Skip to content
Fish in Germany

Privacy policy

This is an English translation. The German version is the binding one.

1. Controller

Andre Mendes dos Santos
E-mail: mendes068de@gmail.com

2. Overview

Fish in Germany is an information site without user accounts, comments or a contact form. We process personal data only as far as needed to deliver the website and run it securely, and for cookie-free audience measurement (section 6).

3. Hosting

The website is hosted by Fly.io, Inc., 2261 Market Street #4990, San Francisco, CA 94114, USA. The application and its database run in a data centre in Frankfurt am Main. Fly.io acts as our processor (Art. 28 GDPR) and handles the connection data needed to deliver the pages, in particular your IP address. A data processing agreement with Fly.io is in place.

Fly.io is a company based in the USA. According to Fly.io, it is certified under the EU-U.S. Data Privacy Framework, so transfers to the USA rely on the European Commission's adequacy decision (Art. 45 GDPR). The legal basis is our legitimate interest in providing the website reliably and securely (Art. 6 (1) (f) GDPR).

4. Server logs

For every page request the application writes a log entry with the date and time, the requested address (including search terms and filters in the URL), the result of the request and a truncated IP address: for IPv4 the last byte is removed, for IPv6 only the first 48 bits are kept. The full IP address is not logged. Browser identifiers (user agent) are not logged.

To rate-limit requests to the interface under /api/, the IP address is also counted briefly (at most 60 seconds) in the server's memory and not stored.

The logs are used for debugging and to prevent abuse (Art. 6 (1) (f) GDPR). How long they are kept depends on Fly.io's logging infrastructure.

5. Cookies

The website sets no advertising or tracking cookies. These are the only ones:

  • lang – stores the chosen language (German or English). Only set when you switch the language; expires after one year.
  • theme – stores the chosen colour scheme (light, dark or system). Only set when you change it; expires after one year.
  • fishing_state and fishing_spots – store the federal state and up to three fishing spots (gauges or waters) chosen on the "Fishing today" page. Only set when you save your choice, and removed with "Forget my choice"; expire after one year.
  • _app_session – a session cookie that ends when you close the browser. It holds a random security value (the Content Security Policy nonce) that lets the browser tell the website's own scripts apart from injected ones. It contains nothing that recognises you on a later visit.
  • analytics_opt_out – only set if you object to the audience measurement (section 6); expires after one year.

These cookies are strictly necessary to provide the setting you asked for or to display the pages securely (§ 25 (2) no. 2 TDDDG); the related processing is based on Art. 6 (1) (f) GDPR.

6. Audience measurement with Umami

To understand which pages are used, we use Umami Cloud by Umami Software, Inc., 28 Geary St, Suite 650 #243, San Francisco, California, USA. Measurement runs on the server: your browser loads no script from Umami, no cookies are set, and nothing is stored on or read from your device. For every page view our server sends to gateway.umami.is: the page address (including search terms and filters in the URL), the page title, the referring page if you came from another website, your browser's preferred language, your IP address and the browser identifier (user agent), as they are sent to our server with every request anyway.

From this Umami derives the browser, operating system, device type and approximate location (country, region, city). Visits are grouped by an anonymous identifier calculated from the website ID, IP address, browser identifier and a value that changes every month; the IP address is processed for this but not stored in the analytics data. Umami and its providers may record IP addresses in operational and security logs.

We chose the EU data region for the analytics data. Even so, Umami uses service providers in the USA (for example for delivery and security). These transfers are covered by the EU Standard Contractual Clauses, which are part of Umami's data processing agreement. Analytics data is kept for six months.

The legal basis is our legitimate interest in privacy-friendly audience measurement to improve the content (Art. 6 (1) (f) GDPR). If your browser sends "Do Not Track" or "Global Privacy Control", nothing is sent. You can also object to the measurement at any time; your objection is stored in the cookie analytics_opt_out and applies for a year or until you lift it here:

Audience measurement is active in this browser.

7. Contact by e-mail

If you e-mail us, we process your address and message to answer your request (Art. 6 (1) (f) GDPR) and delete them once they are no longer needed.

8. No other services

Images, maps and scripts are served from our own server; no external fonts are loaded and no third-party content is embedded. No social media plugins are used. Links to external websites (such as the state law portals) only send data to that provider when you click them.

Water levels and weather on the "Fishing today" page are fetched by our server: from PEGELONLINE (Federal Waterways and Shipping Administration) and from Bright Sky, which serves data of the Deutscher Wetterdienst. Only the gauge's identifier or the spot's coordinates are sent, no data about you; your browser does not connect to these services.

9. Your rights

You have the right to

  • access the personal data we process about you (Art. 15 GDPR),
  • have incorrect data corrected (Art. 16 GDPR),
  • erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
  • data portability (Art. 20 GDPR), and
  • object, on grounds relating to your particular situation, to processing based on Art. 6 (1) (f) GDPR (Art. 21 GDPR).

To do so, write to the e-mail address above. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

Last updated: October 2026