Privacy notice

The short version

• Nothing is needed to read this site or to contribute to it — no account, no name, no email.
• There are no adverts and no tracking, and nothing here follows you around the web.
• If you do write to the site we keep a one-way hash of your IP address for twelve months, to stop one person flooding it. Never the address itself.

There are no adverts and nothing that follows you around the web. You can read every page on this site, and contribute to it, without an account and without giving us anything at all.

You can also create one. An account is optional, it is 18+, and the only thing it asks for is an email address — never your name. It exists so that saved waters follow you between devices and so that what you contribute can be credited to you if you want it to be.

If you contribute something, report a mistake, tell us a page was helpful, or search for a water we do not have, we keep a one-way hash of your IP address so that one person cannot flood the site. We keep it for twelve months and then delete it, and the key it is made with is replaced every month.

If you make an account

You do not need one to read this site or to contribute to it, and that is not going to change. Five things need one: saving waters, keeping a record of the waters you have fished, adding a photograph, logging a catch, and looking after a club’s pages.

If you make one we hold your email address, because the account has to be verified, and a username if you choose one — you do not have to, and until you do your profile is not public. Your profile is private unless you make it public, and that is the default.

You must be 18 or over. We ask you to confirm it; we do not verify it and we do not keep a date of birth.

We do not hold your name, your address or any payment details. There is nothing to pay for.

Photographs

A photograph you upload has its location and camera data stripped before it is stored. We never see where you were standing. Every photograph is looked at by a person before it appears anywhere, and anybody can ask for one to be taken down.

Catch reports

What you log is published as a total on the water’s page and never as an individual record. No name, no date, no single catch. There is no page on this site that lists what one person caught, and no way to ask for one.

Clubs

If you ask to look after a club’s pages, we keep what you send with the request — the page or the address you offered as evidence, and anything you wrote in the note — and the decision we reached. If we then give you the pages, we also keep a note of who we spoke to and when, because that is the record of why your club controls that page. None of it is published.

Once your club looks after a water, we email you when somebody suggests a change to it. Those messages are written and stored here until they are sent, so what we hold is your address and the message itself; a sent one is deleted after a month. We send nothing else to that address, and telling us to stop is a reply to any of them.

Everything we collect, and how long we keep it

• A hashed IP address, when you submit something, report a mistake, mark a page helpful, or search for a water we do not have. It stops one person flooding the site, and it counts a water’s feedback once per person rather than once per click. Kept for twelve months, then emptied.
• What you typed into a form — the name, the price, the permission, the correction. It is the contribution, and it is the evidence behind what the page ends up saying. Kept for as long as the water is on the map.
• An email address, but only if you choose to give one, and only on the report form. We use it to reply to you about that report and nothing else. It is never added to a mailing list. Kept for twelve months, then deleted.
• The words of a search that found nothing — what was typed, never who typed it. It is how we decide which water to add next. The words are kept; the hashed address attached to them is deleted after twelve months.

If you create an account, three more:

• Your email address, so that we can confirm it is yours and reach you about your account. It is not added to any mailing list and we send nothing you did not ask for. Kept until you delete your account.
• A username, if you choose one. It is optional, changeable, and the only thing about you that anybody else ever sees. Leave it empty and your contributions show as Anonymous.
• Which waters you have saved, the names of your lists, and any waters you have marked as fished. Private. There is no setting that makes them visible to anybody else, no water shows how many people have fished it, and we do not use any of it to work out anything about you.

We record that you confirmed you are 18 or over and which version of the terms you accepted, with the date. That is the record that says what you actually agreed to.

That is the complete list. We never ask for your name, your address, your telephone number or your date of birth. There is no profile beyond the three lines above, no advertising identifier, no cross-site tracking and no device fingerprinting, and nothing records which pages you looked at.

Deleting your account

There is a button on your account and it does what it says. Your email address, your username, your saved waters and your record of waters fished are erased outright.

The waters, corrections and photographs you contributed stay on the site. They are facts about a river rather than facts about you, and other people are relying on them — so the contribution stays and its credit becomes Anonymous. Nothing left behind can be traced back to you.

That is the trade, and it is stated here so it is not a surprise: the name goes, the content stays. Because an anonymous contribution has nothing attached to it, it is anonymous permanently — we cannot go back and put your name on it later, even if you make an account afterwards.

You can also download everything we hold, as a file, from the same page.

How the hashing works, and why it stops working

Your address never reaches the database. Our server combines it with a secret key held only by the server, and a random salt held only by the database, and stores the result — sixty-four characters that cannot be turned back into an address.

We use that hash for these things and nothing else:

• limiting how many submissions one person can make in an hour
• counting a water’s feedback once per person rather than once per click
• counting how many separate people searched for something we do not have
• blocking someone who is deliberately submitting false or abusive information

We do not use it to build a profile of you, and we cannot use it to recognise you anywhere else.

Searches that found nothing

If you search for a water and we have nothing, we record what you typed and a hashed count of how many separate people have asked for the same thing. It is how we decide what to add next, and it is the only search we record — a search that works is never stored.

We do not keep it alongside anything that identifies you, and there is no session or history attached to it. The hashed address is deleted after twelve months; the words stay, because by then they are a note about which waters this site is missing rather than anything about a person.

Twelve months is a job, not a promise

Every night an automatic task empties every hashed address older than twelve months, deletes the rows where the hash cannot be separated from the record, and removes the email address from any report older than twelve months. It writes down how much it removed each night, so we can show you that it ran.

Asking us to delete something sooner

Use Report incorrect information, or the address in the footer, and tell us what to look for — the water you sent something about and roughly when, or the words you searched for.

We are not being obstructive in asking. Because we hold a hash rather than an address, and because that hash changes every month, we genuinely cannot look up “everything from your IP”. You have to point at it. We will delete it and tell you what we deleted.

Cookies and local storage

We set no tracking or advertising cookies, and there is no consent banner because there is nothing to consent to.

Two things are kept in your own browser. Neither is about you, and neither reaches us:

• A shape you are part-way through drawing, held in your browser’s session storage so that it survives the step between the map and the form describing it. It is discarded when you close the tab.
• The filters you have chosen, written into the address bar so that a filtered map is a link you can send to somebody. That also means it is in your browser history, like every other page you visit.

Where you were looking on the map, and whether you have been here before, are not stored at all — on your device or on ours. Every visit starts in the same place.

Two cookies are set, and only if you put yourself in the situation that needs one: a sign-in session if you have an account, and a moderation key if you sign in to moderate the site. Both are strictly necessary — each does the thing you asked for and nothing else — which is why there is still no consent banner. Every cookie this site sets is named in the cookie notice.

Analytics

We use Umami, a cookieless analytics product. It counts page views and a handful of actions — a report filed, a water submitted, a search that found nothing — with no cookies, no profile of you, and no way to follow you to another site. That is why this page has no consent banner.

Whatever we use will be cookieless. It will not set a cookie, will not use local storage to track you, will not fingerprint your device, and will not follow you to any other site. It counts pages, not people: we can see that a page was viewed, not who viewed it or what else they did. That is why this site has no cookie banner — there is nothing to ask you to agree to.

The companies involved in showing you this page

• Our host serves every page, so it necessarily handles your IP address in order to send you one, and keeps short-lived server logs. Every website works this way.
• The map tile provider sends the map imagery, and sees your IP address for the same reason.
• Supabase is our database host. Details of waters are stored there, and so is your hashed address. Your address itself is not.
• Sentry, if a page breaks, receives the error: which page, which browser, and where in our code it went wrong. It is configured not to send request bodies, so what you typed into a form is not part of an error report.

We do not sell data to anyone, and there is nobody else.

Your rights

Under UK GDPR you can ask what we hold about you, ask for it to be corrected or deleted, and complain to the Information Commissioner’s Office. Because we store hashes rather than addresses, and because those hashes expire, we may need you to tell us which submission was yours in order to find it.

Contact

Use Report incorrect information, or the contact address in the footer.