Privacy policy

Last updated: 24 October 2026

1. Who processes your data

The data controller for the RoFish app and website is COLAC ION-VALERIU PERSOANĂ FIZICĂ AUTORIZATĂ (sole trader), tax ID (CUI) 54290566, Trade Register no. F2026014810004, registered office at B-dul Bucureștii Noi nr. 136, parter, ap. 5, Sector 1, Bucharest, Romania. Contact for any question about your data: admin@rofish.app. We process data in accordance with Regulation (EU) 2016/679 (GDPR) and Law 190/2018. This policy explains what data we collect, why, who we share it with, how long we keep it and what rights you have.

2. What data we collect

Account: e-mail address, display name, username, profile photo, phone number (optional), your Google/Facebook/Apple account identifier if you log in through them (they send us your name, e-mail address and, where available, your profile photo), your chosen language, the account creation date and the date of last activity. If you don't choose a display name, we build one from your Google/Facebook/Apple account name or from the part of your e-mail address before the @ sign; you can change it at any time in your profile. Content you publish: catch posts (photos, clips, species, description), comments, likes and dislikes, polls and votes, reviews (including photos), private messages and general chat messages, Marketplace listings (title, description, price, category, condition, county, photos), events you organise (including the contact details you write in the announcement), proposed edits to lakes, reports. Metadata in photos and clips (including location): files made with a phone can contain hidden information, such as the date, the phone model and the exact place where the photo or video was taken (GPS coordinates). When you upload photos, they are recompressed and their metadata (including the location and date from the camera) is removed; we do not keep the location from photos. Video clips are uploaded as they are and may contain the camera's metadata, including the location; anyone who downloads a public clip can read this metadata. If you don't want the location to end up in a clip, turn off location saving in your phone's Camera app before filming (iPhone: Settings → Privacy & Security → Location Services → Camera; Android: Camera app → Settings → Location tags) or choose the option without location when sharing. Location: your device's coordinates, only if you grant permission and only while you're using the app or the website (we don't track location in the background). We use them on the spot for weather, solunar, pressure, water temperature, the distance to fishing spots and the name of the locality. For the forecast, the coordinates are sent to Open-Meteo, and the locality name is obtained through your phone's location service (Apple or Google). We don't keep a history of your location. We save a position only when you choose to: (1) when reporting poaching or pollution to the authorities you can attach your GPS position, which is saved with the report and appears in the text you send to the authorities (in the mobile app the option is ticked by default and you can untick it); (2) when you propose a new fishing spot, you can use your position as the spot's position, and it becomes public. “I'm here today”: if you announce that you're at a lake, we save the lake and the day. Other logged-in users can see that you were there, and the lake owner gets a notification. You can withdraw the check-in at any time. Publicly visible activity: the users you follow and those who follow you, your likes and dislikes, event participation, points, leaderboard position and game records (with your name and profile photo), as well as the history of approved edits to a fishing spot (who changed it and when). Data visible only to you: your fishing journal (trips, catches, notes, the weather at the time), water level alerts, trivia answers, poll votes, the users you've blocked, who invited you to the app. Reports to the authorities: the type, description, place, photo and, if you choose, the GPS position. Only you and the RoFish team can see them. You send the report yourself, from your own e-mail app, to the institutions you choose; we don't send it on your behalf. The attached photo can be opened by anyone who has the link, so that the institution can view it. Contact and claims: the name, e-mail address and message from the contact form (you can use it without an account); when claiming a lake, the phone number and the information you send us for verification. Fish identification and weight estimation: the photo you choose is sent, through our server, to Google (Gemini API), which analyses it and returns the result to us. Before the first upload, the mobile app asks for your consent (once per phone); on the website you are told right next to the upload button. We don't store the photo; we keep only the result (the species and confidence level, or the estimated weight and length) and the date, for the daily limit and for your history. Bookings and payments: fishery, date, duration, number of companions, amount, fee, status and the Stripe transaction identifier. For card payments in the Marketplace we keep the listing, the buyer and the seller, the price, the total paid, the fee, the status, the Stripe payment identifiers and the time of the consent given by the buyer before paying. For sellers who enable card payment we keep the Stripe account identifier, the time of the consent to the fee, the name, town and county used on the fee invoice, and the invoices issued. You enter card details directly in the Stripe form -- we do not see or store them. For donations made through Stripe we only keep the confirmation received from Stripe and, if you left public display ticked, the display name shown in the public announcement. Marketplace delivery details: when you buy an item, you give us the delivery method, the recipient's name, the phone number, the delivery address (for courier delivery), any notes for the seller and the billing details (optionally, the company name and tax ID (CUI)). We keep them with the transaction so the seller can send you the item, and if you tick “Remember my details for future purchases”, we also keep them in your account to fill in the form next time. Only you can see your saved details, and you can change or delete them at any time: in the app (Settings → My account → My delivery details) or on the website, at https://rofish.app/cont/date-livrare. Notifications: a technical device token (Expo/Apple/Google), only if you allow notifications, plus your notification preferences. Technical data and protection against abuse: server logs (IP address, device/browser type, access times, errors), kept temporarily by our hosting providers for security and debugging. To limit abusive requests, we keep for a short time a request counter tied to your account or, if you're not logged in, to your IP address. Moderation: reports made by you or about your content (with a short excerpt of the reported content) and the measures taken by the moderation team (hiding content, suspending the account). Acceptance of the terms: the date and version of the Terms and conditions accepted when creating the account. Map pins: the exact spot, type, title, description, photos and comments of the pins you drop on public waters, with the visibility you choose (everyone, only your followers or only you). The online game “Predators”: while you play, the other players in the same lake see your player name and the fish you picked. The game server receives your account identifier (so the score is saved to your account) and your IP address (to limit abuse) and does not store them after you leave the game.

3. Data about fishing spots and their administrators

For the fishing spots in the directory we display the administrators' contact details (name, phone number, website, social media pages). We took them from public sources (the lakes' own websites, social media pages, fishing directories, lists published by the authorities) or received them from owners or users. We use them only so that anglers can get in touch with the spot. If you run a fishing spot and want your number or other details corrected or removed, write to us at admin@rofish.app and we'll make the change without delay. You also have the other rights listed in the “Your rights” section, including the right to object to this processing.

4. Why and on what legal basis

• Performance of the contract with you (Art. 6(1)(b) GDPR): creating and managing your account, including sign-in through Google/Facebook/Apple if you choose it; displaying content; messaging; the Marketplace, including card payment and the fee; bookings; donations; the features you turn on yourself (“I'm here today”, the log, reports, events, games and leaderboards); notifications about activity that concerns you. • Consent (point a): access to location, camera and gallery and receiving push notifications, which you allow from your phone; attaching the GPS position to a report to the authorities; sending the photo to Google Gemini for fish identification and weight estimation, for which the app asks for your consent before the first upload. You can withdraw these at any time from your phone's or the app's settings; for photos, it is enough to stop using those features. • Legitimate interest (point f): platform security, preventing fraud and abuse (including limiting the number of requests per account or per IP address), content moderation, handling reports and blocks, aggregated statistics (e.g. the number of active users), improving features, displaying the contact details of fishing spots. • Legal obligation (point c): issuing invoices and sending them to the RO e-Factura system, keeping payment records and responding to requests from the authorities. We don't make automated decisions with legal effects on you. Fish identification and weight estimation are for guidance only, with no legal effect. Moderation is done by people. Communications: we only send you service emails (account confirmation, password reset, payment confirmations from Stripe, notices about important changes to the terms). We do not send marketing emails. Push notifications concern activity in your account and, occasionally, important announcements about the service; you can turn them off in Settings → Notifications.

5. Who we share data with

Providers that process data for us, under contract: • Supabase, Inc. -- database, authentication and file storage; the data is hosted in the European Union (Ireland); • Vercel, Inc. -- hosting of the website and the app's server; the server functions run in the European Union (Ireland); • Expo (650 Industries, Inc.), Apple and Google -- delivering push notifications; the notification's title and text pass through them; • Google (Gemini API) -- analysing the photo for fish identification and weight estimation. Under the Gemini API terms that apply to developers in the European Economic Area, Google processes the photo on our behalf, doesn't use it to improve its products and keeps it in logs for a limited period, to detect abuse. Even so, don't send photos with people or personal data; • Open-Meteo -- the weather forecast based on coordinates and searching for localities by name (no account, no personal identifiers); • Giphy, Inc. -- GIF search (Giphy receives the search term and the IP address); • OpenStreetMap and the services through which the map is loaded -- the map images; their servers receive the IP address and the map area you're viewing; • Cloudflare, Inc. -- the server of the online game “Predators”; while you play, it receives your IP address, account identifier and player name. Independent controllers: • Stripe Payments Europe, Ltd. -- processing payments for bookings, for card payments in the Marketplace and for donations, under its own privacy policy; we pass on the email address, the account identifier and the details of the booking, the sale or the donation; owners and sellers who receive payments are asked by Stripe directly for identity and bank details; • the National Agency for Fiscal Administration (ANAF) -- receives, through the RO e-Factura system, the invoices issued by RoFish for the Marketplace fee, with the seller's name, town and county, as required by law; • Google, Meta (Facebook) and Apple -- if you choose to log in with their accounts, they confirm your identity to us under their own policies; • Apple or Google, as your phone's provider -- turn coordinates into the name of the locality, through the phone's location service; • lake owners -- receive your name and the details of the booking you make, and learn that you're at their lake if you announce “I'm here today”; • the seller of the item you buy in the Marketplace -- receives, only after the payment is confirmed, the delivery and billing details you filled in, solely to send the item, for the invoice and for communication about this sale; • other users -- see your public content (profile, posts, reviews, comments, general chat, listings, events, leaderboards, follows, likes) and the messages you send them; the general chat and public content can also be seen by visitors without an account; • the authorities to which you yourself send a report, from your own e-mail address. The data in your account is hosted in the European Union. Some providers (Supabase, Vercel, Expo, Google, Giphy, Stripe, Cloudflare) have their headquarters or teams in the United States and may process or access data from there; the transfer is based on the European Commission's standard contractual clauses and/or the EU-US Data Privacy Framework certification. We don't sell your data and don't use it for advertising. We may disclose data to the authorities when the law requires us to.

6. Cookies and similar technologies (website)

The rofish.app website uses only the cookies and local storage it needs in order to work: • the Supabase session cookies, which keep you logged in; • “limba”, which remembers the language you chose (1 year); • “rf_oauth”, a temporary safeguard used while logging in through Google/Facebook/Apple (10 minutes); • on the Stripe payment pages (booking, payment for a Marketplace item, donation), the cookies set by Stripe to prevent fraud; • in the browser's local storage, the data of some tools (for example the timers and the packing list), which stays on your device and is not sent to us. We don't use advertising or tracking cookies and don't integrate analytics services that build profiles. The mobile app doesn't use cookies; it keeps the session and your preferences in the phone's storage.

7. How long we keep data

• Account data and your content: as long as the account is active. You can delete your account from the app (Settings → My account → Delete account) or on the website, at https://rofish.app/cont/sterge-cont. Deletion is immediate and cannot be undone. • What is deleted with the account: your profile; posts, comments, likes, reviews; general chat messages; Marketplace listings; the fishing journal; “I'm here today” check-ins; reports to the authorities; bookings you made; reports you filed about content; the photos and clips you uploaded. The private conversations you took part in are deleted entirely, including for the other participant. • What stays, with no link to your name: the photos you added to fishing spots and the approved changes to lake information; the problem reports you sent; messages sent through the contact form; the short excerpts of your content that was reported and the record of moderation measures; if you were publicly announced as a donor, that announcement. The lakes you managed become unclaimed. • Payments: the record of card payments stays with Stripe, according to its legal obligations. We only keep what financial and accounting law requires (the invoices issued and the record of Marketplace fees), for the legal archiving periods. • Marketplace delivery details: the copy attached to an unfinished payment is deleted after 7 days; the copy attached to a paid sale is kept for 3 years from the payment (for delivery, returns, warranty and any complaints) and then deleted. The details saved in your account remain until you delete them or delete your account. • Listings marked as sold: stay in your account until you delete them or your account. • “I'm here today” check-ins, identification and estimation results, scores and points: as long as you have the account. • Technical logs: at most 30 days at our providers, except for security incidents under investigation. Anti-abuse counters (per account or per IP address): usually a few days at most. • Reports, moderation records and correspondence: as long as needed to resolve them and to defend our rights in any disputes; we delete them when they are no longer needed for that purpose. • Map pins, with their photos and comments: until you delete them or delete your account.

8. Your rights

You have the right to access your data, to rectification, to erasure, to restriction of processing, to portability, to object (in particular to processing based on legitimate interest) and to withdraw consent, without affecting the lawfulness of earlier processing. You can exercise most of them directly: editing your display name and profile photo, deleting posts and listings, withdrawing your “I'm here today” check-in, exporting your fishing journal, turning off notifications, withdrawing location permission in your phone's settings, deleting your account from the app or on the website (https://rofish.app/cont/sterge-cont). If you no longer have access to your account, write to us from the account's e-mail address and we'll delete it for you. To change your e-mail address or phone number, to get a copy of all your data or for any other request, write to us at admin@rofish.app; we reply within 30 days at most. If you are the administrator of a fishing spot, you can ask us at the same address to correct or remove your contact details. If you believe the processing breaks the law, you can file a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), 28-30 G-ral. Gheorghe Magheru Blvd., Bucharest, www.dataprotection.ro, or go to the courts.

9. Minors

RoFish is intended exclusively for people aged at least 18. We don't knowingly collect data from people under 18; if we learn that an account belongs to a minor, we delete it. Parents or guardians can write to us at admin@rofish.app.

10. Security

We use encrypted connections (HTTPS), secure authentication, row-level access rules in the database (each user sees only what they're allowed to see), data encryption at our providers and restricted administrative access. Photos and clips from posts, reviews, the general chat, listings and reports to the authorities are stored as files that can be opened by anyone who knows their address (the link); photos in private messages are accessible only to the participants. No method is 100% secure; in the event of an incident affecting your data we'll inform you as required by law.

11. Changes

We may update this policy. Important changes are announced in the app or by e-mail; the date of the last update is shown at the top.

12. Contact

admin@rofish.app or the “Report a problem” option in Settings (in the app).

Operator identification details

Name:: COLAC ION-VALERIU PERSOANĂ FIZICĂ AUTORIZATĂ
Tax ID (CUI):: 54290566
Trade Register no.:: F2026014810004
Registered office:: B-dul Bucureștii Noi nr. 136, parter, ap. 5, Sector 1, București, România
Email:: admin@rofish.app
Phone:: +40 768 985 698