Fish City Privacy Policy

Last updated: September 17, 2026 · Effective date: April 30, 2026

1. Who we are

This privacy policy describes how Fish City, operated by Cerity Farms LLC ("Fish City," "we," "us," or "our"), collects, uses, and shares information when you:

• Use our mobile application "Fish City: Real Fish Counts" (the "App")
• Visit our website at fishcity.app and its subdomains (the "Site")
• Interact with our marketing communications

You can contact us at:

• Email: team@fishcity.app

2. Information we collect

2.1 Information you provide directly

• Account information (if you create an account): email address, optional display name
• Region preferences: the California region you select within the App (Southern California, Channel Coast, Central Coast, or Bay Area)
• Fish catch logs (if you choose to log catches): species, approximate location, date, count, photos (optional)
• Push notification preferences: which alerts you've opted into

2.2 Information collected automatically

• Device information: device type, operating system and version, app version, language and region settings
• Usage data: screens viewed, features used, in-app actions, session duration
• Approximate location: only if you grant the App location permission; used to set your default region
• Crash and performance data: technical diagnostics that help us fix bugs
• Mobile advertising identifier (IDFA on iOS, GAID on Android):
  • iOS — the IDFA is shared with Meta and other advertising partners only if you grant permission via Apple's App Tracking Transparency (ATT) prompt; the App wires this directly to the Meta SDK's setAdvertiserTrackingEnabled flag.
  • Android — the GAID (Google Advertising ID) is collected by default by partner SDKs (including Meta) for attribution. You can reset or delete the GAID at any time in Android Settings → Privacy → Ads.
• Tracking endpoints: the iOS App's Privacy Manifest (PrivacyInfo.xcprivacy) declares the third-party domains the App contacts for tracking, including Meta's connect.facebook.net, graph.facebook.com, and www.facebook.com; Branch.io's app.branch.io and cdn.branch.io; and Google's www.googletagmanager.com and www.google-analytics.com. The Android App contacts equivalent endpoints (Android does not require an on-device manifest).

2.3 Information from third parties

• App install attribution: when you install the App via a paid advertisement or shared link, we receive attribution data from advertising partners (e.g., Meta, Google) and from our deep-link partner (Branch.io)
• Public fishing data: aggregate fish count, conditions, and trip data displayed in the App is sourced from public landing reports and government APIs (e.g., NOAA). This data is not personal information about App users.

2.4 Information from landing/charter operators who connect Instagram

If you are a charter boat, landing, or fishing business operator, Fish City offers an optional feature that lets you connect your business's Instagram account (a Business or Creator account is required) so your public posts can be surfaced in the App. If you choose to connect your account, we collect:

• Instagram profile information: your Instagram Business/Creator account ID, username, and public profile fields
• Media you've posted: your public posts, photos, captions, and permalinks
• A long-lived access token: issued by Instagram when you authorize the connection, stored encrypted and used to periodically refresh the above data on your behalf

We request only the minimum permission needed for this feature (instagram_business_basic, via Meta's "Instagram API with Instagram Login"). We do not request or access private messages, follower lists, or any data outside what this permission provides. We use this data only to display your posts in the App — we do not sell it, use it for advertising, or use it to train machine-learning models. This feature is entirely separate from, and does not affect, the advertising/attribution data described in §4.2, which applies only to anglers using the App, not to operators connecting Instagram.

3. How we use information

We use the information we collect to:

• Provide the App's core functionality (region-based fish counts, conditions, trends, push alerts)
• Send you push notifications you've opted into
• Measure and improve App performance, fix bugs, and develop new features
• Measure the effectiveness of our marketing campaigns (only as permitted by your consent and applicable law)
• Detect, prevent, and address security incidents, fraud, and abuse
• Comply with legal obligations and respond to lawful requests from public authorities
• Communicate with you about the App, including service updates and important notices
• For operators who connect an Instagram account: display your public posts (catch photos, trip reports) to anglers using the App, and keep that content up to date via periodic automated refresh

We do not use your information to:

• Make automated decisions that produce legal or similarly significant effects on you
• Train third-party machine learning models
• Sell your personal information to third parties

4. How we share information

We do not sell your personal information.

We share information with the following categories of recipients:

4.1 Service providers (data processors)

These third parties process information on our behalf, only for the purposes we direct, and under contractual obligations to safeguard your data:

4.2 Advertising and measurement partners

Fish City works with Meta and Google for advertising and uses Apple's and Google's privacy-preserving attribution frameworks to measure campaign performance. The disclosures below describe what data is shared, when, and how you can control it.

Meta Platforms, Inc. Fish City uses Meta's mobile SDK (embedded in the iOS and Android App) and the Meta Marketing API (server-side):

• The Meta mobile SDK posts a small set of standardized "app events" so we can measure how our advertising performs. The events we configure and the parameters we send are:
  • fb_mobile_complete_registration — sent when you create an account; includes the registration method (email, Google, or Apple)
  • fb_mobile_content_view — sent the first time you view fish counts; includes a generic content-type tag
  • fb_mobile_complete_tutorial — sent the first time you select a stats boat; includes a tutorial-step identifier
  • fb_mobile_add_to_wishlist — sent each time you follow a boat; includes the boat's public ID and name
  • App activation — sent on each App launch (Meta's standard activateApp event)
• On iOS, the SDK's setAdvertiserTrackingEnabled flag is wired directly to your App Tracking Transparency (ATT) response. If you decline the ATT prompt, no IDFA is shared with Meta and Apple's SKAdNetwork framework (described below) handles attribution on an aggregate basis instead.
• On Android, the SDK collects your Google Advertising ID (GAID) and auto-logs additional standard events by default (Meta's AutoLogAppEventsEnabled and AdvertiserIDCollectionEnabled are enabled in our Android manifest). You can reset or delete the GAID at any time in Android Settings → Privacy → Ads.
• The Meta Marketing API is used server-side to retrieve aggregate impression, click, conversion, and spend data per campaign. No user-level Platform Data is retrieved through this API.

Google LLC (Google Ads). Used for Universal App Campaigns starting later in our marketing rollout. The same consent framework as Meta applies (ATT on iOS, OS-level Ads controls on Android).

Apple SKAdNetwork (iOS). The iOS App declares 51 SKAdNetwork IDs in its Info.plist to support Apple's privacy-preserving ad-attribution framework. SKAdNetwork lets advertisers measure install attribution without exposing user-level identifiers: Apple aggregates a "conversion value" between 0 and 63 (mapped to install plus the four priority Meta events listed above) and sends aggregate postbacks to the ad network that ran the ad (typically Meta and Branch.io). No IDFA, device ID, or per-user data is included in these postbacks. SKAdNetwork postbacks fire regardless of your ATT response.

Google Play Install Referrer (Android). When you install the App from the Google Play Store, Google's Install Referrer API forwards install timestamp and referrer URL parameters (such as UTM tags from the ad you tapped) to our deep-link partner Branch.io for install attribution. No personal information is included beyond what appears in the referrer URL.

4.3 Public authorities

We may disclose information to public authorities or law enforcement when we believe in good faith that disclosure is required by law, necessary to comply with a legally valid request, or necessary to protect rights, safety, and security. We follow our internal Government Data Request Handling Policy when responding to such requests, including reviewing the legality of the request, applying data minimization, and documenting our response.

4.4 Business transfers

If Fish City is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred to the successor entity. We will notify you (in-app or by email) before your information becomes subject to a different privacy policy.

4.5 With your consent

We may share information for purposes not listed above if we have your specific consent.

4.6 Website analytics and advertising tags

The fishcity.app website uses two parallel measurement systems. Neither runs until you make a choice in our cookie banner, both stop when you click Reject all, and both stay off when your browser sends the Global Privacy Control (GPC) signal.

• First-party analytics — We operate our own analytics pipeline that records pageviews, scroll depth, and click events to understand how visitors use the Site. Events are sent to Fish City's own API at api.fishcity.app. This data is collected directly by Fish City (no third party). Events describe how the Site is used (for example the page, a scroll-depth mark, or the link you clicked, with the referring site and your device type) and carry a randomly generated visitor identifier stored in your browser; they contain no other personal information. We do not store your IP address, or a location derived from it, with these events. If you sign up for an email newsletter (such as the Intel Brief) while Analytics is allowed, we store that visitor identifier with your signup, which links this browser's analytics events to your email address. First-party analytics runs only after you allow Analytics in our cookie banner (Accept all, or Analytics on under Customize). It is off when your browser sends Global Privacy Control (GPC) or "Do Not Track", and it stops and deletes its identifier when you click Reject all or turn Analytics off under Customize.
• Google tags (GA4, Google Ads, and Google Tag Manager) — To measure marketing campaign performance and report aggregate usage metrics, we use Google Tag Manager, Google Analytics 4, and (when advertising is active) Google Ads conversion tags on the Site. The Google container does not load at all until you grant at least one of the categories below in our cookie banner, and it never loads when your browser sends GPC. Until then no request is made to Google, cookieless or otherwise. Any tag that does load also runs under Google Consent Mode v2 with the categories you chose:
  • Analytics storage — GA4 pageview and event reporting
  • Ad storage — Google Ads conversion measurement
  • Ad personalization — tailored ads on Google properties
  • Ad user data — hashed identifiers shared with Google to improve ad accuracy

When you click Accept all in the banner we grant all four categories and the Google container loads. Reject all keeps every category denied, so no Google tag loads, and stops our first-party analytics. Customize lets you toggle each category individually. Your choice is stored in your browser under the fc_consent_v1 key and applied automatically on subsequent visits. Essential cookies for site functionality and security are always on and are required for the Site to work.

5. Your rights and choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you
• Correction — ask us to correct inaccurate information
• Deletion — ask us to delete your personal information (subject to legal exceptions such as record-keeping obligations)
• Restriction or objection — restrict or object to certain processing
• Data portability — receive a machine-readable copy of information you provided
• Withdraw consent — withdraw consent for processing where consent is our legal basis

To exercise any of these rights, contact us at team@fishcity.app with the subject line "Privacy Request." We will respond within the timeframes required by applicable law (typically 30–45 days).

5.1 California residents

Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), California residents have the rights described above plus the right to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell personal information, and we honor Global Privacy Control (GPC) signals as opt-out preferences.

5.2 EEA, UK, and Swiss residents

Under the General Data Protection Regulation (GDPR) and equivalent UK and Swiss laws, our legal bases for processing your personal information include:

• Performance of a contract (when you use the App and we provide services)
• Legitimate interests (analytics, security, fraud prevention, service improvement)
• Consent (marketing communications and certain optional features)
• Legal obligation (responding to lawful requests, tax and accounting records)

You have the right to lodge a complaint with your local data protection authority.

5.3 App permissions

You can control certain data collection through your device settings:

• Location — disable Location Services for the App in iOS Settings or Android Settings
• Notifications — disable push notifications in your device settings or the App's notification preferences
• Tracking — opt out of tracking via App Tracking Transparency (iOS) or your Android advertising ID settings

5.4 Website cookie preferences

To change your website consent choice after you've made one:

• Click Cookie preferences in the footer of any fishcity.app page. The banner reopens with your current choices and you can make a new one. Withdrawing a previously granted choice reloads the page so that already-loaded Google tags are removed.
• Or clear the fc_consent_v1 entry from your browser's local storage for fishcity.app; the banner will reappear on your next visit. Private / incognito browsing starts each session with no stored consent.
• Browser-level signals: the Global Privacy Control (GPC) is honored as a full opt-out on fishcity.app — no Google tag loads and our first-party analytics stays off, regardless of any earlier banner choice, and the banner is not shown. "Do Not Track" turns off our first-party analytics.

5.5 Operator Instagram connection

If you're an operator who has connected an Instagram account, you can disconnect it at any time from the Fish City Operator Portal (Settings → Instagram). Disconnecting immediately deactivates the connection and stops all further use and automated refresh of your stored access token; the token is marked revoked and excluded from all processing, and the stored connection data is removed in line with our retention practices (§7) and deleted when you delete your organization account. You can also revoke Fish City's access directly from your Instagram account settings (Apps and Websites); our next scheduled token refresh will then fail permanently and the connection will be automatically marked revoked and deactivated on our side. To request deletion of Instagram data we hold, disconnect the account as described above or email us at team@fishcity.app with the subject line "Privacy Request."

6. Children's privacy

Fish City is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn we have inadvertently collected personal information from a child under 13, we will delete it. Parents or guardians who believe we may have collected information from their child should contact us at team@fishcity.app.

7. Data retention

We retain personal information only as long as necessary to fulfill the purposes described in this policy and as required by law:

Upon account deletion, we delete or anonymize personal information within 30 days, except where we are required to retain it for legal, regulatory, tax, or accounting reasons.

8. Security

We use industry-standard administrative, technical, and physical safeguards to protect your information, including:

• Encryption in transit (TLS) and at rest
• Access controls and least-privilege provisioning
• Secrets stored in encrypted vaults (e.g., Supabase Vault)
• Regular security reviews and dependency updates

No system is 100% secure. If you believe your account has been compromised, contact us immediately at team@fishcity.app so we can investigate.

9. International data transfers

Fish City is operated from the United States. If you use the App from outside the United States, your information will be transferred to and processed in the United States, which may have data protection laws different from those of your jurisdiction. Where required by law, we use Standard Contractual Clauses (SCCs) or other valid transfer mechanisms to safeguard international transfers.

10. Changes to this policy

We may update this privacy policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this policy
• Where required by law or where the change is material, notify you in-app or by email

Your continued use of the App or Site after changes take effect constitutes acceptance of the revised policy. Prior versions will be archived and made available upon request.

11. Contact us

For privacy questions, requests, or concerns:

• Email: team@fishcity.app
• Subject line for data subject requests: "Privacy Request"
• Mailing address: Cerity Farms LLC, 2108 N St Ste N, Sacramento, CA 95816

For unresolved concerns, EEA/UK/Swiss residents may also contact their local data protection authority.

Fish City — Privacy Policy v1.1 — Last updated July 2, 2026