Fish counts, catch reports, regulations, conditions and the forecasts built from them are public and need no account. Browsing those pages does not create a profile of you.

To learn which waters, reports and features anglers actually use, and where visitors come from, the site keeps its own record of the pages it serves. It uses no cookies and nothing stored in your browser. For each page it records the page and what it is about (a water, a species), the kind of device, the day and time, and — for the first page of a visit — the website or search engine that sent you there. It also records a few things you do on a page, such as sharing a link, running a search or opening the catch report form.

• If you are not signed in, each page is tied to a code worked out from your IP address and browser, scrambled with a secret that changes every day. It lets us count visitors for one day and cannot follow you from one day to the next. Your IP address itself is not stored.
• If you are signed in, pages are recorded against your account, which is how we measure whether people come back and which features help them. When you create an account, we note where the visit that led to it came from (for example “Google search”) and the page it started on.
• Who sees it: only the site's administrators, as counts and tables. It is not sold or shared, and it is not used for advertising.
• How long: page records are deleted after 30 days. Daily totals — how many visitors, visits and page views — are kept after that, with nothing in them about any one person. The source noted on an account is deleted with the account.

When you create an account, we keep:

• Your email address — how you sign in and where alerts go by default.
• A password hash, if you set a password. We store a scrypt hash, never the password itself, so we cannot read it or tell you what it is.
• Optional details you choose to add — a display name, a username, a mobile number for text alerts, and a profile picture.
• Your saved spots and alert settings, so we know what to watch and how to reach you.
• A record of alerts we sent you, so the same one is not sent twice and you can see what you have already read.
• A record that you agreed to the Terms and this policy — when, and which versions.

A profile picture you upload is resized in your browser to a small square before it is sent, and stored with our storage provider, Cloudflare R2.

Catch reports, photos, videos and comments are published on the site under your username, with your profile picture, level and points. A report shows the water, species, count, date and any tackle or place name you add. Your points and standing can appear on the public leaderboard.

• Private reports are shown to nobody but you. Their catch details may be counted in aggregated, de-identified figures, never shown individually.
• Direct messages are visible only to the people in the conversation. They are stored so the conversation can be shown. We may review a message if someone in the conversation reports it, or if our automatic check flags a photo or video in it before it's delivered.
• Photos are resized and re-encoded in your browser before upload, which removes the hidden metadata a phone adds — including the GPS location where it was taken.
• Videos are stored exactly as recorded. A video file can contain metadata your phone added, which may include where it was recorded. Turn off location tagging in your camera settings if you do not want that included.

We use the details in reports — combined with other anglers' reports and public data — to build and improve our forecasts, scores and alerts. Figures produced this way are aggregated and do not identify you or an exact spot.

Photos, videos and profile pictures are stored with Cloudflare R2. Before a report is published or a message is delivered, its photos and a few frames of any video are sent to OpenAI's moderation service, which checks them for explicit content; the text of your report is not sent. Readers can report content, and we keep a record of moderation decisions.

If you use “near me”, your browser — or in the app, your phone — asks for permission first. Your position is sent to our server only to sort waters and reports by distance for that request, and it is not stored.

If you sign in with Google or Facebook, the provider tells us your account identifier, your email address and whether it has verified it, your name, and your profile picture. We store those to create and recognise your account. A Facebook profile picture is kept as a copy on our own storage, because Facebook's links to it stop working after a few weeks; it is deleted when you remove your picture or delete your account. We never receive your password, and we cannot see anything else in that account.

In the iPhone app you can also sign in with Apple. Apple tells us an identifier for your Apple Account, an email address — your own, or a private relay address if you choose Hide My Email — and, the first time only, the name you choose to share. We store those to create and recognise your account, with a token from Apple that we use to disconnect the app from your Apple Account when you delete your account.

You can unlink a sign-in method at any time in Settings → Sign-in & security, as long as you have another way to sign in.

To see which pages are used and how quickly they load, we use the site's own page record (see Which pages are used) and Vercel Web Analytics and Speed Insights, none of which set cookies — see Vercel below. The one exception is advertising: the Meta Pixel and the Google tag set their own cookies (_fbp for Meta; _gcl_au and, after a click on one of our Google ads, _gcl_aw for Google) and read Meta's and Google's if you have them — see Advertising, including how to turn it off. We set these cookies, all first-party:

• wff_session — keeps you signed in. Set when you sign in, cleared when you sign out, and it expires a year after you last use the site.
• wff_admin — only for the site's own administrators: marks that their admin tools are unlocked. It lasts seven days and is deleted when they sign out.
• wff_oauth — a short-lived cookie that carries a single sign-in across the trip to Google or Facebook and back. It lasts ten minutes and is deleted as soon as you return.
• wff_signup — holds what Google, Facebook or Apple told us for up to ten minutes while you agree to the Terms to create a new account. Deleted when the account is created or you cancel.
• wff_apple_nonce — in the iPhone app, a one-time value that ties a Sign in with Apple to this device. It lasts ten minutes and is deleted as soon as it is used.
• wff_in and wff_plus — hold nothing but “1”: that this browser is signed in, and that the account is on Angler+, so the page can show the right version from the start. They come and go with wff_session. The page checks your account itself, so they unlock nothing.
• wff_me — for up to ten minutes after you sign in: your initial, first name or username, picture, a link to your profile, your plan and whether you have had the free trial, so the first page shows your header before the site has asked who you are.
• wff_ref and wff_inv — set when you open someone's invite link: their invite code, and the name to show on the invite. Kept for 30 days, so the invite still counts if you join and take Angler+.
• wff_via_app — marks a browser the app opened (to check out or manage Angler+), so the end of checkout can send you back to the app. It lasts an hour.
• wff_2fa — for accounts with two-factor sign-in, remembers for ten minutes that your password was right while you enter the code.
• wff_ads_ok — set only while the Meta Pixel and Google tag are allowed on your device, so our server knows it may also report a sign-up or Angler+ start to Meta (see Advertising). It holds nothing but “1”, and is removed the moment they are turned off.

wff_ads_ok, wff_in, wff_me and wff_inv can be read by scripts on the page, because the page uses them; the others cannot.

If you allow notifications in the iPhone or Android app, your phone gives us a device token, which we store with your account to send your alerts, messages and other notifications to that phone. Notifications are delivered by Apple on an iPhone and by Google on Android. Each carries the notification's text, the page it opens, the unread count shown on the app icon, and internal references the app uses to group it and mark it read. A token is deleted when you sign out of the app, when Apple or Google tell us it is no longer valid (for example after you remove the app), and with your account.

We advertise WA Fish Forecast on Facebook, Instagram and Google, and use the Meta Pixel and the Google tag — scripts from Meta and Google — to see which of our ads bring anglers here, so we spend less on the ones that don't. There are no ads on this site, and we don't sell your data.

• What it sends Meta: the pages you view here, and when you create an account, start an Angler+ trial or subscribe — along with your IP address, browser and Meta's cookies. When you create an account or start Angler+, our server also tells Meta directly, with a scrambled (hashed) copy of your email address and account number rather than the address itself, so it is counted even if your browser blocks the pixel. If you use Facebook or Instagram, Meta may connect this to your account there, which is how it measures which ad you saw. In the Android app and the iPhone app from version 1.0.1, Meta's app SDK tells Meta instead: when the app is installed and opened, when you create an account and when you start Angler+, with your device's advertising identifier where the device allows it. On Android the SDK also fetches its settings from Meta each time the app opens, even with this turned off.
• What it sends Google: the pages you view here, and when you start an Angler+ trial or subscribe — along with your IP address, browser, Google's cookies, and the click identifier Google adds to the address when you arrive from one of our Google ads. With a sign-up or an Angler+ start, the tag also sends a scrambled (hashed) copy of your email address, so Google can match it to the ad you clicked without its cookie. Our server sends Google nothing; only the tag in your browser does. In the iPhone and Android apps, Google's Firebase Analytics also tells Google when the app is installed, opened and used, when you create an account, and when you start Angler+, with your device's advertising identifier where the device allows it.
• Where: both run on the website and in the Android app. In the iPhone app, only if you tap “Allow” when the app asks to track your activity; if you don't, neither runs there. Either way, the iPhone app tells Apple once that it was opened, so Apple can let the ad network that showed an ad know an install happened (Apple's SKAdNetwork) — a count Apple keeps anonymous, with nothing about you.
• Turning it off: neither runs in a browser that sends Global Privacy Control. You can also turn both off on this device below, or, for the iPhone app, in your iPhone's Settings → Privacy & Security → Tracking. In the Android app, Meta's SDK and Google's Firebase Analytics report the app's first launch after it is installed, with your device's advertising identifier, before the setting below can be reached; turning it off stops everything after that. Reinstalling the app clears the setting, so turn it off again after a reinstall. Under some state laws, including California's, using them counts as “sharing” personal information for advertising — turning them off is how to opt out of that.
• Their side: what Meta does with it is covered by Meta's Privacy Policy, and what Google does by how Google uses information from sites that use its services.

The companies that run the site or do a job you asked for, and Meta, for measuring our own ads:

• Vercel — hosts the site, so like any host it sees your IP address when a page loads. Its Web Analytics and Speed Insights record which pages are visited, the site that referred you, how fast pages load, and your rough location, device and browser. They use no cookies, and count visitors in aggregate rather than identifying you or following you to other sites.
• Google, Facebook or Apple — only if you choose to sign in with one.
• Apple and Google — deliver notifications to the app, and take payment for Angler+ bought through the App Store or Google Play.
• RevenueCat — keeps track of Angler+ bought through the App Store or Google Play. See Payments below.
• Meta and Google — through the Meta Pixel, the Google tag and (Meta only) our server, to measure our own ads. See Advertising above, including how to turn it off.
• Neon — hosts our database, where your account and what you post are kept.
• Cloudflare — stores photos, videos and profile pictures (R2).
• OpenAI — receives report photos and video frames, without your name or the report text, to screen them for explicit content before publishing.
• Amazon Web Services (Amazon SES) — receives your email address in order to deliver the email we send you: alerts, password resets and other account email.
• SignalWire — receives your mobile number in order to deliver a text: the code that confirms it, and your alerts. Only if you turn text alerts on.
• Stripe — handles payment if you subscribe by card. See Payments below.

We do not sell your data, and there are no ads on this site. The only thing that goes to an advertising company is what the Meta Pixel, the Google tag and our server report to Meta and Google about how our own ads perform — and you can turn that off.

The map is drawn with tiles from OpenFreeMap, which — like any resource loaded by your browser — sees your IP address when the map loads. Fish, weather, tide and flow data is fetched by our servers from WDFW, NOAA, USGS and Open-Meteo; those requests come from us, not from you, and carry nothing about you.

If you turn on text alerts, your mobile number is used for those texts and nothing else: the code that confirms the number is yours, a confirmation, your alerts, and our replies if you text HELP or STOP. We record when you confirmed the number and when you replied STOP, so that a STOP is honoured. How signing up works, and an example of every text we send, are on the text alerts page.

We do not share your mobile number, or your consent to receive texts, with third parties or affiliates for marketing or promotional purposes. SignalWire, which carries the messages, receives your number only to deliver them.

Angler+ is paid for in one of two ways. On the website, by card, through Stripe. In the iPhone and Android apps, through the App Store or Google Play, as Apple and Google require — though when the App Store cannot offer it, the iPhone app opens the website's card checkout instead. Settings → Angler+ shows which one yours is.

We are not a payment processor and deliberately never receive your card details: the card number, expiry, security code and billing address are entered into Stripe's secure payment form, served by Stripe and sent to Stripe's systems. They never reach our servers, and there is nowhere in our database they could be stored.

What we do keep, so we know what you are entitled to:

• for a subscription paid by card, a Stripe customer identifier and subscription identifier — opaque references that let us ask Stripe about your subscription; for one bought through a store, which store it came from;
• the plan you are on and its status — active, past due, cancelled or trialing;
• the date your current period ends, so access continues for what you have already paid for.

Stripe receives your email address to attach to the customer record and to send receipts. Stripe is an independent controller of the payment data it holds, and its handling is governed by Stripe's privacy policy. Stripe also uses this data to detect and prevent fraud, which is why a payment can be declined for reasons we are not told.

Stripe tells us when a payment succeeds, fails or a subscription is cancelled, so your access reflects reality. We never see the card behind any of those events.

A subscription bought through the App Store or Google Play is paid to Apple or Google with the payment method on your Apple Account or Google account, which we never see. RevenueCat, which manages these subscriptions for us, receives your account ID — not your name or email address — and the store's record of the purchase, and tells us whether your subscription is active and until when. Apple, Google and RevenueCat each handle that data under their own privacy policies.

Deleting your account removes what we hold. It does not, by itself, cancel a live subscription or erase the payment companies' own records — Stripe, Apple and Google keep transaction history as long as financial regulations require, and RevenueCat keeps its record of a store purchase under an account ID that no longer leads to you. Cancel first, then delete: by card, in Settings → Angler+; through the App Store, in your iPhone's Settings → your name → Subscriptions; through Google Play, in the Play Store, under your profile → Payments & subscriptions → Subscriptions.

Your account, reports and saved spots stay until you delete them. Alert history is kept so the same alert is not repeated. Sign-in codes and password-reset links are single-use and expire within minutes. Content removed by moderation is kept out of sight for a period so decisions can be reviewed and, where the law requires, reported.

Go to Settings → Delete account and confirm. This permanently removes your account, your reports and their photos and videos, your saved spots, your alert history, your profile picture and any connected sign-in — immediately, and it cannot be undone. Aggregated figures that no longer identify you are not affected.

If you cannot sign in and want your data deleted, email us from the address on the account (or tell us your username) and we will do it for you.

Cancelling a paid subscription is separate: cancel it first — in Settings → Angler+ for one paid by card, or with Apple or Google for one bought through the App Store or Google Play (see Payments) — so you are not charged again, and then delete the account.

The same instructions, step by step, are on the deleting your data page.

This site is not intended for children under 13, and we do not knowingly collect their information. Accounts require you to be 13 or older.

WA Fish Forecast is owned and operated by WA Fish Forecast LLC, which is responsible for the information described in this policy.

If this policy changes in a way that affects you, the date at the top changes and the previous behaviour does not silently continue. Questions about your data, or a request to delete it, can be sent to hello@wafishforecast.com.