keeping children safe) |
| Check shared posts for harmful content before others can see them | Legal obligation, and legitimate interests (keeping the community safe) |
| Improve our species identification using catch photos (see below) | Legitimate interests (you can object, see below) |
| Apply usage limits, prevent abuse, and monitor our costs | Legitimate interests |
Improving species identification
When an account holder aged 13 or over confirms a catch, we may keep a copy of the catch photo, labelled with the species, to improve how well Phyler recognises species. These copies are stored separately from your collection, but we can still link them back to your account, so they are deleted along with it (see Deleting your account).
We rely on legitimate interests for this: better identification makes the app more useful for everyone. You can object at any time by emailing privacy@phylerapp.com, and we will delete the copies we hold of your photos and stop using them for this.
AI processing
To identify a species or estimate its length, we send the photo and a short description of what we need to an AI service: Anthropic (Claude) or Google (Gemini). When you share a post, its photos are checked by Google Cloud Vision for harmful content and to confirm they show a fish.
These providers process the photo only to return a result to us. Under the terms we use them on, they may not use your photos to train their own AI models. AI results are estimates. You can always change the species or length before saving.
Children and young people
Phyler is for people aged 13 and over. We work out your age group from the date of birth you give when signing up, and some features depend on it:
- Under 13. Phyler isn’t available yet. If someone under 13 signs up, the account is blocked straight away: it can’t be used or save anything, and we delete it, and the little we hold (sign-in details and date of birth), within 14 days. The account holder can also delete it immediately.
- 13 and 14. The core app (logging catches, the field guide, your collection) is fully available. Following, groups and the social feed are not.
- 15 to 17. Social features are available, but the account is always private: anyone who wants to follow must be approved first. Accounts in this group can’t join public groups on their own.
- 18 and over. All features, with the privacy settings you choose.
Everyone under 18 gets privacy-protective settings by default, including profiles that aren’t public.
For parents. If you think your child under 13 has created an account, or you have any concern about your teenager’s account, email privacy@phylerapp.com and we’ll help, including deleting the account.
Advertising
Phyler doesn’t show ads. If that changes, we’ll update this policy and tell you before any ads appear.
Who we share it with
Other users see only what you choose to share: your profile, posts that pass our safety check, and comments and reactions. Your collection, your unshared catches and your exact locations are private to you. Your privacy setting controls who can see your profile and posts.
Service providers process data on our behalf, under contracts that let them use it only for us:
| Provider | What for |
|---|---|
| Railway | Hosts our servers and database |
| Cloudflare | Stores your photos; hosts this website; forwards our email |
| Upstash | Short-lived data used for rate limiting and caching |
| Anthropic | AI species identification and length estimates |
| AI identification (Gemini), content safety checks (Cloud Vision), Google sign-in | |
| Apple | Apple sign-in |
We don’t sell your personal data. We may disclose data if the law requires it, or to protect the safety of our users or others.
International transfers
Several of these providers are based in, or store data in, the United States. Where personal data leaves the UK, we rely on the UK’s adequacy regulations (including the UK–US “data bridge”) or on the UK International Data Transfer Agreement or Addendum.
How long we keep it
- Your account and everything in it: until you delete your account.
- Accounts of under-13s (who can’t use Phyler yet): deleted within 14 days of sign-up.
- Photos copied to improve identification: deleted with your account, or sooner if you object (see Improving species identification).
- Server logs: kept for up to 30 days for security and troubleshooting.
Deleting your account
You can delete your account at any time in the app (Settings → Delete account). Deletion is permanent and happens straight away. It removes your profile, catches, photos, posts, comments, reactions, follows, and any groups you own. If you no longer have the app, see Delete your account.
Your rights
Under UK data protection law you have the right to:
- Access the personal data we hold about you
- Correct data that is wrong
- Delete your data
- Object to, or ask us to restrict, how we use it
- Data portability: receive the data you gave us in a reusable format
- Withdraw consent at any time, where we rely on it
To use any of these rights, email privacy@phylerapp.com. We reply within one month. If you aren’t happy with how we handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, but we’d appreciate the chance to put it right first.
Security
Data is encrypted in transit. Photos are stored privately and can only be opened through short-lived links. Access to admin tools is restricted and password-protected. No system is perfectly secure, but we work to protect your data and will tell you, and the ICO where required, if a breach affects you.
Changes to this policy
If we make a significant change, we’ll let you know (for example, in the app or by email) before it takes effect. The date at the top shows when this policy was last updated.