Surfishlog
The short version
Your fishing log is yours. Your spots, trips and catches are used only to run Surfishlog for you. They are never shared, sold, published, or pooled with other anglers' data, not even anonymized. There are no ads and no tracking cookies. We count page visits with Umami, which uses no cookies and never sees your log. You can download all of it, or delete all of it, whenever you want.
What we collect
Your account
Your email address and a password (stored only as a one-way hash). If you subscribe to Pro, Stripe gives us a customer ID and your subscription status; we never see or store your card.
Your log
What you enter: spots (name, type, ZIP code and the pin you drop on the map), trips (times, rating, notes), what the water looked like (clarity, surf, weed, bait, birds), what you threw, and the fish you caught (species, length, released or kept, time).
Conditions we add
For each trip we look up and store the tide, tide swing, water temperature, moon, sunrise and sunset, and weather for your spot and time, from the services listed below.
Your location
Only when you ask. "Use my location" on the spot form sends your position to our server to fill in the ZIP code and find nearby tide stations, and it's saved only if you save the spot. Beach Mode's "Find my spot" compares your position to your saved spots on your phone; it isn't sent to us. We never track your location in the background.
How we use it
- To run the app for you: your log, your analysis, your forecasts and plans.
- To email you about your account (password resets and email changes). No newsletters or marketing.
- To answer feedback you send us.
Your analysis and forecasts are computed from your own trips only.
Who else is involved
A few services help run Surfishlog. Each gets only what it needs:
- Railway hosts the app and its database in the United States. Your account and log are stored there.
- NOAA (U.S. government) provides tide predictions and water temperatures. We send station IDs and dates, nothing about you.
- OpenWeather provides weather. We send your spot's ZIP code or coordinates and the time.
- OpenFreeMap serves the map images on spot pages. Your browser loads them directly, so OpenFreeMap sees your IP address and which area of the map you're viewing.
- Resend delivers our emails, so it receives your email address and the message.
- Stripe handles Pro payments, so it receives your email and payment details, under its own privacy policy.
- Umami counts page visits so we know which pages people use: the page address (without anything after the "?"), the site that sent you, and your browser, device type and country. It sets no cookies, doesn't store your IP address, never sees your trips, catches or spots, and skips you entirely if your browser sends Do Not Track. It's never loaded on password-reset or email-confirmation links, or in Beach Mode.
Fonts and app code are served from our own servers. We don't use any advertising or social-media scripts.
Cookies and storage on your device
Only the cookies the app needs to work: keeping you logged in, protecting forms against forgery, showing one-time messages, returning you to the page you wanted after logging in, and a short cooldown on the feedback form. No tracking or advertising cookies. Beach Mode keeps a copy of your spot list, your current trip and any trips waiting for signal on your phone, so it works with no service and a dead zone can't lose a fish. Signing out clears the spot list from the phone; deleting your account clears all of it.
Your choices
- See and edit everything in the app, anytime.
- Download your whole log (every trip and fish, the spot, conditions and what you threw) as a spreadsheet (CSV) from Settings → Your data, or print a PDF logbook from My Trips.
- Delete your account from Settings. It immediately and permanently deletes your account and your whole log, and stops any Pro billing first (Pro ends at once; ask us about the rest of a paid year).
How long we keep it
As long as you have an account. When you delete it, everything is removed at once from our database, and any copies in our hosting provider's backups expire on its retention schedule. Stripe and Resend keep their own records of payments and sent emails as the law requires. Messages you sent through the feedback form stay in our inbox; ask and we'll delete them.
Security
Everything travels over HTTPS. Passwords are stored only as slow, salted hashes. Every request for your data is checked against your account, so no one else can see or change it.
Children
Surfishlog isn't meant for children under 13, and we don't knowingly collect their data.
Changes
If we change how your data is handled in a way that matters, we'll tell you in the app or by email before it takes effect.
Contact
Questions or requests about your data? Use the feedback form and we'll get back to you.