Privacy Policy
📱 Privacy in the app 🌐 Privacy on this website
Part A — Privacy when using the CASTA app
This part describes what happens to your data when you use the CASTA app on iPhone and Apple Watch.
In short
CASTA has no servers. Everything you record stays on your own devices and in your own private iCloud database. We cannot see it, and we never receive a copy of it. There is no analytics, no tracking, no advertising, and nothing is sold or shared for marketing purposes.
The only data that ever leaves your device goes to Apple — for iCloud sync, sign-in, maps and App Store purchases — and to a weather service, which receives coordinates in order to return the conditions at your fishing spot.
1. Provider and controller
Timm Robert Jacobsgaard
Wellingsbütteler Landstr. 232a
22337 Hamburg, Germany
Email: timm@casta-fishing.com
Phone: +49 176 62034855
2. Categories of data processed
- Account identifier issued by Sign in with Apple (a pseudonymous, app-specific user ID)
- Name, if you release it during first sign-in
- Voluntary profile details: display name, home water, favourite species, description text, profile picture
- Fishing session data: date, duration, number of casts and bites
- Catch data: species, length, time, catch location
- GPS routes of recorded sessions
- Photos you take or select
- Voluntary notes and photo captions
- Workout data: start, end and duration of a session
- Lifetime statistics and earned awards
- Device information required for the app to function
Only the sign-in is mandatory, because without an account the app cannot associate or sync any data. Every other permission is optional and can be granted or withdrawn at any time in your device settings. This applies in particular to location, motion sensors, the photo library and HealthKit. If a permission is withheld, the features depending on it stay switched off; everything else works unchanged.
3. Nature and place of processing
The provider operates no servers and maintains no database. Data arising from your use of the app is processed exclusively:
- locally on your devices (iPhone and Apple Watch), and
- in the private CloudKit database of your own iCloud account, operated by Apple.
The provider has no technical means of accessing data stored in your private CloudKit database. No user data is transferred to, or stored by, the provider.
The only exceptions are the transfers to Apple and to the weather service expressly described in this policy.
4. Purposes of processing
- Providing the core function of the app: recording fishing sessions, casts, bites and catches
- Syncing your data between your own devices
- Displaying routes and catch locations on a map
- Showing the weather conditions for a session or catch
- Recording a session as a workout on Apple Watch
- Managing the CASTA Pro subscription
5. Detailed information on each processing activity
Storage and sync (Apple iCloud / CloudKit)
The app uses Apple CloudKit to store your data — sessions, catches, photos, profile, statistics — in the private database of your iCloud account and to sync it between your own devices. The provider has no access to this data.
Provider: Apple Distribution International Ltd., Ireland
Data processed: device information, session and catch data, photos, profile data
Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
Sign in with Apple
The app lets you register and sign in using Sign in with Apple. Apple Inc. processes the sign-in as an independent controller. Apple passes to the app only a pseudonymous, app-specific user identifier and — if you release it at first sign-in — your name. The app neither requests nor stores an email address.
Provider: Apple Distribution International Ltd., Ireland
Data processed: user identifier, name where released
Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
More information: apple.com/legal/privacy
Location data
The app processes location data in three distinct situations.
1. Route recording during a session (Apple Watch). While a fishing session is running, the app records your position continuously in order to build the route you covered and the positions of bites and catches. Because recording has to continue while the display is off, an extended location permission is requested for this.
2. A single location fix (iPhone). When you add a catch manually to the catch log, the app can determine your current position once, in order to store the catch location and retrieve the matching weather. No continuous tracking takes place.
3. Resolving a place name. Coordinates are turned into a readable place name through reverse geocoding (see the section on Apple MapKit below).
Your control over this. The app offers several precision levels for how a location is stored. On the "Secret Spot" level, no coordinates and no route points are recorded or stored at all — only a neutral label is kept. Location permission can be withdrawn at any time in your device settings. Without it, routes, catch locations, map views and weather stay empty; every other feature works unchanged.
Data processed: geographic position, route points
Stored in: your private CloudKit database
Legal basis: consent (Art. 6(1)(a) GDPR)
Maps and place names (Apple MapKit)
To display routes and catch locations on a map, the app loads map material from Apple through MapKit. The map sections displayed are transmitted to Apple in the process.
To name a fishing spot, the app also converts the current coordinates into a place name — typically a water body and a town — using reverse geocoding. Coordinates are transmitted to Apple for this as well.
If you select the "Secret Spot" location level, neither coordinate storage nor transmission for place-name resolution takes place.
Provider: Apple Distribution International Ltd., Ireland
Data processed: geographic position
Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
Automatic cast detection using motion sensors (Apple Watch)
The core function of the app is counting casts automatically. To do this, the Apple Watch evaluates the accelerometer during a running session and recognises from the movement pattern when a cast has been made. You can adjust the sensitivity of this detection.
Sensor readings are evaluated exclusively in the device's working memory. No motion data is stored, logged or transmitted — neither to the provider nor to any third party. The only thing kept is the result of the evaluation, that is, the number of casts detected.
Evaluation happens only during a session you have actively started, and ends when you stop it.
Data processed: acceleration values (transient, not stored)
Processed on: the Apple Watch only
Legal basis: performance of a contract (Art. 6(1)(b) GDPR); access to motion data is granted through the system dialog
HealthKit and workout recording (Apple Watch)
When you start a fishing session on the Apple Watch, the app creates a HealthKit workout session of the type "Fishing". This serves two purposes: it allows the app to keep running in the background while the display is off, and it records the session as an activity in your Health app.
The app requests permission only to write a workout. No read access to health data is requested. Heart rate, calories and any other health metrics are never read, stored or transmitted by the app.
The workout stays in the Health app on your device and is subject to your own iCloud settings. No health data is transferred to the provider.
Data processed: start, end and duration of the session
Processed on: your device
Legal basis: consent (Art. 6(1)(a) GDPR), granted through the iOS/watchOS system dialog
Photos
The app accesses the camera and photo library so you can take photos of your catches or pick existing ones and keep them with the session they belong to. Selection happens through Apple's system picker; the app receives no blanket access to your library.
These photos are stored together with the rest of your data in your private iCloud environment. They are not transmitted to the provider or to any third party.
All images are re-rendered and compressed by the app before being stored. In the process, the original capture metadata — in particular any location recorded in the image file, the camera model and the capture timestamp — is discarded. No hidden location data from your photo library is carried over.
Data processed: photos, images
Stored in: your device / your private CloudKit database
Legal basis: consent (Art. 6(1)(a) GDPR)
Weather data (Open-Meteo)
The app shows the weather conditions for sessions and individual catches: temperature, air pressure, wind speed, cloud cover, precipitation and general conditions. It also charts air pressure over time, because pressure trends matter to how fish feed.
This data is retrieved through the Open-Meteo service. The following is transmitted to Open-Meteo:
- the latitude and longitude of the location queried,
- the date of the period requested,
- and, unavoidably for technical reasons, the IP address of your device.
No API key, no user identifier and no device identifier is transmitted. Open-Meteo receives no information about which user made the request, and the request cannot be linked to an account.
The moon phase is calculated locally on the device without any data transmission.
If the app has no location permission, or the device is offline, no weather request is made and the session is simply stored without weather data.
Provider: OpenMeteo GmbH, Hintere Schilligmatte 6, 6463 Bürglen (UR), Switzerland — terms and privacy notice: open-meteo.com/en/terms
Data processed: geographic position, date, IP address
Legal basis: performance of a contract (Art. 6(1)(b) GDPR), where you use the weather feature
Distribution and in-app subscriptions (App Store / StoreKit)
The app is distributed, and the paid CASTA Pro subscriptions are handled, exclusively through Apple's App Store. Apple is your contractual partner for the purchase itself.
Payment processing lies entirely with Apple. The provider receives no payment data, no card details, no billing address and no purchaser names. Through the StoreKit interface, the app only checks on your device whether a valid entitlement exists for your iCloud account.
The provider receives only aggregated, non-personal sales and payout reports from Apple.
Provider: Apple Distribution International Ltd., Ireland
Data processed: purchase transaction, subscription status
Legal basis: performance of a contract (Art. 6(1)(b) GDPR)
6. Cookies and trackers
The app uses no cookies and no tracking technologies for advertising or analytics. There is no ad tracking, and no advertising identifiers (such as IDFA) are processed. The app does not track you across other companies' apps or websites.
The third-party services named in this policy exist solely to deliver the app's core functions, not to monitor user behaviour.
7. Legal bases at a glance
| Processing | Legal basis |
|---|---|
| Account, sign-in, profile | Contract, Art. 6(1)(b) |
| Recording sessions, catches and statistics | Contract, Art. 6(1)(b) |
| Cast detection via motion sensors | Contract, Art. 6(1)(b) |
| Subscription management | Contract, Art. 6(1)(b) |
| Location data and route recording | Consent, Art. 6(1)(a) |
| HealthKit / workout recording | Consent, Art. 6(1)(a) |
| Access to photos | Consent, Art. 6(1)(a) |
| Weather retrieval | Contract, Art. 6(1)(b) |
Consent can be withdrawn at any time with effect for the future, through your device settings. The lawfulness of processing carried out before withdrawal is unaffected.
8. Retention and deletion
Because the provider stores no user data, how long data is kept is entirely up to you. It remains in your private iCloud database until you delete it.
Individual entries — sessions, catches, photos and profile details — can be deleted in the app at any time. Deletion covers both the local copy and the record in your iCloud database.
Exception: lifetime statistics. Cumulative totals — casts, catches and earned awards — are retained when you delete an individual entry. The reason is the integrity of the statistic: it should not be possible to improve it by deleting entries after the fact. These totals contain no location, image or free-text data. They are removed completely when you delete your account.
Full account deletion. The "Delete Account" function in the app's profile section permanently and irreversibly deletes: your profile including profile picture, all recorded sessions, the entire catch log, all photos, personal bests, lifetime statistics, and all local caches on your devices. No separate request to the provider is needed — nor would it be possible, since the provider has no access to the data.
Independently of this, you can remove the app's iCloud data at any time through your device settings (Settings → Apple Account → iCloud → Manage Storage).
9. Transfers to third countries
The app uses services from Apple's ecosystem: iCloud and CloudKit for storage, Sign in with Apple for authentication, MapKit for maps and place names, and the App Store for distribution and subscriptions.
For users in the European Economic Area, the contracting party is Apple Distribution International Ltd., based in Ireland — inside the European Union. Where Apple transfers data to affiliated companies outside the EU in the course of providing these services, it does so under its own responsibility and on the basis of the safeguards Apple has put in place for that purpose. The provider of this app has no influence over such transfers and no knowledge of their extent.
The provider transfers no personal data to third countries. The provider operates no servers and receives no user data.
Weather data is retrieved from a service based in Europe. Only coordinates and, unavoidably, the IP address are transmitted, without any user identifier.
For details on how Apple processes data and which safeguards apply, see Apple's privacy policy: apple.com/legal/privacy
10. Your rights
To the extent permitted by law, you have the right to:
- withdraw consent at any time
- object to the processing of your data
- obtain information about your data and receive a copy
- have your data reviewed and corrected
- request restriction of processing
- request erasure of your personal data
- receive your data and have it transferred to another controller
- lodge a complaint with the competent supervisory authority
Because the provider has no technical access to the data held in your private iCloud database, access and erasure requests cannot be carried out by the provider. All your data is directly visible, exportable and deletable within the app itself. For any questions, the provider is available at the contact details given above.
Competent supervisory authority
Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Straße 22, 20459 Hamburg, Germany
datenschutz-hamburg.de
11. Minors
The app is not directed at children. An Apple account is required to use it, and the applicable age requirements are governed by Apple's terms. If the provider becomes aware that a child's data is being processed without the required consent, it will act on notice.
12. Changes to this policy
The provider may amend this privacy policy at any time. You are encouraged to revisit this page and to check the date given at the top.
Part B — Privacy when visiting this website
This part describes what happens when you simply visit casta-fishing.com, independently of using the app.
Provider and controller
Timm Robert Jacobsgaard
Wellingsbütteler Landstr. 232a
22337 Hamburg, Germany
Email: timm@casta-fishing.com
Phone: +49 176 62034855
Hosting
This website is hosted by IONOS SE, Germany. When you access a page, your browser transmits technical information that is recorded in server log files, including your IP address, the time of the request, the page requested, and browser and operating system details. This data is used solely to operate and secure the website.
Provider: IONOS SE, Germany
Data processed: usage data, IP address
Legal basis: legitimate interest in secure and reliable operation (Art. 6(1)(f) GDPR)
Cookies
This website sets no tracking or analytics cookies of its own and no third-party cookies, such as Google Analytics. Your behaviour on this site is not tracked.
Fonts
All fonts used on this site (Bebas Neue, Inter, DM Mono) are served locally from our own server. No connection is made to external font providers such as Google Fonts.
Contacting us by email
If you contact us by email, we process your email address, your name and the content of your message in order to answer your enquiry. Messages are stored on the servers of our email provider IONOS in Germany.
Legal basis: legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR), or performance of a contract where the enquiry is directed at one (Art. 6(1)(b) GDPR). Correspondence is deleted once it is no longer needed and no statutory retention periods apply.
Your rights
The rights listed in Part A, section 10 apply equally here, as do the contact details of the competent supervisory authority. Requests can be sent to the contact details given above and will be answered free of charge and as promptly as possible, at the latest within one month.
Changes
The provider may amend this part of the privacy policy at any time. You are encouraged to revisit this page.
Definitions
Personal data — any information by which the identity of a natural person is or can be determined, directly or in combination with further information.
Usage data — information collected automatically, such as device information, the time of a request, and operating system details.
User — the person using this application.
Data subject — the natural person to whom the personal data relates.
Controller (or provider) — the natural or legal person who determines the purposes and means of processing personal data. For this application: Timm Robert Jacobsgaard.
This application — the software tool (CASTA) by which the user's personal data is collected and processed.
European Union (or EU) — unless stated otherwise, all references in this document cover all current member states of the European Union and the European Economic Area (EEA).