How we handle your data

The short version

riggr is a fishing log built for Great Lakes trollers. To do its job, it stores the catches, trips, waypoints, photos, and (when you choose) live GPS that you put into it. Your data is yours — we don't sell it, we don't train AI models on it, and we give you per-post visibility controls so you decide what's private, visible to followers, or public.

This document explains the specifics. If you just want the gist, that's it.

Who we are

riggr is a fishing log service operated by riggr LLC. For questions about this policy or your data, contact us at hello@riggr.app.

What we collect

Account info

• Email address (for sign-in and important account notices)
• Display name, boat name, home port, bio, avatar, boat photo (whatever you enter)
• Google OAuth profile data if you sign in with Google (name, email, profile image)

Fishing data

• Catches — species, weight, length, depth, speed, lure, photo, GPS coordinates
• Trips — start/end times, port, boat, notes, GPS tracks if you record them
• Waypoints — saved spots with your own notes
• Posts, likes, comments on the community feed

Location

• GPS coordinates on catches — stored with every catch so you can see them on the map. Visibility is controlled by the per-catch privacy toggle you set.
• Live location sharing — only when you explicitly turn it on. You choose off, mutual-follows-only, or public. Not collected when off.
• Background GPS tracking — only while you're actively running a trolling track. Requires opting in via the phone's location permission dialog.

Media

• Photos you upload (catches, profile, boat, posts) — stored in Supabase Storage.
• Voice recordings (Voice Log) — audio you record to log a catch hands-free is sent to Deepgram for transcription and Anthropic (Claude) for field extraction. We don't keep the audio file on our servers after transcription. The resulting transcript and parsed catch fields are saved with your catch record.
• Bait ID images — photos of lures you submit for AI identification are sent to Anthropic (Claude) and not retained by riggr after the identification completes.

Technical data

• Standard server logs (IP address, browser, timestamps of requests) via Vercel and Supabase.
• Session cookies for authentication.
• Product analytics via PostHog — we record page views, button clicks, and form submissions tied to your user ID (after sign-in) or an anonymous identifier (before). This helps us understand which features are useful and where the app is confusing. We do not sell data to third parties. PostHog respects the browser's Do-Not-Track setting; if you have it on, we don't send PostHog events.
• Ad measurement via the Meta (Facebook) Pixel when a campaign is running — page views and a signup conversion so we can tell whether an ad led to an account. If you create an account we send Meta a hashed email and user id (Advanced Matching) so they can attribute the signup to an ad. We do not send Meta your catches, trips, location, or photos. The pixel is off unless a campaign ID is configured, and it respects Do-Not-Track.
• Crash diagnostics via Sentry — when the app or website crashes or hits an unhandled error, we capture a stack trace, the screen / page you were on, and recent app actions (taps, navigation) so we can reproduce and fix the bug. Events are tagged with your Supabase user ID + email so we can tell which tester hit which issue. We do not record screen pixels, form contents, passwords, or API request bodies.
• Push notification token (mobile only) — when you allow push notifications, the app registers a per-device push token with our server so we can deliver alerts (DMs, follows, post likes / comments, admin announcements). You can revoke this at any time in your phone's Notification settings; signing out also drops the token from our database.

How we use your data

• Run the app — your catches, trips, waypoints, and profile are stored so you can retrieve them.
• Show your content to the audience you chose — per-post visibility (private / followers / public) and per-group membership determine who sees what.
• AI features — Voice Log audio is passed to Deepgram for transcription, and Bait ID images are passed to Anthropic for identification. Neither vendor uses your data to train their models (both exclude API data from training by default).
• Account notices — if something material changes, we may email you. We do not send marketing emails.

Who we share data with

riggr uses a short list of infrastructure vendors. Your data only leaves riggr for one of these reasons:

• Supabase — backend database, authentication, file storage.
• Vercel — web hosting.
• Google Maps / OAuth — map tiles and Google Sign-In.
• Deepgram — Voice Log audio transcription.
• Anthropic — Voice Log field extraction, Bait ID lure identification, trip summaries, port enrichment, and other research-driven features.
• Voyage AI — embeddings for the Bait ID retrieval system (text-only; never your photos).
• PostHog — product analytics (page views, feature usage). Hosted in the United States; does not sell data; honors Do-Not-Track. We don't share your identifying info beyond your Supabase user_id and email.
• Meta (Facebook) — when we run ads, the Pixel records that someone visited the site or created an account so we can measure those ads. On signup we send a hashed email and user id for attribution. Not your fishing log. Honors Do-Not-Track.
• Sentry — crash and error diagnostics for the website and mobile app. Hosted in the United States; does not sell data. We share stack traces, breadcrumbs (recent taps / requests), device info, and your Supabase user_id + email so we can triage which user hit which crash. No screen pixels, form contents, or API request bodies.
• Expo — push notification delivery for the mobile app. When you allow notifications on your phone, we register an Expo push token (an opaque device-ID assigned by Expo). The trigger that sends pushes posts the title, body, and a small routing payload (notification kind + a few IDs to deep-link into the right screen) to Expo's push API, which forwards it to Apple APNs or Google FCM. We do not send Expo your contact list, location, photos, or other content beyond the notification text itself.
• Stripe — payment processing when you subscribe (we never see your card number).
• NOAA / NWS — bathymetry and marine forecasts. Requests include a general latitude/longitude but no identifying user data.

We do not sell your data to third parties. When a paid campaign is live we send Meta page-view and signup events so the ads can be measured — not your catches, trips, or location.

Your controls

• Visibility — every catch, trip, and post has a Private / Followers / Public toggle.
• Private account — require approval before new followers can see your posts.
• Blocks — block another angler and they can no longer see your content or interact with you.
• Delete your account — contact hello@riggr.app to request account deletion. We will remove your profile and all associated data within 30 days.
• Export your data — contact us at the same address. CSV export is a planned self-serve feature.

Data retention

We keep your data as long as your account is active. When you delete your account, we permanently remove your profile, catches, trips, waypoints, posts, photos, and group memberships within 30 days. Backups containing prior snapshots are overwritten on our normal cycle (~30 days).

Children

riggr is not directed at children under 13 and we do not knowingly collect data from them. If you believe a child has created an account, contact us and we will remove it.

Where your data lives

Data is stored on servers in the United States (Supabase and Vercel's US regions). If you use riggr from outside the US, your data is transferred to the US for processing.

Changes to this policy

If we make material changes we will update the "Last updated" date at the top and, for significant changes, email active users before the changes take effect.

Contact

Questions about this policy, data requests, or anything else: hello@riggr.app