Baitfish Privacy Policy

Effective date: 23 September 2026

Last updated: 23 September 2026

This policy explains what data the mobile game Baitfish (the "Game") processes, why, and what you can do about it. By installing or using the Game you agree to this policy.

1. Who processes your data

The data controller is:

For any question about this policy or your data, write to [email protected]. We reply within 30 days.

2. In short

We do not collect: your name, email address, phone number, date of birth, photos, contacts, messages, microphone recordings, device location (GPS), browsing history, health data, or any other personal information about you as an individual.

The Game has no access to the camera, microphone, files, contacts or location. The permissions it needs are internet access and, in builds with advertising, access to the advertising identifier (AD_ID on Android). The full list is always visible in the Permissions section of the store listing.

We do collect only what is needed to carry your progress between installs and to keep the server running: a pseudonymous installation identifier and the save file itself. Advertising is separate from this — it needs the device advertising identifier, and it is described in section 3.4. Details below.

The Game is fully playable offline. Cloud saving is switched off in the Game (House → the "CLOUD" button), after which nothing is sent to our servers. That does not switch off advertising: it goes to Google's servers, not ours.

3. What data is processed

3.1. Cloud save (on by default, can be switched off in the Game)

So that your progress survives a reinstall, a copy of your save is sent to our server.

What is sent:

• Installation identifier — an irreversible cryptographic hash (SHA-256) of the system device identifier combined with a fixed salt string, producing a 64-character hexadecimal string. It cannot be reversed into the original device identifier, and it does not reveal your device model, your name or any other way to identify you. It exists for exactly one purpose: to hand your own save back to you on the next launch.
• The save file — numbers and lists describing the state of play: in-game coins, purchased tackle and its wear, caught fish, achievements, completed orders, in-game time and day, assembled rods, and the chosen fishing spot inside the fictional game island.

What the save does not contain: your real-world coordinates. The game world is an invented island, and the "home coordinates" in the save are a point inside that fictional world. The Game has never requested and does not request access to device location.

Legal basis: performance of a contract with you (providing the cloud-save feature), Art. 6(1)(b) GDPR.

3.2. Server technical logs

Like any internet server, ours records request metadata: IP address, date and time, requested path, response code, application version. This is needed to prevent abuse and to diagnose failures.

In some jurisdictions an IP address is personal data. We do not link it to your save file and do not use it for profiling.

Retention: 30 days, then automatically deleted.

Legal basis: legitimate interest (security and availability of the service), Art. 6(1)(f) GDPR.

3.3. In-app purchases

Not every version of the Game contains purchases — like advertising, they arrive with an announcement in the release notes.

All payments are processed by the app stores: Google Play (Google LLC) or the App Store (Apple Inc.). We never receive or store your card number, cardholder name, bank details or billing address. The store tells the app only that a purchase succeeded and its identifier, so the app can grant the item. Payment data processing is governed by Google's and Apple's policies.

3.4. Advertising

Not every version of the Game contains advertising. Until the version whose release notes announce "advertising added", nothing described in this section is collected and the advertising identifier is not read. This is easy to verify: the Data Safety section on Google Play and App Privacy on the App Store always describe the published version.

The Game shows Google AdMob advertising (Google Ireland Limited / Google LLC): a banner at the bottom of the screen and opt-in rewarded videos that start only when you tap to start them. Ads cannot be triggered by accident and never interrupt fishing.

The ad network may process: the device advertising identifier (Google Advertising ID / Apple IDFA), IP address, approximate location derived from the IP address (city or region level — the Game has no access to GPS), device and operating-system information, and impression, click and post-click data.

Advertising is personalised. Ads are selected not only by the content of the Game but also by your interests, which the ad network infers from your activity in other apps and on websites. This processing constitutes tracking and profiling.

We ask for permission, and without it there is no personalisation:

• if you are in the European Economic Area, the United Kingdom or Switzerland, the Game shows a consent dialog on first launch (Google User Messaging Platform). Refusing does not disable advertising and does not restrict the Game — ads are simply selected by the content of the Game rather than by your interests;
• on Apple devices the Game additionally presents the App Tracking Transparency prompt. Without that permission the advertising identifier is unavailable and advertising stays non-personalised.

You can change your mind at any time: House → "AD SETTINGS" reopens the same consent dialog. The Apple permission is changed in device settings: Privacy & Security → Tracking.

Legal basis — your consent, Art. 6(1)(a) GDPR. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Google's advertising policy: https://policies.google.com/technologies/ads Google advertising partners: https://business.safety.google/adspartners

3.5. Crash reports

Crash reporting arrives together with advertising and purchases. It is Firebase Crashlytics (Google): on a crash it sends the device model, OS version, game version, memory state and the call stack — the place in the code where the game broke. Crash reports contain no personal data.

4. Who we share data with

We do not sell data and do not share it for anyone else's benefit. Data reaches only those parties without whom the service cannot work:

We also disclose data where required by law or by a valid request from a public authority of the relevant jurisdiction.

International transfers. The server is located in Казахстан. If you are in the European Economic Area, transfers outside it rely on the European Commission's Standard Contractual Clauses or on the performance of your contract, Art. 49(1)(b) GDPR.

5. How long data is kept

• Cloud save — while you use the Game, plus 24 months after the last access, then deleted automatically.
• Server logs — 30 days.
• Data you delete yourself (see section 6) — immediately, with no backup copy.

6. How to delete your data

In the Game: House → "DELETE CLOUD SAVE" (tap twice — the second tap confirms). The button erases the save on the server immediately and irreversibly. Progress on the device itself remains; it is removed only by uninstalling the Game.

By email: write to [email protected] with the subject "data deletion". To locate your record, include the installation identifier shown in the Game in the House card, under the cloud status line. Without it we cannot tell which data is yours — we hold no other information about you.

Dedicated data deletion page: https://baitfishgame.com/delete

7. Your rights

If the GDPR (EEA, United Kingdom), the Law of the Republic of Kazakhstan "On Personal Data and its Protection", the CCPA (California) or a comparable law applies to you, you have the right to:

• obtain a copy of your data;
• correct inaccurate data;
• have your data erased ("right to be forgotten") — see section 6;
• restrict or object to processing;
• receive your data in a portable format (our saves are plain JSON; we will send the file on request);
• withdraw consent where processing is based on consent;
• lodge a complaint with your national supervisory authority.

On the CCPA/CPRA specifically. We do not sell personal information for money. However, serving personalised advertising is treated by California law as "sharing" for cross-context behavioural advertising. You can opt out — "Do Not Sell or Share My Personal Information" — inside the Game: House → "AD SETTINGS" → decline personalisation. Advertising then continues, but is selected by the content of the Game.

To exercise any right, an email to [email protected] is enough.

8. Children

The Game is not directed to children under 13. That is how it is declared in the app stores: the target audience is teenagers aged 13+ and adults. We never ask for age, name or anything that could identify a child.

This is precisely why personalised advertising is possible in the Game: the Google Play Families Policy and the Children's Online Privacy Protection Act (COPPA) rules that forbid personalisation and the collection of an advertising identifier for a child audience apply to apps directed to children, which this is not.

If you are a parent and believe your child has provided us with data, write to [email protected] and we will delete it.

9. Security

Communication with the server uses HTTPS (TLS). Saves are stored in a database on an access-restricted server. We store no passwords — the Game has none.

No transmission over the internet can be guaranteed secure; we take reasonable measures but cannot promise absolute protection.

10. Changes to this policy

If the policy changes materially we will update the date at the top and show a notice in the Game on the first launch of the new version. Earlier revisions are available on request.

11. Contact

Polina Los Казахстан, г. Алматы, ул. Абая [email protected]