Privacy Policy

1. Introduction

Low Fruit Solutions PTY LTD (ABN 50 618 456 509) ("Company," "we," "us," or "our") operates the CatchKeeper® mobile application, the catchkeeper.net website, and all related services and content (collectively, the "Service"). We are committed to protecting the privacy of our users ("User," "you," or "your").

This Privacy Policy explains what personal information we collect, how we use and share it, how we protect it, and what rights and choices you have regarding your information. This Privacy Policy forms part of our Terms of Service and applies to all users of the Service, regardless of location.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices described here, please do not use the Service.

2. Information We Collect

We collect information in three ways: information you provide directly, information collected automatically, and information obtained from third-party sources.

2.1 Information You Provide

Account Information: When you create an account, we collect your name, email address, username, password, profile photograph, and any optional profile details you choose to provide (such as biography, home location, and fishing preferences).

Catch Records: When you log a catch, you may provide species identification, length, weight, water depth, fishing category, fishing method, bait or lure details, line class or tippet strength, and any notes or descriptions you include.

Posts and Social Content: Content you create or share through the Service, including photographs, text posts, comments, reactions, and messages.

Location Information You Provide: Location data you manually enter, including saved home or favourite locations and catch locations set via a map pin.

Business Account Information: If you register a business account, we collect your business name, business type, business address, contact details, and the identity of authorised representatives.

Communications: Information you provide when you contact us for support, submit feedback, or respond to surveys.

Event Participation Data: Catch submissions, scores, and related data provided when you participate in fishing events or competitions.

2.2 Information Collected Automatically

Device Information: Device type, operating system and version, unique device identifiers, app version, language settings, and general diagnostic data.

EXIF Metadata: When you select a photograph for catch logging, the Service extracts metadata from the image file locally on your device. This may include GPS coordinates, timestamp, camera model, and image settings. EXIF metadata is stripped from images before they are uploaded to our servers (see Section 4.2).

Location Data: With your permission, we may collect precise GPS coordinates from your device to support catch logging and location-based features. You can control location permissions through your device settings at any time.

Usage Data: Information about how you interact with the Service, including features accessed, screens viewed, actions taken, timestamps, session duration, and performance data.

Log Data: Server logs that may include your IP address, access times, pages viewed, and referring URLs.

Website Analytics Data: When you visit the catchkeeper.net website, we collect aggregate information about the visit — the pages viewed, the approximate geographic region derived from your IP address, the site or search engine that referred you, and general device and browser type. See Section 11 for how this is collected and how to opt out.

2.3 Information from Third-Party Sources

Authentication Providers: If you sign in using a third-party service (such as Apple, Google, or Facebook), we receive limited profile information as permitted by that provider and your privacy settings.

Environmental Data Providers: We obtain weather conditions, tidal data, solunar data, barometric pressure, air and water temperature, and other environmental information from third-party providers based on the location and time associated with your catch records. This data is associated with your catch records but is not used to identify you personally.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing and Operating the Service

To create and manage your account, enable catch logging and social features, process and display your content, deliver location-based features, provide species reference information, generate personal and community analytics, deliver activity forecasting, support event scoring and leaderboards, operate gamification and achievement systems, and administer business accounts.

3.2 Improving and Developing the Service

To understand how users interact with the Service, identify trends and usage patterns, diagnose technical issues, develop new features and functionality, and improve existing features and user experience.

3.3 Communication

To send you service-related notifications (such as account verification, security alerts, and feature updates), respond to your enquiries and support requests, and send optional promotional communications where you have consented to receive them.

3.4 Safety, Security, and Legal Compliance

To detect and prevent fraud, abuse, and security incidents, enforce our Terms of Service and Community Guidelines, comply with applicable laws and legal obligations, respond to lawful requests from authorities, and operate automated content-safety systems that review uploaded images for prohibited material before they become visible to others. See Section 4.4 for details on how automated image moderation works.

3.5 Aggregated and Anonymised Analytics

To generate community-level fishing analytics, species distribution insights, activity forecasting models, and other features using aggregated and anonymised data that does not identify you individually (see Section 5.3).

4. How We Handle Location and Image Data

Given the nature of the Service, location and image data require specific attention.

4.1 Location Data

Location data is central to the catch logging and analytics features of the Service. We collect location data only with your permission and through the following means:

• Device GPS: Real-time location from your device, collected only when you grant location permission through your device settings.
• EXIF Extraction: GPS coordinates embedded in photographs, extracted locally on your device during catch logging.
• Manual Entry: Locations you enter manually or set via a map pin.
• Saved Locations: Home or favourite locations you choose to save in your profile.

You may revoke device location permissions at any time through your device settings. This may limit certain features of the Service that depend on location data.

4.2 EXIF Metadata and Image Privacy

When you select a photograph for a catch record, the Service processes the image locally on your device to extract useful metadata (such as GPS coordinates and timestamps) and pre-populate your catch form. Before any image is uploaded to our servers, EXIF metadata is stripped from the image file to protect your privacy. This means that photographs stored on our servers do not contain embedded GPS coordinates, camera information, or other EXIF data.

The extracted metadata (location and timestamp) is stored separately as part of your catch record, subject to your sharing preferences.

4.3 Image Storage and Processing

Photographs you upload are stored on Amazon Web Services (AWS) S3 infrastructure. Images are processed to generate thumbnails for display within the Service. We do not use your photographs for advertising purposes or share them with third parties except as described in this Privacy Policy.

4.4 Automated Content Safety Scanning

To protect our community and comply with our legal obligations, images you upload are automatically scanned for prohibited content before being shared with other users. This applies to all images, including photos attached to posts, catch records, profile avatars, and account banners. Scanning takes place after upload but before the content becomes visible to others, and operates in two ways:

General content moderation. Each image is analysed using Amazon Web Services Rekognition to detect unsafe content, including but not limited to depictions of nudity, sexual activity, graphic violence, hate symbols, and self-harm. Detected content may be held for human review before publication, or removed if it clearly violates our Community Guidelines. Rekognition is provided by our cloud infrastructure provider and operates under our existing data processing arrangements with them. Images are processed in transit; Amazon Web Services does not retain them after processing.

Child sexual abuse material (CSAM) detection. Each image is hashed and compared against established databases of confirmed child sexual abuse material maintained by the National Center for Missing & Exploited Children (NCMEC, United States), the Internet Watch Foundation (IWF, United Kingdom), and the Canadian Centre for Child Protection (C3P, Canada). We use Microsoft's PhotoDNA Cloud Service to perform this matching. PhotoDNA does not analyse image content beyond comparing image hashes against the database; no information about you is sent to PhotoDNA other than the image hash and the image itself for hash computation.

Account holds and legal reporting. If a match against a CSAM database occurs, we are required by law in multiple jurisdictions (including United States 18 USC § 2258A) to report the incident, the matched content, and information identifying the uploading account to the National Center for Missing & Exploited Children. In Australia, equivalent reporting obligations may apply under the Online Safety Act 2021. We will preserve the related content and account data for as long as legally required, suspend the account, and cooperate with subsequent law enforcement requests. We do not notify uploaders of CSAM reports, in accordance with applicable anti-tipoff provisions.

Manual moderation queue. Content flagged by automated scanning but not requiring immediate action enters a queue for human review by our moderation team alongside content reported by other users. You will be notified if your content is removed or your account is actioned, and you have the right to appeal — see Section 8 (Your Rights) and our Community Guidelines.

4.5 Photographs on Species Pages

To help other fishers identify what they have caught, we may display photographs from publicly shared catch posts on the corresponding species page within the Service.

The test is simply whether the photograph is already publicly visible on your profile.

If someone who does not follow you can see it on your profile, it is eligible. All of the following must be true:

• Your account is a public profile, not a private account.
• The catch is not a private catch.
• The post was shared to your followers.

A post shared only to a private group or to an event is not eligible, even where your account is public. Those are shares to a particular audience rather than to your profile, and we do not treat them as public. If any of the conditions above is not met, the photograph is never eligible.

It is the same photograph, not a copy. A species page displays the same image from your post that anyone viewing your profile would see. We do not keep a separate copy of it for this purpose, and we do not add it to any separate image library.

Where a photograph is displayed, it is credited to you by username and linked to your profile. The catch details behind the photograph are never shown: the time and location of the catch remain private to you, as described in section 4.1. Photographs are displayed as uploaded, with EXIF metadata already removed as described in section 4.2. We display these photographs only — we do not use them to train species-identification models.

You stay in control. Eligibility is re-checked every time a species page is displayed, not once when the photograph is uploaded. Because the species page shows the same photograph from your post, anything that removes it from public view on your profile removes it from the species page at the same moment — making the post or the catch private, switching your account to private, deleting the post, or deleting your account. You do not need to contact us for this to take effect. You may also contact us if you would like a particular photograph removed for any other reason.

Photographs of people. Catch photographs often include the person who made the catch. If you would prefer your photograph not to appear on a species page, keep the post or your account private using the controls above.

Private catch logs, and photographs from private accounts, are never used for this purpose.

5. How We Share Your Information

We do not sell your personal information. We share information only in the following circumstances:

5.1 With Other Users

Content you share publicly or with specific audiences through the Service (including catch records, posts, comments, profile information, and achievements) is visible to other users in accordance with your sharing preferences. Private catch logs are visible only to you.

5.2 With Service Providers

We share information with third-party service providers who perform services on our behalf, including cloud hosting and infrastructure (Amazon Web Services), mapping and location services (Google Maps, Apple Maps), child sexual abuse material detection (Microsoft, via the PhotoDNA Cloud Service — see Section 4.4), customer support ticketing (Freshdesk), email marketing and mailing-list management for the website (Mailchimp, operated by Intuit Inc.), website analytics (Google Analytics — see Section 11), environmental and weather data providers, push notification delivery services, and email communication services. These providers are contractually obligated to use your information only as necessary to provide their services to us and in accordance with this Privacy Policy.

5.3 Aggregated and Anonymised Data

We may share aggregated and anonymised data that does not identify you individually with third parties, including research partners, community analytics features, and for the improvement of fishing-related services. This data may include catch statistics, species trends, location-based fishing activity patterns, and environmental correlations.

5.4 Business Transfers

If Low Fruit Solutions PTY LTD is involved in a merger, acquisition, reorganisation, sale of assets, or bankruptcy, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have regarding your information.

5.5 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect the rights, property, or safety of our users, the Company, or the public.

5.6 Mandatory Child Safety Reporting

Where our automated systems or our moderation team identify content depicting the sexual abuse or exploitation of minors, we are legally obligated in multiple jurisdictions to report the content, the uploading account, and related information to specialised authorities, including the National Center for Missing & Exploited Children (NCMEC) in the United States, the Office of the eSafety Commissioner in Australia, and equivalent bodies elsewhere. These reports are mandatory under laws such as United States 18 USC § 2258A and the Australian Online Safety Act 2021. We will preserve all related content and account data for as long as legally required and cooperate fully with subsequent law enforcement requests. In accordance with applicable anti-tipoff provisions, we do not notify uploaders that a report has been filed.

6. Data Retention

We retain your personal information for as long as your account is active or as necessary to provide the Service to you. Specific retention practices are as follows:

Account Data: Retained for the duration of your account and for a reasonable period following account deletion to allow for reactivation requests and to comply with legal obligations.

Catch Records and Posts: Retained for the duration of your account. Upon account deletion, your catch records and posts will be deleted in accordance with Section 6.2.

Usage and Analytics Data: Retained in identifiable form for up to thirty-six (36) months for active accounts. Removed within thirty (30) days of account deletion via our deletion process.

Server Logs: Retained for up to twelve (12) months for security and diagnostic purposes.

Communications and Support Records: Retained for up to thirty-six (36) months for quality assurance and legal compliance.

Content Subject to Legal Preservation: Where content, account information, or related data is subject to a legal preservation requirement (including, but not limited to, content reported to the National Center for Missing & Exploited Children under United States 18 USC § 2258A, or content subject to a law enforcement preservation request), we will retain that material for the period required by law, regardless of any deletion request you may make. Deletion or other erasure rights described in this Policy are subject to these legal preservation obligations.

6.1 Aggregated Data

Anonymised and aggregated data derived from your information may be retained indefinitely, as it does not identify you personally and is used for analytics, forecasting, and service improvement.

6.2 Account Deletion

When you delete your account, we will delete or anonymise your personal information within thirty (30) days, except where retention is required by law or for legitimate business purposes (such as resolving disputes or enforcing our Terms of Service). Content that has been shared with or reposted by other users may persist in those users' feeds or records.

7. Data Security

We implement technical and organisational measures designed to protect your personal information against unauthorised access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/SSL.
• Encryption of sensitive data at rest.
• IAM-based authentication for database access.
• Regular security assessments and monitoring.
• Access controls limiting employee access to personal information on a need-to-know basis.
• Distributed tracing and monitoring for anomaly detection.

While we take reasonable steps to protect your information, no method of transmission over the internet or method of electronic storage is completely secure. We cannot guarantee absolute security.

8. Your Rights and Choices

Depending on your location, you may have some or all of the following rights regarding your personal information:

8.1 All Users

Access and Portability: You may request a copy of the personal information we hold about you, including your catch records and profile data, in a commonly used electronic format.

Correction: You may update or correct inaccurate personal information through your account settings or by contacting us.

Deletion: You may request deletion of your account and personal information, subject to the retention practices described in Section 6.

Sharing Controls: You may control the visibility of your catch records and posts through the sharing preferences available in the Service (for example, public, followers only, or private log).

Location Permissions: You may enable or disable device location services at any time through your device settings.

Notification Preferences: You may manage your push notification and communication preferences through the Service settings.

Data Export: You may request an export of your catch data and personal data at any time.

8.2 European Economic Area, United Kingdom, and Switzerland (GDPR)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) or equivalent legislation:

Legal Bases for Processing: We process your personal information on the following legal bases:

• Contract: Processing necessary to perform our contract with you (providing the Service).
• Legitimate Interests: Processing necessary for our legitimate interests (improving the Service, ensuring security, and analytics), where those interests are not overridden by your rights.
• Consent: Processing based on your consent (such as optional location tracking, marketing communications, and certain cookies), which you may withdraw at any time.
• Legal Obligation: Processing necessary to comply with applicable laws.

Additional Rights: In addition to the rights listed in Section 8.1, you have the right to restrict processing of your personal information in certain circumstances, object to processing based on legitimate interests, withdraw consent at any time (without affecting the lawfulness of prior processing), and lodge a complaint with your local data protection authority.

Data Transfers: Your information may be transferred to and processed in countries outside the EEA, including Australia and the United States (where our infrastructure providers are located). Where such transfers occur, we ensure appropriate safeguards are in place, including standard contractual clauses approved by the European Commission or equivalent mechanisms.

8.3 Australia (Privacy Act 1988)

If you are located in Australia, your personal information is handled in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). You have the right to access your personal information, request correction of inaccurate information, and make a complaint about our handling of your information. Complaints may be directed to us using the contact details in Section 13, or to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

Notifiable Data Breaches. In the event of an eligible data breach as defined under the Notifiable Data Breaches scheme (Part IIIC, Privacy Act 1988), we will notify affected individuals and the Office of the Australian Information Commissioner as soon as practicable, in accordance with our obligations under the scheme.

8.4 United States

If you are located in the United States, you may have additional rights under state privacy laws, including the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), and equivalent laws in other states. These rights may include the right to know what personal information we collect, disclose, and sell (we do not sell personal information), the right to request deletion of your personal information, the right to opt out of the sale or sharing of personal information, and the right to non-discrimination for exercising your privacy rights.

To exercise any rights available to you under applicable US state privacy laws, please contact us using the details in Section 13.

8.5 Other Jurisdictions

If you are located in another jurisdiction with applicable data protection laws, we will comply with those laws to the extent they apply to our processing of your personal information. Please contact us if you have questions about your rights in your jurisdiction.

8.6 Exercising Your Rights

To exercise any of the rights described above, please contact us at support@catchkeeper.net. We may need to verify your identity before processing your request. We will respond to valid requests within the timeframe required by applicable law (generally within thirty (30) days).

9. Children's Privacy

The Service is not directed to children under the age of sixteen (16). We do not knowingly collect personal information from children under sixteen. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@catchkeeper.net and we will take steps to delete such information promptly.

Where a user is between the ages of sixteen (16) and eighteen (18), we require that a parent or legal guardian has reviewed and agreed to our Terms of Service and this Privacy Policy.

Accounts held by users aged sixteen (16) to eighteen (18) are created as private accounts by default. A private account's posts are visible only to followers the account holder has approved, and its photographs are never eligible for display on species pages (see Section 4.5). The account holder can change this setting, and we encourage parents and guardians to discuss it with them before they do.

10. Third-Party Services and Links

The Service may contain links to or integrations with third-party websites, applications, and services that are not operated by us. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Service.

Key third-party services integrated with the Service include:

• Amazon Web Services (AWS): Cloud infrastructure, data storage, and hosting.
• Google Maps and Apple Maps: Mapping and location services.
• Apple / Google / Facebook Sign-In: Authentication (if used).
• Environmental Data Providers: Weather, tidal, and solunar data.

11. Cookies and Tracking Technologies

In the mobile application. The application does not use traditional browser cookies. It may use similar technologies, including device identifiers, local storage, and software development kit (SDK) tracking, to collect usage data and improve the Service. You can manage certain tracking preferences through your device settings and through the notification and analytics preferences available within the Service.

On the catchkeeper.net website. We use Google Analytics to understand how many people visit the site, which pages they read, and where they arrived from. How it behaves depends on where you are:

• If you are in the European Economic Area, the United Kingdom, or Switzerland, analytics storage is disabled: no analytics cookies are placed on your device. Google Analytics receives only aggregate, cookieless measurement — it does not store an identifier on your device and cannot recognise you on a return visit or across other websites.
• Everywhere else, Google Analytics operates normally and sets a first-party analytics cookie on your device. That cookie lets us tell a returning visitor from a new one and count visits accurately. It is used only to measure use of this website; it does not follow you to other websites.

You can opt out in either case using the options below.

We do not use the website for advertising measurement, remarketing, or ad personalisation, and we do not sell or share website analytics data.

You can opt out of Google Analytics entirely by installing Google's browser add-on at https://tools.google.com/dlpage/gaoptout, or by using your browser's tracking-protection settings.

Mailing list. If you submit your email address to be notified about the app's release, that address is sent to Mailchimp, which manages the mailing list on our behalf. We use it only to contact you about CatchKeeper, and every message includes an unsubscribe link.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, legal requirements, or the features of the Service. Material changes will be communicated through in-app notifications or via the email address associated with your account at least thirty (30) days before they take effect.

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes acceptance of the updated Privacy Policy.

13. Contact Information

If you have any questions, concerns, or complaints about this Privacy Policy or our handling of your personal information, please contact us:

Low Fruit Solutions PTY LTD
ABN: 50 618 456 509
Email: support@catchkeeper.net
Address: Wilton, NSW 2571

For EEA/UK residents: If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority.

For Australian residents: If you are not satisfied with our response, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.

By using CatchKeeper®, you acknowledge that you have read and understood this Privacy Policy.