Privacy Policy

Last updated: September 26, 2026

Shut Up N Reel LLC, doing business as Fish or Nah ("we," "us," or "our"), operates fishornah.com. This policy explains what information we collect, how we use it, and what you can ask us to do. It describes practices we have implemented. It does not claim certifications we have not obtained.

Information We Collect

We collect information you provide directly:

• Account data — email address and a hashed password when you register. We also store last-login time, a session version used to invalidate old sessions after a password change, and when you confirmed your email address (and when we last sent you a confirmation link).
• Terms acceptance — for new registrations, whether you agreed to the Terms of Service, the terms version, the time of acceptance, the IP address your registration request arrived from (as reported by our hosting proxy), and the browser user agent string that sent it. We keep this with your account as a record of your agreement. Existing accounts created before that feature may have no acceptance record.
• Billing identifiers — Stripe processes payments. We do not store your full card number. We may store your Stripe customer ID, subscription status, subscription plan, and subscription end date, plus Stripe webhook event records used to keep access in sync.
• Preferences — streams you pin and your fishing mode (fly or conventional).
• Angler reports — if you post a fishing report, we store it with your account: the river, the day you fished, the fish, how it was, and the optional spot and note, plus the display name you pick, when you agreed to the angler report rules, and the times of your last five posts, which we keep so the daily limit still counts reports you delete. Your display name and reports are shown to other signed-in users on that river's card. They are not on the public web. If you flag someone's report, we record that you flagged it so you can't flag it twice. Flags are never shown to other users. You can delete a report yourself while it is listed on the river's card (the last 14 days); after that, email us or delete your account.
• Send It alerts — if you turn on a Send It alert for a pinned river, we store which rivers you turned alerts on for and whether each has already alerted for its current good stretch, plus a record of each alert email we send you (the date and the rivers). Turning an alert off, unsubscribing from an alert email, or unpinning the river deletes its alert.
• Free trial — if you start the free Pro trial, we keep a one-way fingerprint of your email address: a keyed hash that can't be turned back into the address, made so that dots and "+" tags in the same inbox count as one. It exists only so each inbox gets one trial. It stays even if you delete your account, so deleting and signing up again doesn't start another trial.

We also collect limited technical data:

• Session cookie — NextAuth uses a JWT session cookie so you stay signed in. That cookie is needed to use the logged-in product.
• First-party analytics — we run our own event tracker, for anonymous visitors and signed-in users alike. Per page load it records an anonymous visitor id, a session id, the page path with no query string attached (query strings on this site can carry password-reset tokens and Stripe session ids, so they are stripped before anything is stored), the referring URL, UTM campaign parameters when present, and a coarse device type (mobile, tablet, or desktop) read from the browser's user agent string. It also records a short, fixed list of named product events — for example viewing the dashboard, starting checkout, or completing a subscription. It does not record keystrokes, form values, session replay, full page URLs, or your IP address. If you are signed in, the event additionally carries a pseudonymous user_key: an irreversible HMAC of your account id, computed with a server-side secret. It is not your email address and not your account id, and it cannot be reversed back into either one. Rotating that secret permanently severs every stored event from every account.
• Google Analytics — the site loads Google Analytics 4 (measurement ID G-3VXK8PYVGG) with the default gtag('config') snippet. Our code does not set IP anonymization, does not disable Google signals, and does not add a Google Ads tag. Analytics cookies are set by Google. The opt-out described under Your Requests and Choices below turns off this tag as well as our first-party analytics — one control, both trackers.
• Browser storage — if you switch light/dark theme, that choice is stored in browser localStorage (fntheme), not on our servers. The first-party analytics tracker above stores its anonymous visitor id the same way, in a browser localStorage key named fn_visitor_id. Both stay in your browser and are not themselves sent to us as a page request; the tracker reads and includes the visitor id when it reports an event.
• Rate-limit and logs — we use client IP addresses in memory to rate-limit signup, login, and password-reset attempts. The only IP address we store durably is the one recorded with your terms acceptance at registration (see Terms acceptance above). Application logs may include emails, IPs, or error details. Hosting logs are controlled by Pair Networks. We have not defined a retention period for hosting logs, backups, or provider logs in this application.
• Location — we do not call the browser geolocation API. Stream catalog coordinates are used to fetch NWS weather for that water, not to locate your device.

How We Use Your Information

• To operate Fish or Nah, including login, the dashboard, and plan entitlements.
• To process Pro payments and cancellations through Stripe.
• To generate Pro AI recommendations as described below.
• To send account and billing emails: a welcome email with a link to confirm your address when you register, one reminder with a fresh link if you haven't confirmed after a day, and a new link if you ask for one, password reset links and a confirmation when your password changes, Pro activation, payment failure, cancellation, and subscription-ended notices, and a confirmation when you delete your account. If you turn on Send It alerts, we also email you the evening before a river you chose looks like Send It. We also send internal/admin notices about signups, billing events, and new or flagged angler reports to the operator inbox.
• To diagnose errors and abuse (rate limits and logs).

We do not sell, rent, or share your personal information with third parties for marketing purposes. The account and billing emails above are service notices, not marketing. Send It alerts are opt-in: you turn them on per river, and every alert email has an unsubscribe link. We do not send marketing email and do not currently collect a separate marketing-email consent.

Where the Service Runs

• Hosting — Pair Networks, Pittsburgh.
• Offsite backups — Pair Networks, Denver. Pair manages production backups. We have not published a backup retention period in this application.
• Email — account and billing emails (welcome and email confirmation, password reset and password-change confirmations, Pro activation, payment failure, cancellation and subscription-ended notices, account deletion confirmation), Send It alerts, and admin notices are delivered by Resend, which receives each recipient's address and the message in order to send it. Subject to Resend's Privacy Policy.

No content-delivery network is currently active for the app.

Third-Party Services

• Stripe — payment processing and the customer portal. Subject to Stripe's Privacy Policy. Stripe may send its own billing emails according to Stripe's settings.
• Anthropic — Pro AI recommendations only. The request payload includes stream name, location, county, state, target species, flow, gage, water temperature when present, weather, a short forecast, and fishing mode (fly or conventional). It does not include your email, account id, or payment information. Responses may be cached by stream conditions (not by user) in memory and in our database. Subject to Anthropic's Privacy Policy.
• USGS & NWS — public streamflow and weather data. No account data is sent to those agencies.
• Google Analytics — usage measurement as described above. Subject to Google's Privacy Policy.

Cookies

Essential: the NextAuth session cookie keeps you logged in. Analytics: Google Analytics cookies from the default GA4 tag. We do not set advertising cookies in our own code. We cannot see every setting inside the Google Analytics property, so we do not claim that Google never uses the tag for ads features or cross-site measurement.

Data Retention and Deletion

We keep account data while the account exists. You may request deletion by emailing us or using Delete account on the plan page. When deletion runs in the app, billable Stripe subscriptions attached to the account are canceled first, then the account row is removed (password-reset tokens, angler reports and flags are removed with it). The free-trial fingerprint described above is not removed, so the same inbox can't start another trial; it can't be turned back into your address.

We do not promise a specific number of days for hosting logs, Pair backups, Stripe records, Resend email records, Anthropic logs, or Google Analytics. Backups and providers may retain copies for a period we do not control. We may also retain information when the law requires it. Cached USGS and AI records are keyed by stream conditions, not by your account.

First-party analytics events are the one exception where we do commit to a number: we keep them for up to 400 days, then delete them in batches on a scheduled job. Fish or Nah is seasonal, and comparing this spring's conditions and usage to last spring's is the reason we keep a year-plus of history rather than the shorter window a non-seasonal product might use.

Your Requests and Choices

You may email bro@fishornah.com to ask for access to, correction of, or deletion of personal data we hold. We will respond as we reasonably can; we have not implemented a self-serve data-export download.

Children

The Terms of Service say you must be at least 13 years old. Fish or Nah is not directed at children under 13, and we do not knowingly collect data from children under 13. We do not currently collect parental consent for teenagers. Whether 13 is the right age gate is an owner decision; this policy matches the current Terms.

Changes to This Policy

We may update this policy. If a change is material, we will notify you by email or by posting a notice on the site at least 14 days before it takes effect, matching the notice commitment in the Terms of Service. We will not treat continued use alone as permission for a new, unrelated use of your personal data. If a change requires a new choice from you, we will ask for it.

Contact

Questions? Email us at bro@fishornah.com.