Hookset Privacy Policy

Hookset is a private fishing journal for your gear, setups, trips, catches and trophies. It is published by KAL Foundry, LLC ("KAL Foundry", "we", "us"). This policy explains what Hookset collects, where it goes and the choices you have.

1. Information stored on your device

Everything you enter is saved in a database on your phone: gear, setups, tackle boxes, trips, catches (species, measurements, notes, time, location, weather), photos, trophies, cards, records, achievements, settings and drafts. Hookset keeps working without a connection and syncs later. If a change to a record is made in two places, the last edit is the one kept.

When you sign out. Your journal leaves the app and the database on your phone. Anything that has not reached your account yet (changes waiting to upload, changes our server did not accept, drafts, photos that are not backed up) and your license copies are kept on this phone for your next sign-in to the same account, unless you choose “Remove them” when you sign out. The records are encrypted with a key kept in your phone's secure keychain for that account alone; the photos are moved into the app's private storage, which your phone encrypts. Nothing on the phone names the account, and another account signing in on the phone cannot see or open them. When you sign in to the same account here again, they return and sync. You can remove what is kept for signed-out accounts in Settings › Your data; deleting your account, resetting the app's data or removing the app removes it too. Other photos of the account are deleted from the phone when you sign out.

2. Your account and sync

When Hookset can reach our servers, it starts a guest account for you with no name or email, so your journal can be backed up and used by AI features. You can later link that account to an email address (we send a sign-in link), Sign in with Apple or Google sign-in. If you link one of these, we receive your email address and the name your provider shares.

Your journal records sync to that account, which is hosted by Supabase in the United States (AWS us-east-1, Northern Virginia). This includes catches with their exact locations, saved spots, trips, gear, setups, notes, achievements, settings, and a small device record (platform, app version and an install ID). Each record can be read only by your account. Secure server rules enforce this.

3. Location

• Hookset uses your location only while the app is open, and only when you ask it to (for example, "Use current location" or forecasts). It never tracks you in the background.
• For each catch you choose Exact location, General area (only a coarse label such as a county is kept) or No location.
• Exact coordinates are stored with your catch and synced to your account so they appear on your personal map. Only you can see them.
• Exact coordinates are never put in shared images, public community features, analytics, crash reports or server logs.
• To turn a pin into a general area label, Hookset uses your phone's built-in place-name lookup (Apple on iPhone, Google on Android). That service receives the coordinates.

4. Photos

• Before any photo leaves your phone, Hookset re-encodes it and removes its metadata, including camera GPS. People and other details in the picture remain.
• Free plan: your photos, cutouts, trophies and gear photos stay on your phone. They are not backed up. They upload only when you use an AI photo feature (section 5).
• Hookset Pro photo backup: the cleaned copy of each photo (never the original), plus cutouts, masks, trophy images and gear photos, is stored in private storage in your account. It is restored if you reinstall or move to a new phone. Restored photos, downloaded artwork, Species Guide images and map tiles you viewed share up to 1 GB on your phone; past that the oldest are removed and downloaded again when you open them. Originals, photos that are not backed up and saved offline map areas are never removed this way.
• Profile mounts (any plan): a trophy mount you choose to show on your public angler profile is uploaded as a smaller cleaned copy to separate storage that other signed-in anglers can view while it is shown (section 8).

5. AI features

AI photo processing is optional and off by default. You can turn it on or off in Settings at any time. Manual logging and manual cutouts always work without it.

On your iPhone

On supported iPhones, background removal and fish cutouts run on the device using Apple's built-in Vision features, and on iPhones with Apple Intelligence, species, gear and tackle identification can run on the device too. This processing sends nothing to us or to Apple.

On our servers

When you are offline, nothing is sent later on its own: Hookset tells you to try again when you are online, and a request waiting on your phone is cancelled rather than sent (and charged) when the connection returns.

Other AI features go through our Supabase server functions, which forward the request to the service below. We do not send your exact location. Your account ID is never shared with these AI providers.

• Species identification, size and weight estimates, and gear, tackle and bait identification (Hookset Pro). We send the cleaned photo, plus optional context such as a general region label, water type and measured length, to OpenAI.
• Custom mount and card artwork. We send the cleaned photo to OpenAI. The resulting image is stored privately in your account.
• Background removal and automatic cutouts, when they are not done on your device. We send the cleaned photo to Hookset's cutout service (backgClear, operated by KAL Foundry and hosted on Render). It processes the photo and returns the cutout without keeping a copy. The resulting cutout is stored privately in your account.
• Tackle advice. We send your question, your setups (up to eight) with the temporary swaps you select, your rods and reels (up to twenty), tackle names, categories, colors, counts and fishing specifications, per-item catch counts, your target species if you chose one, the month, your home region label, the fishing details you add, the extra context you type in "Anything else?", a short weather summary and the earlier questions and answers of the same conversation (up to six) to OpenAI. We never send photos, prices, serial numbers, gear notes or coordinates for this.
• Stats advice (Weekender and Pro Angler). We send your question, the earlier questions and answers of the same conversation (up to six) and a summary of your statistics for the range you are viewing: totals, species names with counts and typical sizes, and counts by month, hour, season, weather, pressure, wind, moon, lure, setup, technique, depth and release choice. Water bodies are replaced by codes (W1, W2…) whose names stay on your phone. With Pro Angler we also add the anonymous totals of your home region (section 5a). We never send exact locations, spot or water names, notes, photos or the date and time of any single catch. Charts in an answer are drawn on your phone from your own statistics.

Advisor conversations are kept on your phone so you can come back to them; they are not synced and are removed when you start a new conversation or delete the app, and leave the app with your journal when you sign out (section 1). Questions that are not about fishing may be declined, and a few of those a day are free.

Reporting AI artwork. If a mount or card artwork is wrong, you can report it from the trophy. We keep the report (the reason, your note, which artwork it is and its style) and, if you leave it included, a copy of the catch photo re-encoded without location or camera details, in a private storage area only Hookset's operators can review. Reports and their photos are kept until your account is deleted. A refund for a report is applied to your Hook Points or allowance.

We keep a private record of each AI request (task, status, result and a fingerprint used to avoid repeat charges) so usage limits can be applied. For safety and to run the service we also keep an operations log of each AI request: the question or notes you typed, a digest (not a copy) of any photo you sent, the options you chose, the outcome and any error. Before an AI request runs, the text and the photo are checked with OpenAI's content moderation and a request that is flagged is refused without charge and noted in that log. The log is readable only by Hookset's operators, never shown to other anglers, kept for as long as your account exists and deleted with it. OpenAI processes requests under its API terms: data sent through the API is not used to train OpenAI's models, and OpenAI may keep it for up to 30 days to monitor for abuse before deleting it. For the tackle and stats advisors we also ask OpenAI not to store the conversation.

5a. Regional statistics (Pro Angler)

Pro Angler shows how anglers who call the same region home fish: shares of species, hours, months, water types and lure types, and typical sizes. These are computed on our server from the catches of anglers with that home region over the last 12 months. Every figure needs at least five different anglers, totals are rounded down, and only shares and medians leave the server: never an angler's name, account, location, spot, water body, notes or photos. Your catches count toward your home region's totals unless you turn off "Contribute to regional statistics" in Settings. With no home region set, your catches are not counted.

6. Weather, forecasts and maps

• Weather for a catch and fishing forecasts come from Open-Meteo. Hookset sends it a location rounded to about 1 km, never your exact point.
• Map tiles come from OpenStreetMap's tile servers. Like any website, the tile server sees your IP address and which map area you are viewing. Downloaded map tiles stay on your phone.

7. Barcode scanning

Before your first scan, Hookset explains what is sent. When you scan a tackle barcode, your phone sends the barcode number directly to UPCitemdb, which sees your IP address. The barcode and the product listing are then sent to our server, which uses OpenAI to read the listing. We keep a shared product cache by barcode only (product details and one retailer product image). It contains no user information. Products you confirm are remembered on your phone.

8. Local Waters, angler profiles, friends and Jams (optional community features)

Nothing in your journal is public by default. Local Waters lets you browse anglers' public fish marks in an area and, if you choose, take part. An angler profile, friends, monthly Jams and private Jams are separate choices, also off by default. Each of these requires a linked account.

• Joining a community shares the username you choose and your journal level. It does not share your location, email or account details.
• Trophy shelf shares only the species you pick, using Hookset's built-in fish illustrations. Your photos, captions, dates and place names are not shared.
• Publishing a fish mark shows the species and an approximate point you choose (rounded to about 1 km) in a named community. Your username, the month and measurements are each off by default. You preview exactly what will be shown before publishing. Your notes, gear, photos, exact location and fishing time are never included.
• You can remove your marks or reset your participation at any time. Other people may already have seen or copied public information, and removal cannot undo that.
• Angler profile: if you turn your profile on, signed-in Hookset users can find it only by typing your exact username, and always see that username, your Jam podium places and your number of friends. You choose who sees each of the rest: your avatar, your journal level, your badges, the trophy mounts and the catch cards you choose to show, and your saved spots. Each can be shown to everyone, to your friends only, or to nobody but you. By default your avatar, level, badges and mounts are shown to everyone, your cards to friends and your spots to nobody. A shown mount or card is a smaller cleaned copy of the image (re-encoded, without photo metadata or GPS) that keeps only the species, measurements and date if it displays them; its location, gear and caption are removed. A shared spot shows its name and water body at a position rounded to about 1 km, never its exact point or your notes. Your catches, other photos, gear and notes are not shown.
• Friends: anglers with a profile can send you a friend request; you become friends only when you accept. We keep who asked whom, when, and whether it was accepted, until either of you removes the friendship, blocks the other or deletes the account. Friends see what you share with friends, and a list of friends' recent mounts, cards, badges and podiums they may see. Every angler also sees Logan.io, a demo angler built into the app and labelled as a demo: it is not a real person and has no account, so nothing about you is shared with it.
• Hookset Pro marker: a public profile and your appearances in Local Waters and Jams show a Pro marker while an active Hookset Pro subscription is confirmed by the app store.
• Monthly Jams: if you turn on Jams, your longest and your heaviest eligible catch of each species in each fishing region every month are ranked on a length board and a weight board. A catch is eligible only once you add two photos of it: one showing its length, one showing its weight. Those evidence photos are re-encoded without photo metadata or GPS and stored in a private area that only you and Hookset's operators can open; operators use them to review entries and may remove an entry whose photos do not support it. They are kept until your account is deleted. A board shows your username, the level and avatar you share with everyone, the fish's length or weight, your rank and, if you made one, the trophy mount of that catch (the cleaned copy described above, shown with the board whatever audience you chose for mounts). To decide the region, our server reads the catch's exact location from your account; the location itself is never shown, and boards do not include the catch's date, time, evidence photos or notes. The top five of each board receive a podium badge shown on your profile.
• Private Jams: you can start a Jam among friends with your own dates, ranking, species and photo rules, and invite friends; they join only if they accept. Its members see each other's username, the level and avatar shared with them, and each member's best qualifying fish (species and length, weight or count) between the Jam's dates. Nothing in a private Jam is public. The creator can change the rules or delete the Jam; members can leave at any time.
• You can hide a mount, turn Jams off or make your profile private at any time. Hidden mounts stop being visible straight away and their public copies are deleted. Turning Jams off removes your entries from months whose results are not final yet; final results and badges stay.
• You can hide marks, block members and report profiles and mounts. Jam entries are not reported by other anglers; Hookset reviews their evidence photos. Blocking also ends any friendship or request between you and hides your identities from each other on boards. We review reports and Jam evidence to moderate community content only; we do not review your private journal. Reports and anti-abuse rate records are kept until the account that made them is deleted.

9. Sharing

When you share a trophy, card or catch, Hookset creates a fresh image that contains only the fields shown in its preview. It never includes coordinates, private spot names, internal IDs, private notes or photo metadata. The general area label is off by default. Once you send it, the recipient and the app you share to control their copy.

10. Subscriptions

Hookset Pro is sold through the Apple App Store or Google Play. They process payment, and we never see your card details. RevenueCat manages subscription status. It receives your Hookset account ID and purchase details from the store. Our server stores a record of your subscription status from RevenueCat to unlock Pro features.

11. Contacting us from the app

If you use Contact developers, we store your category, your message and, if you add them, a reply email and product correction details (barcode, product name and reason). This is linked to your account. Diagnostics are optional and off by default. If you include them, they are only the app version, build number and platform. You can delete this information by deleting your account.

12. Fishing license wallet

License photos, cards and PDFs you add are encrypted and stored only on your phone. They are never uploaded, synced, included in Pro photo backup or data exports, and excluded from device backups. When you sign out they stay on your phone, still encrypted for your account, for your next sign-in here, unless you choose “Remove them” (section 1). They are removed when you reset the app, remove what is kept for signed-out accounts or delete your account, and they cannot be recovered after a reinstall.

13. Analytics and crash reporting

Hookset uses Google Firebase for two things:

• Crash reports (Firebase Crashlytics), so we can find and fix crashes. A report contains the error, the app version, your phone model and operating system version, and an identifier for the installation. It never contains your journal, photos, locations, notes or email address.
• Usage statistics (Firebase Analytics), only while the "usage statistics" setting is on. You can turn it off during onboarding or at any time in Settings. These events are coarse: which features are used, whether a save had a photo, which paywall was shown, a bucketed duration, and a random session identifier that changes every time the app starts. They never include locations, region labels, spot names, notes, photos, serial numbers, prompts or email addresses; the app checks every event against that list before sending it.

Google processes this data under its own terms. If you have agreed in your phone's settings to share diagnostics with app developers, Apple or Google may also give us crash information under their own terms.

14. Who receives data

We do not sell or rent your personal information, and we do not share it for advertising. We may disclose information if required by law or to protect people's safety, and we will tell you when allowed.

15. How long we keep data

• Account and journal data are kept until you delete them or your account. When you delete a single record, it is marked deleted in your account on the next sync so your other devices remove it too. It is removed permanently when you delete your account.
• Data on your phone stays until you delete it, reset the app or remove the app. Work kept for a signed-out account (section 1) stays until that account signs in here again, you remove it in Settings or you remove the app.
• Encrypted server backups that may contain deleted data expire within 30 days.
• Jam evidence photos are kept until your account is deleted; friendships and private Jams until you or the other angler remove them, or an account is deleted.
• Feedback messages, AI request records, AI artwork reports with their photos, community reports and rate records are kept until your account is deleted.
• Server logs (error codes and request metadata, never photos or prompts) are kept for up to 90 days.

16. Your choices and rights

• Export: Settings → Your data → Export my data creates a ZIP of your journal and photos.
• Delete: remove individual records at any time, or delete your whole account. See Delete your Hookset account.
• AI: turn AI photo processing off in Settings.
• Regional statistics: turn off "Contribute to regional statistics" in Settings.
• Location: choose "No location" per catch or deny location permission in your phone's settings.
• Community content: remove your marks, leave a community, choose who sees each part of your profile, hide mounts and cards, remove friends, leave private Jams, turn off Jams or make your profile private at any time.

Depending on where you live, you may have rights to access, correct, delete or port your data, or to object to some processing. If you live in California or another U.S. state with a privacy law, you have the right to know what personal information we hold, to correct or delete it, and to opt out of its sale or sharing; we do not sell or share personal information for advertising, and we will never treat you differently for exercising these rights. If you live in the European Economic Area, the United Kingdom or Switzerland, you have the rights to access, rectify, erase, restrict and port your data, to object to processing, and to complain to your data protection authority; our legal bases are performing our agreement with you, your consent where we ask for it, and our legitimate interest in keeping Hookset secure and working. To make a request, contact team@kalfoundry.com. We will respond within 30 days.

17. Security

Data travels over encrypted connections. Each account's records and files are locked to that account by server rules. Sign-in details are kept in your phone's secure storage. License documents are encrypted on your phone. No system is perfectly secure, so please keep your phone protected.

18. Children

Hookset is not directed to children under 13. We do not knowingly collect personal information from them. If you believe a child has given us information, contact team@kalfoundry.com and we will delete it.

19. Changes to this policy

If we change this policy, we will update the effective date. If the change is significant, we will also tell you in the app before it applies.

20. Contact

KAL Foundry, LLC
team@kalfoundry.com
www.kalfoundry.com