GDPR, KVKK & App Store / Google Play Compliant
Privacy Policy & Security Standards
Last Updated: October 20, 2026 • Policy Version: v2.9
Our Core Commitment: Your Secret Spots Stay Yours
We are passionate anglers ourselves. We know the priceless value of a hidden reef, sunken wreck, or productive shallow mark discovered through years of dedication. ShoreMark never stores your precise GPS coordinates in plain text on servers, never sells your spots, and never shares your private fishing grounds with third parties or other users.
1. Data Controller & Scope
This Privacy Policy applies to all recreational and sport anglers ("User", "you") utilizing the ShoreMark (also operating domestically as "Mera Pusulası") mobile applications (iOS and Android) and our official website at merapusulasi.com. This disclosure is prepared in strict accordance with the European Union General Data Protection Regulation ("GDPR") and the Turkish Personal Data Protection Law No. 6698 ("KVKK").
Data Controller Contact Email: [email protected]
2. Encrypted Coordinate Storage (AES-256-GCM)
The geographic coordinates (latitude and longitude) of catches recorded in your private Catch Log are treated under a specialized privacy tier:
- On-Device Encryption: When logging a catch, coordinates are encrypted directly on your device with a 256-bit key using AES-256-GCM (Galois/Counter Mode). The encryption key is tied to your authenticated account; any authorized device you sign in with securely retrieves the key.
- Ciphertext-Only Storage: Our database (Supabase PostgreSQL) stores coordinates strictly in ciphertext format. Plain-text coordinates are never persisted on the server. The key escrow function secures key wrapping under dedicated server-side encryption secrets.
-
Default Privacy Isolation: Your catch log is private by default (
privacyLevel = SECRET). Your exact catch locations and logs are never visible to other users.
3. EXIF GPS Metadata Stripping
Smartphone cameras embed sensitive location tags (EXIF metadata)—including latitude, longitude, altitude, and compass direction—directly into photo files.
When you attach a catch photo in ShoreMark, our built-in image processor (ImageCompressor) completely strips all EXIF GPS tags on your device before the image is uploaded. As a result, stored photo files contain zero geographic metadata.
4. Weather & Geocoding: Coarse Location Privacy
Wind, atmospheric pressure, temperature, cloud cover, and precipitation data are retrieved via Apple WeatherKit (Apple Weather). To protect your exact whereabouts, your precise GPS point is never sent to Apple; instead, the center point of a coarse 5 km × 5 km cell (Geohash5) is queried. On Android, weather requests query Apple WeatherKit through our proxy using only this coarse 5 km × 5 km cell center.
The regional name ("District, State / Country") associated with a catch is resolved on iOS via Apple’s native reverse geocoding service (CLGeocoder) and on Android via the system geocoder, querying only the coarse 5 km × 5 km cell center. For legal attributions regarding weather data, please refer to the Apple Weather Legal Attribution page.
5. Collected Data & Purpose of Processing
| Data Category | Purpose | Storage & Retention |
|---|---|---|
| Account & Identity | Authentication via Sign in with Apple or Google; single active device session enforcement. | User ID (UUID) and email address (or Apple private relay email). Retained until account deletion. |
| Catch Log Records | Species, length (cm), weight (kg), bait/rig, personal notes, and catch photos. | Coordinates stored encrypted (AES-256-GCM); photos and details accessible solely by your account. |
| Subscriptions & Purchases | ShoreMark Pro entitlement verification and quota management. | Processed by Apple App Store or Google Play; credit card details never touch our servers. Server verifies signed receipts and stores product ID, status, expiry, and transaction hash. Cross-platform access is supported with the same account. |
| Crash & Diagnostic Data | App stability and performance monitoring. | We do not employ third-party crash sdk trackers. Diagnostics are handled solely by native Apple / Google vitals according to your OS privacy settings. |
| Anonymous Usage Analytics (Opt-Out Available) | Feature usage counts to enhance usability. | Provided by Aptabase (EU-hosted, Germany), fully de-identified without persistent device or user IDs. No advertising IDs, no cookies, no tracking. Can be disabled anytime in App Settings. |
| Device Identifier (Session Control) | Single active device session verification. | Randomly generated install token sent to server; renewed upon re-installation and wiped upon account deletion. |
6. Third-Party Service Providers
ShoreMark never sells, rents, or trades your personal data or fishing spots to data brokers, advertisers, or commercial entities.
Data is exchanged strictly over encrypted TLS/HTTPS connections with essential infrastructure partners:
- Apple (iOS): Sign in with Apple, App Store StoreKit 2 (subscriptions), MapKit, and CLGeocoder.
- Google: Google Sign-In and Google Play Billing on Android.
- Supabase: Account authentication, encrypted database storage, and private photo storage hosted within the European Union (Ireland, eu-west-1).
- Apple WeatherKit: Atmospheric and marine forecasts queried solely via coarse 5 km × 5 km grid centers.
- Aptabase: Privacy-first de-identified event counting hosted in the EU (Germany). No cookies, no IDFA, no personal profile construction.
- Cloudflare: Website hosting and edge network security.
7. Your Rights Under GDPR & KVKK
Under GDPR (Chapter III, Articles 15-22) and KVKK Article 11, users hold comprehensive data rights:
- The right to access and confirm whether your personal data is processed,
- The right to rectification of inaccurate or incomplete records,
- The right to data portability and deletion of stored information,
- In-App Account Deletion: You can permanently delete your account and all associated catch logs at any time: Profile > Settings > Delete My Account. Deletion is instantaneous and permanent. You may also email [email protected] to request manual deletion.
8. Account Deletion & Subscription Disclosure
When you delete your account via the app or email request, your email address, catch logs, photos, and favorite fishing spots are immediately and permanently erased from our operational servers. Technical system backups naturally expire shortly thereafter.
Important Subscription Note: Deleting your account does not automatically cancel an active auto-renewing subscription managed by Apple or Google. Subscriptions must be cancelled directly via your Apple ID (Settings > Subscriptions) or Google Play Account (Payments & Subscriptions).
If you have an active subscription, our deletion flow explicitly presents this notice and requires affirmative confirmation. To establish legal compliance and audit verification (legitimate interest defense against payment disputes), a minimal consent record is stored separately from user data: timestamp, platform, subscription status, notice version, confirmation status, and a one-way irreversible hash of the user ID. This audit record contains no email, catch logs, or location data and is purged after 2 years.
9. Contact & Privacy Officer
For any questions regarding our encryption architecture, privacy practices, or to exercise your statutory rights, please contact our Data Protection Officer:
All statutory privacy requests are processed free of charge within 30 days.