Fish City Privacy Policy

1. Who we are

This privacy policy describes how Fish City, operated by Cerity Farms LLC ("Fish City," "we," "us," or "our"), collects, uses, and shares information when you:

• Use our mobile application "Fish City: Real Fish Counts" (the "App")
• Visit our website at fishcity.app and its subdomains (the "Site")
• Interact with our marketing communications

You can contact us at:

• Email: [email protected]

2. Information we collect

2.1 Information you provide directly

• Account information (if you create an account): email address, optional display name
• Region preferences: the California region you select within the App (Southern California, Channel Coast, Central Coast, or Bay Area)
• Fish catch logs (if you choose to log catches): species, approximate location, date, count, photos (optional)
• Push notification preferences: which alerts you've opted into

2.2 Information collected automatically

• Device information: device type, operating system and version, app version, language and region settings
• Usage data: screens viewed, features used, in-app actions, session duration
• Approximate location: only if you grant the App location permission; used to set your default region
• Crash and performance data: technical diagnostics that help us fix bugs
• Mobile advertising identifier (IDFA on iOS, GAID on Android):
  • iOS — the IDFA is shared with Meta and other advertising partners only if you grant permission via Apple's App Tracking Transparency (ATT) prompt; the App wires this directly to the Meta SDK's setAdvertiserTrackingEnabled flag.
  • Android — the GAID (Google Advertising ID) is collected by default by partner SDKs (including Meta) for attribution. You can reset or delete the GAID at any time in Android Settings → Privacy → Ads.
• Tracking endpoints: the iOS App's Privacy Manifest (PrivacyInfo.xcprivacy) declares the third-party domains the App contacts for tracking, including Meta's connect.facebook.net, graph.facebook.com, and www.facebook.com; Branch.io's app.branch.io and cdn.branch.io; and Google's www.googletagmanager.com and www.google-analytics.com. The Android App contacts equivalent endpoints (Android does not require an on-device manifest).

2.3 Information from third parties

• App install attribution: when you install the App via a paid advertisement or shared link, we receive attribution data from advertising partners (e.g., Meta, Google) and from our deep-link partner (Branch.io)
• Public fishing data: aggregate fish count, conditions, and trip data displayed in the App is sourced from public landing reports and government APIs (e.g., NOAA). This data is not personal information about App users.

3. How we use information

We use the information we collect to:

• Provide the App's core functionality (region-based fish counts, conditions, trends, push alerts)
• Send you push notifications you've opted into
• Measure and improve App performance, fix bugs, and develop new features
• Measure the effectiveness of our marketing campaigns (only as permitted by your consent and applicable law)
• Detect, prevent, and address security incidents, fraud, and abuse
• Comply with legal obligations and respond to lawful requests from public authorities
• Communicate with you about the App, including service updates and important notices

We do not use your information to:

• Make automated decisions that produce legal or similarly significant effects on you
• Train third-party machine learning models
• Sell your personal information to third parties

4. How we share information

We do not sell your personal information.

We share information with the following categories of recipients:

4.1 Service providers (data processors)

These third parties process information on our behalf, only for the purposes we direct, and under contractual obligations to safeguard your data:

4.2 Advertising and measurement partners

Fish City works with Meta and Google for advertising and uses Apple's and Google's privacy-preserving attribution frameworks to measure campaign performance. The disclosures below describe what data is shared, when, and how you can control it.

Meta Platforms, Inc. Fish City uses Meta's mobile SDK (embedded in the iOS and Android App) and the Meta Marketing API (server-side):

• The Meta mobile SDK posts a small set of standardized "app events" so we can measure how our advertising performs. The events we configure and the parameters we send are:
  • fb_mobile_complete_registration — sent when you create an account; includes the registration method (email, Google, or Apple)
  • fb_mobile_content_view — sent the first time you view fish counts; includes a generic content-type tag
  • fb_mobile_complete_tutorial — sent the first time you select a stats boat; includes a tutorial-step identifier
  • fb_mobile_add_to_wishlist — sent each time you follow a boat; includes the boat's public ID and name
  • App activation — sent on each App launch (Meta's standard activateApp event)
• On iOS, the SDK's setAdvertiserTrackingEnabled flag is wired directly to your App Tracking Transparency (ATT) response. If you decline the ATT prompt, no IDFA is shared with Meta and Apple's SKAdNetwork framework (described below) handles attribution on an aggregate basis instead.
• On Android, the SDK collects your Google Advertising ID (GAID) and auto-logs additional standard events by default (Meta's AutoLogAppEventsEnabled and AdvertiserIDCollectionEnabled are enabled in our Android manifest). You can reset or delete the GAID at any time in Android Settings → Privacy → Ads.
• The Meta Marketing API is used server-side to retrieve aggregate impression, click, conversion, and spend data per campaign. No user-level Platform Data is retrieved through this API.

Google LLC (Google Ads). Used for Universal App Campaigns starting later in our marketing rollout. The same consent framework as Meta applies (ATT on iOS, OS-level Ads controls on Android).

Apple SKAdNetwork (iOS). The iOS App declares 51 SKAdNetwork IDs in its Info.plist to support Apple's privacy-preserving ad-attribution framework. SKAdNetwork lets advertisers measure install attribution without exposing user-level identifiers: Apple aggregates a "conversion value" between 0 and 63 (mapped to install plus the four priority Meta events listed above) and sends aggregate postbacks to the ad network that ran the ad (typically Meta and Branch.io). No IDFA, device ID, or per-user data is included in these postbacks. SKAdNetwork postbacks fire regardless of your ATT response.

Google Play Install Referrer (Android). When you install the App from the Google Play Store, Google's Install Referrer API forwards install timestamp and referrer URL parameters (such as UTM tags from the ad you tapped) to our deep-link partner Branch.io for install attribution. No personal information is included beyond what appears in the referrer URL.

4.3 Public authorities

We may disclose information to public authorities or law enforcement when we believe in good faith that disclosure is required by law, necessary to comply with a legally valid request, or necessary to protect rights, safety, and security. We follow our internal Government Data Request Handling Policy when responding to such requests, including reviewing the legality of the request, applying data minimization, and documenting our response.

4.4 Business transfers

If Fish City is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred to the successor entity. We will notify you (in-app or by email) before your information becomes subject to a different privacy policy.

4.5 With your consent

We may share information for purposes not listed above if we have your specific consent.

4.6 Website analytics and advertising tags

The fishcity.app website uses two parallel measurement systems:

• First-party analytics — We operate a same-origin analytics pipeline that records pageviews, scroll depth, and click events to understand how visitors use the Site. This data is collected directly by Fish City (no third party), contains no personal information beyond a randomly generated visitor identifier stored in your browser, and runs on a legitimate-interest legal basis. It honors the Global Privacy Control (GPC) and "Do Not Track" browser signals as opt-out preferences.
• Google tags (GA4, Google Ads, and Google Tag Manager) — To measure marketing campaign performance and report aggregate usage metrics, we deploy Google Tag Manager, Google Analytics 4, and (when advertising is active) Google Ads conversion tags on the Site. These tags are gated by Google Consent Mode v2: they default to a "denied" state on first visit and only collect data after you make a choice in our cookie banner. The categories you can control are:
  • Analytics storage — GA4 pageview and event reporting
  • Ad storage — Google Ads conversion measurement
  • Ad personalization — tailored ads on Google properties
  • Ad user data — hashed identifiers shared with Google to improve ad accuracy

When you click Accept all in the banner we grant all four categories. Reject all leaves them denied (the default). Customize lets you toggle each category individually. Your choice is stored in your browser under the fc_consent_v1 key and applied automatically on subsequent visits. Essential cookies for site functionality and security are always on and are required for the Site to work.

5. Your rights and choices

Depending on your jurisdiction, you may have the following rights regarding your personal information:

• Access — request a copy of the personal information we hold about you
• Correction — ask us to correct inaccurate information
• Deletion — ask us to delete your personal information (subject to legal exceptions such as record-keeping obligations)
• Restriction or objection — restrict or object to certain processing
• Data portability — receive a machine-readable copy of information you provided
• Withdraw consent — withdraw consent for processing where consent is our legal basis

To exercise any of these rights, contact us at [email protected] with the subject line "Privacy Request." We will respond within the timeframes required by applicable law (typically 30–45 days).

5.1 California residents

Under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), California residents have the rights described above plus the right to opt out of the "sale" or "sharing" of personal information for cross-context behavioral advertising. We do not sell personal information, and we honor Global Privacy Control (GPC) signals as opt-out preferences.

5.2 EEA, UK, and Swiss residents

Under the General Data Protection Regulation (GDPR) and equivalent UK and Swiss laws, our legal bases for processing your personal information include:

• Performance of a contract (when you use the App and we provide services)
• Legitimate interests (analytics, security, fraud prevention, service improvement)
• Consent (marketing communications and certain optional features)
• Legal obligation (responding to lawful requests, tax and accounting records)

You have the right to lodge a complaint with your local data protection authority.

5.3 App permissions

You can control certain data collection through your device settings:

• Location — disable Location Services for the App in iOS Settings or Android Settings
• Notifications — disable push notifications in your device settings or the App's notification preferences
• Tracking — opt out of tracking via App Tracking Transparency (iOS) or your Android advertising ID settings

5.4 Website cookie preferences

To change your website consent choice after you've made one:

• Clear the fc_consent_v1 entry from your browser's local storage for fishcity.app — most browsers expose this under Developer Tools → Application → Local Storage. The cookie banner will reappear on your next visit and you can make a new choice.
• Or browse in private / incognito mode, which starts each session with no stored consent.
• Browser-level signals such as the Global Privacy Control (GPC) are honored by our first-party analytics. Google's tags use Consent Mode v2 as described above; their compliance with GPC is governed by Google's own controls.

6. Children's privacy

Fish City is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If we learn we have inadvertently collected personal information from a child under 13, we will delete it. Parents or guardians who believe we may have collected information from their child should contact us at [email protected].

7. Data retention

We retain personal information only as long as necessary to fulfill the purposes described in this policy and as required by law:

Upon account deletion, we delete or anonymize personal information within 30 days, except where we are required to retain it for legal, regulatory, tax, or accounting reasons.

8. Security

We use industry-standard administrative, technical, and physical safeguards to protect your information, including:

• Encryption in transit (TLS) and at rest
• Access controls and least-privilege provisioning
• Secrets stored in encrypted vaults (e.g., Supabase Vault)
• Regular security reviews and dependency updates

No system is 100% secure. If you believe your account has been compromised, contact us immediately at [email protected] so we can investigate.

9. International data transfers

Fish City is operated from the United States. If you use the App from outside the United States, your information will be transferred to and processed in the United States, which may have data protection laws different from those of your jurisdiction. Where required by law, we use Standard Contractual Clauses (SCCs) or other valid transfer mechanisms to safeguard international transfers.

10. Changes to this policy

We may update this privacy policy from time to time. When we do, we will:

• Update the "Last updated" date at the top of this policy
• Where required by law or where the change is material, notify you in-app or by email

Your continued use of the App or Site after changes take effect constitutes acceptance of the revised policy. Prior versions will be archived and made available upon request.

11. Contact us

For privacy questions, requests, or concerns:

• Email: [email protected]
• Subject line for data subject requests: "Privacy Request"
• Mailing address: Cerity Farms LLC, 2108 N St Ste N, Sacramento, CA 95816

For unresolved concerns, EEA/UK/Swiss residents may also contact their local data protection authority.