01DATA CONTROLLER
- Data controller
- Efecan Küçük
- Contact
- destek@mechaway.tech
02WHAT IS COLLECTED
Stored on our server with your account:
- Your email address and username
- An irreversible hash of your password (Argon2). The password itself is never stored.
- Hashes of email verification and password reset codes, which expire shortly
- Hashes of the refresh tokens that keep you signed in
- The list of species you starred in Tavsiyemiz
- Your catch records: species, time caught, place (exact coordinates), optional length, weight, count, method, lure or bait, note, whether it was released, and your visibility and location-precision choices
- Photos you add to a catch
- Your profile photo (optional)
- The conditions added automatically to each catch: wind, waves, sea temperature, pressure, current, moon and the nearest fishing spot
Kept only on your device and never sent to the server:
- Your session tokens (in the iOS Keychain)
- Display preferences, such as whether the depth layer is on and which panel sections you keep open
- Catches and photos not yet sent; they are uploaded once a connection is available
03LOCATION
Balıkolog uses location in three places:
- On the Tavsiyemiz screen, if you allow it, your device's approximate location. The app requests kilometre-level accuracy only and uses it only while the app is open. Location is never collected in the background.
- The coordinates of the point you tap on the map
- When you add a catch, if you allow it, your device's precise location. The app asks for precise location once for that record only; you can also place the spot on the map yourself.
These coordinates are sent to our server to fetch the sea, weather, current and depth information for that point. The server forwards them to Open-Meteo for the weather and sea forecast. When you add a catch, its exact location and time are also sent to Open-Meteo to fetch the weather and sea conditions at that moment; no account information is sent. Coordinates sent for the map and Tavsiyemiz are not stored with your account and no location history is kept. A catch's place, however, is stored with your account as part of that record. The place of a catch set to "Yalnız ben" (private) is visible only to you; the place of a catch set to "Herkese açık" (public) is shown to other users according to the location precision you chose (an approximate area, the shore name only, or the exact point; details below).
One exception: if the weather service returns an error, the requested address, including coordinates, may end up in the server's technical error logs. These logs are not linked to your account and are deleted by the system after a limited time.
You can turn location access off at any time in iOS Settings. The map and Tavsiyemiz keep working without it.
04PHOTOS
Adding photos is optional. Photos are resized on your device (longest side 2048 pixels), and the location, device and capture-time information inside them is removed before upload.
Photos are kept private in Hetzner Online GmbH's object storage in Germany and are shown only through signed links that expire. Photos of private catches are shown only to you; photos of public catches are also shown to other users.
Your profile photo is handled the same way: resized on your device (512-pixel square), stripped of metadata and kept in the same storage. It is shown to other users together with your username: on your shared catch cards, on your comments, in the activity notifications sent to a catch's owner, and in the block list of anyone who has blocked you.
05PUBLIC SHARING AND COMMUNITY
If you set a catch to "Herkese açık" (public) or comment on someone else's catch, that record or comment becomes visible to other users: the photo(s), species, time caught, location (shown according to the precision you chose), your username and profile photo.
Location is shown one of three ways, depending on the precision you choose for that record:
- Approximate (1 km) — the location is rounded to a roughly 1 km area on the map; the exact coordinates never appear in any response
- Shore name only — never shown on the map, only the name of the nearest fishing spot is visible
- Exact point — the exact coordinates are also visible to other users
Visibility ("Herkese açık"/"Yalnız ben", i.e. public/private only) and location precision are chosen per catch and can be changed at any time; the default is public with 1 km precision. A catch set to private is never visible to other users or on the map.
With community features, we also store: the catches you liked, the comments you wrote, the users you blocked or who blocked you, and any reports you filed or that were filed about you, together with their moderation records.
If an account is suspended or a catch or comment is removed, you can write to destek@mechaway.tech to appeal the decision.
06USAGE STATISTICS AND CRASH REPORTS
Balıkolog contains no analytics, advertising or crash-reporting tools. Your behaviour in the app is not tracked and is not linked with other apps or websites.
If you chose in iOS Settings to share crash reports and analytics with Apple, Apple may pass those reports to the developer in a form that does not identify you.
07WHERE DATA IS STORED
The server, database and photo storage run in a Hetzner Online GmbH data centre in Germany. Data is encrypted in transit (HTTPS).
08RETENTION
Account data is kept for as long as your account exists. Verification and reset codes expire after a short time.
Your catches and photos are kept until you delete them or your account. Deleting a catch deletes its photos.
Your profile photo is kept until you remove it or delete your account; uploading a new one deletes the old one.
Report and moderation log records are kept for 1 year, then deleted. Block records are kept until you remove them or delete your account.
When you delete your account in the app (Profilim → Hesabı sil, i.e. delete account; the app is in Turkish), your email address, username, password hash, catches and photos are removed immediately. Your starred species and any pending codes are deleted and all sessions are signed out. What remains is a record identifier and dates that contain no personal information.
09SHARING
Your data is not sold and not used for advertising. To provide the service we work with these providers:
- Hetzner Online GmbH (Germany): server, database and photo storage
- Resend: sending verification and password reset emails. Your email address and the email's content pass through this provider.
- Open-Meteo: weather and sea forecasts. Only coordinates are sent, without any account information.
- Cloudflare: domain name (DNS) service and forwarding of email sent to the support address
Current, wind and depth data from Copernicus, DWD, NOAA and GEBCO is only downloaded; nothing about you is sent to these organisations.
10YOUR RIGHTS
Under Article 11 of Turkey's Personal Data Protection Law (KVKK) and the EU General Data Protection Regulation (GDPR), you have the right to access, correct, delete and port your data, and to object to its processing. You can delete your account yourself in the app. For any other request, write to destek@mechaway.tech; you will get a reply within 30 days.
If you are not satisfied with the reply, you can complain to Turkey's Personal Data Protection Authority or the data protection authority of the country where you live.
11CHILDREN
Balıkolog is not designed for people under 16, and data is not knowingly collected from them.
12CHANGES
If this notice changes, the updated version is published at this address and the date above changes.