Privacy Policy

English (GDPR + CCPA)

1. Data Controller

NOMDAD LLC, 5830 E 2nd St, Ste 7000 #18785, Casper, Wyoming 82609, USA. Email: hello@strikeahead.fishing. StrikeAhead V2 is available as a mobile app (iOS, Android) and a web app. This policy applies to all platforms.

2. Data We Collect

• Account data: name, email (via Apple Sign-In or Google Sign-In), profile photo, language preference.
• Catch data: uploaded photos, fish species, weight, length, date, optional GPS location, notes.
• Location: only when the map / capture is actively used with GPS, after OS permission prompt. Catch spots are private by default and shown to no one. You control any sharing yourself (private / crew / public); when shared publicly the spot is shown only on a coarse grid (~1 km) — never your exact location, unless you explicitly choose to. Location data is never sold or passed to third parties or other anglers.
• Device info: OS, app version, language, push token (if enabled).
• Usage data: which features you use (PostHog, servers in the EU) — only with your consent, which you can withdraw in settings at any time. This stores a random ID on your device; no name, no email, no location, no screen recording. Crash reports (Sentry, servers in the EU): when the app crashes or an error occurs, with device, OS, app version and error trace — not linked to your account and without location.
• Microphone (RECORD_AUDIO): Optional, for voice visualizer and voice commands. Speech recognition is handled by your operating system or browser (via Apple or Google, depending on the device). We only receive the recognized text, never the audio, and use it to carry out the command.
• Camera + photo library: Only when you upload a photo for a catch. Photo is sent with your permission to our servers (Supabase EU).

3. Why We Use Your Data

To provide app features (catch management, maps, competitions), for AI-powered fish identification via Google Gemini (images are transferred temporarily for analysis only, not used for model training), for personalized recommendations (best times, similar spots), competition and Captain-verification mechanics, push notifications (with consent), and security / spam protection.

4. Third Parties

Supabase (EU, Frankfurt) for database + auth + storage. Vercel for hosting. Apple / Google for OAuth login. Google Gemini AI for fish recognition (no model training). Sentry (EU) for crash reports not linked to your account; PostHog (EU) for usage analytics, only with your consent. Apple APNs / Google FCM for push notifications. PayPal for premium-subscription payment processing. Resend (EU/US) for system and Pathfinder enquiry emails (relay between angler and expert; only the content needed for delivery is transmitted).

5. Your Rights (GDPR — EU/EEA Residents)

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). To file a complaint, contact your local supervisory authority. Delete your account directly in-app via Settings → Profile → Delete account, or by emailing hello@strikeahead.fishing. We delete your data fully within 30 days.

6. Your Rights (CCPA / CPRA — California Residents)

California residents have the right to know what personal information we collect, to delete it, to correct it, to opt-out of "sale" or "sharing" of personal information, and to non-discrimination. We do not sell personal information. We do not share personal information for cross-context behavioral advertising. To exercise your rights, email hello@strikeahead.fishing with the subject "CCPA request" and we will respond within 45 days.

7. Your Rights (Other US States)

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and other states with privacy laws have similar rights to access, correct, delete, and opt-out of targeted advertising. Same email contact applies — we will respond per your state's required timeline (typically 45 days).

8. Categories of Personal Information (CCPA Disclosure)

In the past 12 months we have collected: identifiers (email, user ID), commercial information (subscription tier, purchase history), internet activity (app usage, error logs), geolocation (when permitted), audio data (none — speech recognition runs on your device's OS or browser, we receive only text), visual data (uploaded catch photos), professional info (none), education info (none), inferences (fishing pattern preferences for recommendations). We collect from you directly; sources are first-party only.

9. Data Retention

Account data: until account deletion. Catches: until account or item-level deletion. Server logs: 30 days. Security logs (login attempts): 90 days. Backups: up to 30 days after account deletion in encrypted form.

10. Minors

StrikeAhead is not directed at children under 13 (US) / 16 (EU). We do not knowingly collect data from children. If we discover such data, we delete it promptly. Parents can contact us to delete a child's data.

11. International Transfers

NOMDAD LLC is a US entity. Some processing happens in the EU (Supabase Frankfurt), some in the US (Vercel, Google Gemini). We rely on Standard Contractual Clauses (SCCs) for transfers from EU to US per Art. 46 GDPR.

12. Security

Encrypted transmission (TLS 1.3), encrypted at rest, Row-Level Security in the database, regular security audits (most recent: Sprint S10/S10b, May 2026). Authentication via Apple/Google OAuth (no passwords stored by us).

13. Changes

We may update this policy. Material changes will be notified in-app and via email at least 30 days before taking effect. Last update shown at the top of this page.

14. StrikeAhead Pathfinder — Data When You Contact an Expert

When you send an enquiry to an expert (skipper, guide, coach) via StrikeAhead Pathfinder, we process the contact and enquiry details you provide (e.g. name or display name, contact method, message text, desired dates/trip). We forward these details to the expert you selected so they can respond to your enquiry. The expert is an independent provider and, from the moment they receive your data, is independently responsible for handling it. Communication runs through the StrikeAhead platform (enquiry and reply relayed by email via our processor Resend); we do not disclose your private email address to the expert as long as you keep the conversation on the platform. The legal basis is taking steps at your request prior to entering a contract (Art. 6(1)(b) GDPR) and our legitimate interest in safe facilitation (lit. f). We retain enquiry data for as long as needed to handle it and for record-keeping, then delete it. At the current stage StrikeAhead processes no payments and collects no tax-reporting data (DAC7); should platform payment processing be added in future, we will inform you separately and add the necessary details.