Privacy Policy

This policy describes how Reel Regs Inc. (“ReelRegs”, “we”, “us”) handles personal information for the ReelRegs website, application and any mobile app (together, the “Services”). We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and British Columbia's Personal Information Protection Act (PIPA).

1. Who is responsible, and how to reach them

Reel Regs Inc. is accountable for the personal information in its custody. We have designated a Privacy Officer, who is responsible for our compliance and who answers privacy questions and requests, at privacy@reelregs.com.

2. What we collect

When you make an account

• Your email address, and a display name if you give one.
• Where you live: your province or territory, or that you are outside Canada. We ask when you first sign in, for sales tax and to understand where our members are.
• The state of your account — such as which provinces it may see regulations for, whether you are on Free or Pro, and any trial or gift running on it.
• A record that you agreed to these documents: which version, and when. See section 9.
• If you ask for our newsletter, a record of that choice: when you made it, the exact wording you were shown, and when you change it. Canadian anti-spam law requires us to be able to show that you asked for email, so we keep it with your email address for three years after you unsubscribe, or after your account is deleted, whichever happens first.

When you use the app

What you save, write or set up in the app is kept with your account. That includes:

• The waters you save.
• Catches you log: what you choose to record about a catch — such as the species, the water, the date, how big it was, and any note you write.
• Spots you pin: the coordinates of the place you pick, with whatever you choose to add, such as a name and a note. We store a spot only when you tap save. If you ask the app to find where you are, it reads your device location at that moment to answer you, and keeps no record of it.
• How you have the app set up: your settings and filters, and which tips, notices and updates you have already seen, so we do not show them twice.
• Reports you send us about a rule that looks wrong, together with what you were looking at when you sent it — such as the water and rule involved, the page you were on, and your app version and browser — so we can reproduce what you saw.

Automatically

• Ordinary server logs needed to run and secure a web service: IP address, approximate city, device and browser type, and what was requested.
• That you signed in: the date, roughly what kind of device (phone, tablet or desktop) and the country. This record holds nothing about what you did once you were inside — that is analytics, in section 5, and it has a switch. This one does not, because it is part of running and securing your account and it is how we count how often the app is used.
• How far you get through checkout, so we can find what stops people buying. Switching analytics off switches this off too.
• That a shared link was followed. People pass ReelRegs on — a friend posting a link, a poster with a code on it. When someone follows one, we note which link it was, the day, the country, and the site they came from. We also make a short code from the network address that lasts a day, so we can tell one person coming back from two people arriving. None of it tells us who anyone is.
• The anonymous id your browser was already using, kept with your account when you sign up. It is what lets us see that the person who read the website last week is the person who joined today, so we can tell which pages bring people in. It is not sent at all if you have analytics switched off, and it is deleted with your account.
• Which version of something you were shown, when we are comparing two. We sometimes send one group a different subject line, or show one group a different page, to find out which works better. We record which group you were in so we can count the result. It says nothing about you.

When you pay

• A record of each payment, refund and chargeback — such as the amount, the tax, the date and what it was for, with the references our payment provider uses to identify it. We keep these as business and tax records for as long as the law requires, which is longer than your account lasts.
• Your subscription history — such as when it started, when a trial became a payment, when you changed plan, and when it ended, including any reason you give when you cancel.

In our emails

• Whether an email reached you, and which links you click in it. Where one of our emails carries a link, it may point at ReelRegs first, which notes the click and sends you straight on. Turning analytics off stops that record being kept; the link still works exactly the same.
• How many people opened a newsletter — a count, not a list. When we send a newsletter, it loads a small image that is identical for everyone who received that issue, so we learn how many copies were opened and never which of you opened one. There is no switch for this because there is nothing about you in it. We do not do it at all for service email about your account.

When you contact us

• Your message and email address, so we can reply and keep a record of the exchange.

If you buy or redeem a gift membership

• Buying one, with or without an account: the email address you give at checkout, so we can send you the gift code and a link back to your order, and your province, which sets the sales tax. Payment details go to our payment provider, never to us.
• Sending one by email: the name you give as the giver, the recipient's name and email address, and your message, so we can send them the gift in your name and show you whether it was delivered. Our email provider tells us whether it arrived. We use the recipient's address for nothing else, and clear their name, address and your message once the gift is redeemed.
• Redeeming one before you have an account: the email address you enter, so we can send you an invitation and hold the gift for that address. It is cleared once the gift is redeemed.
• Redeeming one: your province or territory, kept with the gift, because the sales tax on a gift is due where it is redeemed.
• Checking a code: a short code worked out from your network address — not the address itself, and it cannot be turned back into one — kept for up to a day, so we can limit how many codes one connection can try.

If you ask for product news

• Your choice, when you made it, and the wording you were shown. If you ask for product news when you sign up, or turn on “Product news and tips” in your account settings, we email you occasionally about new features, new regions and the fishing season. You can turn it off there or unsubscribe from any of those emails. Emails your account needs (sign-in, receipts, trial and payment notices) are sent regardless.
• If you ask, at checkout, to be told when ReelRegs Pro or gift memberships are sold where you live: your email address, the province or country, when you asked, and the wording you were shown. We use them to email you once when it opens there, and to count how many people are waiting in each place. You can unsubscribe from that email, or ask us to delete the request, at any time.

Photographs, when we add them. The catch log does not take photographs today. When it does, a photo will be stored with the catch it belongs to and private to your account unless you choose to share it. Photographs can carry information your camera recorded inside the file, including where and when the picture was taken and the device used, and we may use that to place a catch on the map or fill in its date for you. A photo will be deleted when you delete the catch it belongs to, or your account. We may analyse photographs to recognise the fish in them, and to make that recognition better.

If you use a ReelRegs mobile app. We may collect your device model, operating system, app version and settings, and reports about crashes and performance. If you turn them on, we may also collect a notification token, so we can send you alerts, and your device location, which we read to work out which water you are on without storing it. Notifications and location are yours to switch on or off in your device settings at any time.

If you sign in with another service. If you choose to sign in with Google, Apple or a similar provider, we receive your email address and basic profile details from them so we can create and secure your account. We never receive your password for that service, and we do not post anything to it.

3. What we do not collect

• Your password. Sign-in is handled by our authentication provider. We never receive it and we do not store it, hashed or otherwise.
• Your card number. Payment is handled by our payment provider. The card fields on our checkout page are theirs, not ours: what you type goes straight to them and never reaches us. We are told the card brand, its last four digits and whether a payment succeeded, so we can show you which card is on file; we read that from them when you open the page, and do not keep it.
• Continuous or background location. We do not track your location. Your device location is read only when you ask for something that needs it, such as centring the map or naming the water you are on. We keep no history of where you have been. The locations we do store — the spots you choose to save, and later any location your own camera wrote inside a photo you add — are listed in section 2.
• Your fishing licence. We do not ask for it, hold it, or check it.

4. Why we collect it, and your consent

We collect, use and disclose personal information with your consent, for the purposes set out here: to provide, operate, secure and improve the Services; to give you the features you asked for; to answer you; to take payment; to understand how the Services are used so we can decide what to build and fix; to prevent fraud and abuse; to communicate with you about the Services; to promote ReelRegs, using material a member has expressly given us permission to use; to develop and improve features, including automated and machine-learning systems that help us keep the regulations accurate; and to meet our legal obligations. If we want to use your information for a purpose not described here, we will tell you, and where the law requires it we will ask you first. You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice; the practical way to do that is to stop using a feature, turn off analytics, or delete your account.

5. Analytics and error reporting

Product analytics. This is on unless you turn it off. There is no consent banner: this policy is the notice, and the switch below is the off button. We collect information about how the Services are used, so we can see what is confusing, what is slow and what is broken. This may include the pages and screens you open, the features and controls you use, what you search for, your device, browser and settings, the website or link that brought you (including a link in one of our emails), and your approximate location worked out from your network address. When you log a catch, we note the species, never where you caught it. If you use your location to find a water and there is none near you, we note the area you were in, to within about 10 km, so we can see where coverage is missing. We do not record or replay your screen. If you are signed in, this information is associated with your account.

This includes our website. The same analytics run on reelregs.com as on the app, in the same account, and the two are linked: if you visit the website and later sign in, we can see that it was the same person. That is how we learn which parts of the site bring people to the app. Turning analytics off below turns it off in both places.

Two things we never see. Passwords and payment card numbers are handled by our sign-in and payment providers and never reach us, so they cannot appear in anything we collect.

We keep analytics for up to 24 months, and counts and summaries that identify no one for longer. If you delete your account, your analytics profile and its history are deleted with it. Section 9 lists how long we keep everything else.

You can turn analytics off below or in your account settings, and the app works exactly the same with it off. The choice is remembered in this browser and, if you are signed in, on your account, so it applies on every device you use.

Error diagnostics. When something breaks, we receive a technical report of the failure so we can fix it. We also measure how long pages take to load, on a sample of visits, to find what is slow. Neither records or replays your screen.

Visit counts. We also keep a plain tally of which pages are opened and where visitors arrived from. It uses no cookies, and separates one visitor from the next using an identifier that is thrown away and remade each day.

The switch covers product analytics, visit counts, and the record of which links you click in our emails. It does not cover error diagnostics, which we need in order to fix crashes. Nor does it cover a short list of events about your own subscription and payments: that it started, changed or ended, that a payment succeeded, failed or was refunded, that a trial is ending, and that a payment was disputed. We send those to our analytics provider so we can see how the paid product is doing, with the amount where there is one and the reason the bank gave for a dispute. Those carry nothing about how you browse, and they continue either way, because they are records of a transaction between us. Newsletter open counts are not on the list either: they are a tally per issue, with no way to tell who is in it.

We do not share your information with advertising networks for their own purposes.

6. Cookies

We use cookies to keep you signed in, to keep the Services secure, and — unless you have turned analytics off — to recognise a returning visit, so we can tell whether a problem you hit yesterday is gone today. We do not allow anyone to track you across unrelated websites for their own advertising.

If you arrived through a shared link, there are two more: one remembers which link brought you, and one the sequence of links you have followed, each for 90 days, so that if you join we know what brought you. They hold codes for those links and nothing about you, and they never follow you to any other site. If you have analytics switched off, we clear them without connecting them to you.

7. Who else handles it

We use service providers to run ReelRegs. Each is bound by a written agreement that limits them to processing information on our instructions, for us. We do not sell personal information, and we do not disclose it for anyone else's marketing.

If the business changes hands. If ReelRegs is involved in a financing, merger, acquisition, reorganisation or sale of assets, personal information may be shared with the people assessing or completing that transaction, and may be transferred as part of it. Anyone receiving it is bound by this policy, and we will tell you before a new owner changes it.

Information that identifies no one. We may create aggregated and de-identified information from what we hold, and use and share it to run, improve and describe the Services. We do not sell it, and we do not attempt to re-identify it.

Your browser loads the street map, satellite imagery, depth shading and weather directly from third-party map and weather services, which are named on our credits page. Those are requests for public map and weather data; we do not send them anything about you beyond what any web request necessarily reveals, such as your network address.

We may also disclose personal information where the law requires it, to respond to a valid legal demand, or to protect someone's safety or our rights. We will challenge any demand that appears overbroad.

8. Where it is held

Our service providers are United States companies, and your personal information is stored and processed on their infrastructure. That means it may be subject to lawful access requests under the laws of the United States, by courts or government there, regardless of where you live. We have data-processing agreements in place with each of them.

If you would like to know the specific region your account data is stored in, ask the Privacy Officer and we will tell you.

9. How long we keep it

Some records outlast your account, because the law requires us to keep them or because they are no longer about you. None of them is used to contact you or to rebuild a profile of you.

• Until you delete it — your account and everything in it: your catch log, your saved spots, how you have the app set up, your analytics profile, the anonymous id your browser carried before you joined, and which group you were in when we compared two versions of something. Deleting your account removes all of it from our live systems promptly.
• Up to 90 days — encrypted backups of the database, which we keep so we can restore it after a failure. A deleted account disappears from them as they age out. A backup is never used to bring an account back.
• Up to 30 days — server logs.
• 24 months — the record that a shared link was followed.
• 90 days — crash and performance reports. The analytics switch does not cover these, so we hold them for the shortest time we can while still being able to fix what broke.
• Up to 90 days — the delivery reports our email provider sends us, which say whether a message arrived or bounced and carry the address it went to. After that we keep only what happened and which provider it went to — that it was a Gmail address, not which one — so we can see whose mail servers are rejecting ours.
• 24 months — analytics. Counts and summaries that identify no one are kept longer. If you delete your account, your analytics profile goes with it.
• Two years — support emails, so we can see the history of a problem; and administrative actions on your account, such as a plan change we made for you, so we can account for what staff did.
• Three years after you unsubscribe, or after your account is deleted, whichever is first — the record that you asked for our newsletter, and the wording you were shown. That is the period Canadian anti-spam law gives a regulator to ask us to prove it.
• Six years — payment records, including a gift membership's order and the buyer's email address, which is what tax and corporate records law requires. A redeemed gift keeps its record, but not who redeemed it once that account is deleted.
• Seven years after the account ends — the record that you agreed to our Terms and this policy: which version, and when.
• Indefinitely — reports you sent us about a wrong rule, kept as the record of a correction with your identity removed.

10. Your rights

You can ask us for a copy of the personal information we hold about you, to correct it, or to delete it, and we will respond within 30 days. You can do most of this yourself in the app:

• Export your catch log and your saved spots to CSV from the app, any time.
• Delete individual catches, spots or saved waters in the app.
• Delete your account from your account settings, or from reelregs.com/delete-account if you cannot sign in. That removes your catch log, your saved spots and your analytics profile. A few records outlast it, and section 9 lists every one. This cannot be undone.
• Turn analytics off with the switch in section 5 of this policy, or in your account settings. It is the same switch.

We honour access, correction and deletion requests from anyone who asks, wherever they live, whether or not the law where they live requires it of us — subject to the records section 9 says we keep, and to the limited exceptions the law allows.

11. Keeping it safe

Administrative access to member data is restricted to staff who need it to run the service, and sensitive actions are logged. Our providers encrypt data in transit and at rest. Sign-in is handled by a company that does only that. The database enforces per-account access rules, so one account cannot read another's. No system is perfectly secure, and we do not claim otherwise.

12. If something goes wrong

If a breach of security creates a real risk of significant harm to you, we will report it to the Office of the Privacy Commissioner of Canada and, where British Columbia's Personal Information Protection Act requires it, to the Office of the Information and Privacy Commissioner for British Columbia, and tell you as soon as feasible, with what happened, what information was involved and what you can do. We keep a record of every breach, as the law requires, whether or not it is reportable.

13. Children

ReelRegs is for a general audience of anglers and is not directed at children under 13. We do not knowingly collect personal information from them. If you believe a child has given us information, tell the Privacy Officer and we will delete it.

If you are between 13 and 17. Our Terms let you use ReelRegs with a parent or guardian's consent, and only they may buy a subscription. A parent or guardian can write to the Privacy Officer to see what we hold about you, to turn analytics off, or to delete the account.

14. Automated decisions

We do not make decisions about you by automated means alone. We do group members into segments — Free or Pro, new or long-standing, which province — to understand how the app is used; we do not use that to make decisions about you individually.

15. Where the Services are offered

ReelRegs is offered in Canada and is built for anglers in Canada. We do not target it at people in the European Union or the United Kingdom. If you use it from outside Canada, you do so on your own initiative, and we handle your information under Canadian law and this policy.

16. Changes

If we change this policy we will update the date at the top. Where the change is material we will tell you in the Services or by email at least 30 days before it takes effect, and say what changed. A privacy update is a notice rather than a new agreement: you do not have to agree to it again, and if you do not want to carry on under it you can turn analytics off or delete your account.

17. Complaints

Please contact us first so we can try to resolve it: the Privacy Officer, at privacy@reelregs.com. If you are not satisfied, you can complain to the Office of the Privacy Commissioner of Canada, or to the Office of the Information and Privacy Commissioner for British Columbia.