Privacy Policy

When you create an account: your email address and a password. The password is hashed by Supabase — it is never stored in a form we or anyone else can read.

When you subscribe: Stripe processes the payment and holds your card details. We never see or store a card number. We keep your Stripe customer and subscription identifiers, your plan, and its status, so we know whether to unlock Pro.

How you found us: if you arrive from a link carrying campaign tags (utm_source and similar), or from another website, we record that and attach it to your account when you sign up. It tells us which advertising actually works. It is not shared with anyone.

What you save: today, the rivers you star, add or hide. When the catch log arrives it will also include GPS coordinates, notes and photos you choose to record. Those are yours — see below.

Basic usage: page views and referrers via Vercel Web Analytics, which is cookie-free and does not build a profile of you across other websites.

The catch log is not live yet. When it is, marking a spot records that location and any photo you attach. This is precise personal data, so:

• it is recorded only when you deliberately mark a spot
• it is private to your account, enforced at the database level, not just in the app
• your individual spots are never shown to other users or sold
• aggregated, de-identified patterns across many anglers may be used to improve the Fishability Score

When you ask Cody something, your question and a snapshot of the current dashboard data are sent to Anthropic to generate the reply. Please don't include sensitive personal information in your questions.

We use a small number of providers, all US-based:

• Supabase — database, accounts, and photo storage
• Stripe — payments and billing (PCI compliant)
• Anthropic — powers Cody's answers
• Vercel — hosting and privacy-friendly analytics

We do not sell your personal information, and we do not share it with advertising networks or data brokers.

We use two, and no advertising cookies:

• A session cookie that keeps you signed in. Essential — the site can't work without it.
• hw_attr, which remembers the campaign or referrer that first brought you here, for 90 days. It holds no personal information and cannot be read by JavaScript.

Preferences like your starred rivers are kept in your browser's local storage on your own device.

Account and subscription data are kept while your account is open, and for as long afterwards as tax and accounting rules require for the payments involved. Attribution data is kept for as long as it's useful for measuring marketing, and is deleted with your account.

You can ask us to show you the data we hold about you, correct it, or delete it and close your account. Email support@hatchwise.pro and we'll act on it — normally within a few days and at most within 45 days.

Colorado residents have specific rights under the Colorado Privacy Act, including access, correction, deletion, and the right to opt out of the sale of personal data or profiling. We don't sell data or profile you, and the same email covers every one of those requests.

Hatchwise is not intended for children under 13, and we don't knowingly collect their information. If you believe a child has created an account, email us and we'll remove it.

Data is encrypted in transit. Every table holding user data uses row-level security, so one angler's records are isolated from another's in the database itself rather than only in application code. No system is perfectly secure, but we take the basics seriously.

If this policy changes materially, we'll update the date at the top and tell subscribers by email before the change takes effect.