Privacy policy

This is a translation for your convenience. The Dutch version is the legally binding one.

Last updated: 25 October 2026

This privacy policy explains which personal data CarpWeather ("the app", "we") processes, what for, and what rights you have. We process as little data as possible and never sell your data.

1. Who is responsible?

The data controller is CarpWeather, a sole proprietorship established in the Netherlands, registered with the Dutch Chamber of Commerce under number 42114185, reachable at privacy@carpweather.app.

2. Which data do we process?

• Account data: your email address and (optionally) your name or display name, via signing in with Google, Apple or your email address. If you sign in with email and password, Google (Firebase) manages your password; we never see or store it. A new email account is confirmed first through an email.
• Fishing data you enter: catches (species, weight, length, bait, time, photos), swims (locations, notes), sessions and planned trips.
• Location data: if you allow it, we use your GPS location to recognise your swim and show the right weather and carp score. On the iPhone you can also choose "always allow"; the app then recognises your swim in the background too and the forecast follows you on a trip — sparingly (only on a clear movement) and solely for this purpose. On Android we only use your location while the app is open. We never use your location for advertising and never sell it. To show the weather, the radar and your carp score we send your coordinates to our weather and map sources (see 4) — without your account or name. Coordinates are stored with your catches and swims.
• Crew data: if you take part in a crew (a closed group of 2–8 people), you share the data you choose (such as catches, swims and messages) with your crew members. We never share your swims and locations with others unless you choose to — outside a crew you create or join yourself, they are visible only to you.
• Co-op (fishing together live): if you start or follow a co-op session, you decide what your crew sees: your exact swim on the map, or only the region you are fishing in. Who is watching is also visible. This only applies while the session runs and only within your own crew.
• Technical data: minimal data needed to make the app work (e.g. app version, settings) and — if the app hits a fault — a anonymised error report without personal data, so we can trace and fix problems. We also measure how long certain actions take (for example loading your crew or sending a chat message) and whether they fail. Those measurements contain your user ID, the app version, the platform and the version of iOS or Android — no names, locations or content — so we can see whether a problem affects one user or everyone. They are deleted automatically after 30 days. We also record when you last used the app and on which system (iOS, Android or web): a single timestamp that is overwritten each time you use it and updated at most once an hour. No device model, no version number. That tells us whether the app is actually being used — your login does not, because it is not refreshed every time — and which systems we need to keep supporting. An error report is first kept on your phone (at most 20, no longer than 7 days) and sent as soon as there is a connection, also if you are not (yet) signed in; even then no user ID or location goes with it. The app also counts on your phone which screens you open: only the name of the screen and how often. Once a day those numbers go to us, without an account or device number, and we add them to everyone else's; that shows us which parts are used. To stop anyone from overloading our weather and radar services, we count how many requests arrive per hour from each IP address. Those counters are deleted automatically after 24 hours. We use no advertising or tracking technology and no analytics SDKs.
• Reports of unwanted behaviour: if you report another user within a crew (or are reported), we process that report (reason, user involved, time) so we can act. The report itself is erased after processing; we keep only a minimal counter of how often a user has been reported, to recognise repeated abuse.
• Feedback and reviews: if you send us an idea or a bug report through the app, we keep your name and your message so we can act on it. If you write a review on our website, we keep the name you enter, your text and your rating — those are there to be shown. See section 6 for how long.
• Log of administrative actions: if we as administrators do something that affects you — imposing or lifting a block, granting you founder status, or giving you Premium through a partner code — we record what happened, by whom and when. That exists so we can account for it: who did what, and why. See section 6 for how long we keep it.
• Partner code: if you work with us as a shop or creator and enter a partner code in the app, we link that code to your account. We keep your user ID, your email address (with Sign in with Apple possibly a hidden relay address), the moment of linking and, if we give you Premium, for how long and under which title. To limit guessing of codes, we count per day how many incorrect codes are entered from your account. If you do not enter a code, we process nothing for this.
• Your session on the lock screen: during a session the app shows a card (iPhone) or a notification (Android) with the start time, the name of your swim, your bites and catches and the carp score — never coordinates. It stays on your phone only; nothing goes through our or anyone else's servers. If you tap Bite, your phone keeps only the time until you handle it in the app. Note: anyone can see your lock screen. On Android we therefore show a version without the swim there; on iPhone you decide whether Live Activities may appear on your lock screen. You can turn it off in your phone's settings.

3. What for and on what basis?

• To deliver the app and to store or sync your data — on the basis of performance of the contract (your use of the app).
• To calculate the carp score and the weather — on the basis of your consent for the use of location.
• To make crew features possible — on the basis of your choice to share data.
• To improve our carp score — we count in aggregate, across all users, at which scores fish are actually caught. No catches, locations or names are kept, only counts. On the basis of our legitimate interest in a better forecast.
• To protect users against unwanted behaviour and to recognise repeated abuse — on the basis of our legitimate interest in a safe environment for all users.
• To trace and fix faults (error reports and measurements) — on the basis of our legitimate interest in an app that works.
• To make partnerships with shops and creators possible (partner code) — on the basis of performance of the contract: you enter the code yourself to receive the agreed Premium. Counting incorrect codes is based on our legitimate interest in preventing abuse.

4. Third parties we use

• Google Firebase (authentication, database, photo storage, server functions, push notifications and hosting our website carpweather.app) for your account and cloud storage. Data is sent encrypted over HTTPS.
• Open-Meteo and KNMI for weather and radar data. For this, coordinates of your location are sent (only), in order to fetch the local weather; no account data is shared. The European rain radar (EUMETNET OPERA) and the rain forecast of the Deutscher Wetterdienst are fetched by our server itself, as images of all of Europe and Germany; nothing about you is sent along.
• Resend for sending our emails, such as confirming your email address, a new password, and the copy of your data when you request it. Resend receives your email address and the content of the email for this.
• RevenueCat for handling subscriptions (your purchase and an app-specific user ID).
• OpenStreetMap (Nominatim) to turn coordinates into a place name.
• MapTiler (MapTiler AG, Switzerland) for the map display. When the map loads, your device connects directly to MapTiler; your IP address is processed briefly (max. 20 min) for security and then deleted. MapTiler does not track your map use and does not sell data. See the MapTiler privacy policy. The map data is based on OpenStreetMap.
• Cloudflare for the map tiles, the European rain radar and the maps you save for offline use. When those load, Cloudflare sees your IP address; no account data is sent. Cloudflare also manages the domain name carpweather.app.

Where your data is held: your catches, swims, sessions and photos are stored in the European Union (database and photo storage in the EU, server functions in europe-west1, except three — see below).

Two parts sit outside the EU, and we cannot configure that. Your sign-in details (email address and display name) are processed by Firebase Authentication exclusively in the United States. The same applies to the delivery of push notifications and the web hosting. Google is certified for that transfer under the EU-US Data Privacy Framework, and standard contractual clauses apply. Resend and Cloudflare are US companies and are also certified under the EU-US Data Privacy Framework.

Three server functions run in the United States. Google cannot run two of them anywhere else: they fire at the moment an account is created or removed. One sends us a notice of a new account (with your name or email address), the other cleans up your data after you have deleted your account. They store nothing themselves. The third fetches the radar images from the KNMI; it sees your IP address and the part of the map you are viewing, but no account.

We conclude data processing agreements where needed and never share your data for commercial purposes.

4a. Our website

On carpweather.app there are no cookies, no trackers and no analytics. We do not measure who visits and nothing is stored on your device. That is also why you see no consent banner: there is nothing to consent to.

One exception: the reviews on the home page and the contact form on the help page run through Firebase (Google). Two things are loaded there: the Firebase library itself, and Google reCAPTCHA — the latter protects against abuse by bots. In both cases your IP address is visible to Google, and reCAPTCHA looks at your behaviour on the page to determine whether you are human. Google may place cookies for that. On the rest of the site that does not happen.

If you fill in the contact form, we store your name, email address and message so we can answer your question. Once we have dealt with your question, the message is automatically deleted after three months — we keep that period in case you come back to it. See also the Google privacy policy.

The fonts are on our own server, not with Google.

5. Photos

Photos you add to a catch are stored with that catch and — if you are signed in — synced to the cloud and (if shared) visible to your crew. Do not add photos you would not want to share within your crew.

Sending your catch to CarpWeather. In your logbook you can send your catch photos to us for the CarpWeather Instagram and Facebook pages, and from a finished session photos from that whole session (up to five). This only happens if you choose to and switch on consent. We then receive the photos you choose (saved again by the app, without location or camera data; if you are in it, you will also be in a post), your story, your name or "anonymous" (your choice), your Instagram name if you add it, the language of your app, and per catch a short line from your logbook with species, weight and the weather at that moment (wind, air pressure, temperature; never your swim or the place). The legal basis is your consent. If we post it, it is public on Instagram and Facebook (Meta) and you get a notification. You can withdraw your consent at any time in the app, at the catch or the session: we then delete the photos and the data straight away and take down a published post. A rejected submission is deleted after 30 days, everything else after 2 years at the latest. Sending in is for ages 16 and up, or with a parent's consent.

6. Retention period

We keep your data for as long as you have an account. If you delete your account, your data — your catches, swims, sessions, photos, crew contributions, any founder record (with your email address and name), any partner link (with your email address) and sign-in details — is immediately and completely deleted. So we keep your data until you decide to delete your account.

What else happens when you delete your account. The app also erases that account's data from your phone (data of another account on the same phone stays). We ask RevenueCat, our subscription service, to delete your customer data. If you sign in with Apple, we revoke the link with Apple on iPhone; if that fails, or you use Android, the app tells you how to do it yourself. Your subscription keeps running with Apple or Google: cancel it there first. The app tells you beforehand and takes you there with one tap.

One note on “immediately”: from the systems the app uses your data is gone at once. Google, which provides our database and sign-in service, also removes it from its backups within 180 days. Those backups exist in case of a failure and cannot be consulted by us.

Not used for two years? Then we delete your account and all your data, in the same way as described above. We email you first, and once more a week before; if you open the app within 30 days, everything simply stays. This does not apply while you have a paid subscription or a trial.

Leaving a crew. If you leave a crew yourself, we immediately remove everything you shared there: your catches and swims from the shared feed, your chat messages and your replies under other people’s posts. If an owner removes you, those contributions stay — you can then erase them yourself with Delete all my data in that crew.

Have you been removed from a crew? Then your contributions stay there — you are no longer a member, so you cannot remove them yourself. If you still want them deleted, email privacy@carpweather.app with the name of the crew. We will then take out your catches, swims, chat messages and replies. We do that within a month, usually much sooner.

Exception — crew chat: messages and photos in the crew chat are automatically deleted after two months, even if you keep your account. That keeps the conversation current and the storage limited.

Reports and abuse: a report of unwanted behaviour is erased by email after it has been handled. To recognise repeated abuse we keep a minimal counter per reported user (number of reports, last date and reason) for up to 12 months after the last report; after that it is automatically deleted. On the basis of our legitimate interest in protecting other users, this minimal counter may also be kept for that period after an account has been deleted.

Reviews: a review you post on our website stays, even if you later delete your account. It is there to be read, after all, and no account is attached to it. If you want it gone, email privacy@carpweather.app — and we will take it down.

Partner code: the link stays in place while the partnership runs. If we unlink it or delete the code, it is gone at once, both at the code and on your account. The count of incorrect codes is overwritten every day.

Measurements: are deleted automatically after 30 days.

Last used: we keep a single timestamp per account, overwritten each time — so there is no history of when you opened the app. Delete your account and it goes with it.

Log of administrative actions: we keep this for 12 months; after that it is automatically deleted. On the basis of our legitimate interest in being able to account for interventions, a line concerning you may also be kept for that period after your account has been deleted.

7. What stays on your device

Besides what we keep in the cloud, the app also stores data on your own phone. That does not leave your device and is not visible to us.

• Your settings — theme, units, notification preferences and the state of the map buttons.
• Your catches, swims and sessions — so the app works when you have no signal. If you are signed in, they are also in the cloud. If you sign out, they stay on your phone, so they are back when you sign in again. If someone else signs in on the same phone, they see only their own data.
• Map tiles — of places you have viewed, so the map keeps working without a connection. Only what you opened yourself; we fetch nothing in advance. They disappear automatically after 30 days, and the app never keeps more than a few hundred megabytes of them.
• What still has to be sent or handled — error reports and screen counts not sent yet, and taps on Bite from your lock screen until you handle them in the app.

You can see what is on your device under Settings → Diagnostics → Storage use. There you can also erase the stored maps. If you delete the app, everything on your device goes with it.

8. Your rights

You have the right to access, rectification, deletion, restriction en transfer (a copy of) your data. You can also withdraw your consent at any time. You can:

• delete your account and all data in the app via Settings → Profile → Delete account;
• download a copy of your data via Settings → Legal → Download my data — you then receive it by email in JSON format;
• or submit a request via carpweather.app/account-verwijderen.

A note on downloading your data. In that file your photos are link, not files — otherwise the download would be far too large. Those links work as long as your account exists. If you want to keep your photos, save them before you delete your account.

Questions or complaints? Email privacy@carpweather.app. You also have the right to lodge a complaint with the Dutch Data Protection Authority.

9. Security

All communication runs over encrypted connections (HTTPS). Access to your data is secured through your account. We do not store passwords ourselves: signing in goes through Google, Apple or Firebase Authentication.

10. Children

CarpWeather is intended for people aged 16 and over, and is not aimed at children. We do not knowingly process data of children under 16. If we do find out we hold such data, we delete it. If you are a parent or guardian and think your child has an account, let us know via privacy@carpweather.app.

See also our child safety page.

11. Changes

We may update this policy. We announce significant changes in the app. The date at the top shows the latest version.