Privacy

What we hold, and who can see it

Last updated 6 November 2026.

This wording has not yet been reviewed. It is a working draft. Everything it describes about how the app behaves is true today and is written to be checkable; if you find something here that does not match what the app does, that is a bug in one of the two and we want to hear about it.

Catch Log - the app, this website and the dashboard - is owned and operated by Isoline Limited, a company registered in New Zealand (company number 9458052, NZBN 9429053949592). Isoline Limited collects and holds the information this page describes and is responsible for it under the Privacy Act 2020, and "we", "us" and "our" on this page mean Isoline Limited.

Why this page is worded the way it is

A mark can take twenty years to find and costs a season if it gets out. That is the thing at stake, so vague reassurance is not much use. What follows is meant to be specific enough that you can check it - including a section at the end on what we have not done, because a privacy page that only lists strengths is not one you should believe.

The closure map needs no account

Checking whether a spot is closed works without signing up, on the website and in the app. We were not going to put a registration wall in front of the one thing that keeps somebody out of a marine reserve.

When you use it that way, the app sends us a position and the activities you have ticked so the server can work out an answer. That position is not attached to a name, not attached to an account, and not written into our logs - the request carries it in the body rather than in the web address precisely so it stays out of the server's access log. It is used to answer the question and then it is gone.

What we collect once you have an account

• Your email address. It is how you sign in and how we would contact you. Nothing else about you is asked for - no name, no vessel, no permit number, no fishing company.
• The marks, catches and areas you record. Position, date, species, size, quantity, your own notes and ratings. This is the sensitive part, and the rest of this page is mostly about it.
• Photos, if you take them. One per visit to a mark, uploaded only on wifi.
• Ordinary technical records. Your device's ID for the records it created, so a mark made offline is not duplicated when it syncs. Web server logs holding IP addresses, dates and which pages were requested, which is what any web server keeps and what the sign-in rate limits are built on.

Where it is kept

On one server we rent, in Sydney, Australia. We would rather it were in New Zealand and it may move here later; saying "Sydney" now is better than letting you assume. Australia has privacy law comparable to New Zealand's, and the New Zealand Privacy Act 2020 continues to apply to us wherever the machine sits.

Everything between your phone and that server is encrypted in transit. How it is kept safe, below, covers what stands between someone and the machine itself.

Who can see it

Other fishers: no. There is no sharing feature, no crew accounts, no following, no leaderboard. Every request the server answers about records is filtered to the account that is asking, in the same query that fetches the data - so asking for somebody else's mark by its number returns the same "not found" you would get for a mark that never existed.

MPI, quota owners, iwi, councils, researchers: no. Nobody has a feed, an export or a login that shows them your records. If a public agency ever made a lawful demand for data we would have to comply with the law like anyone else, and we would tell you unless we were legally prevented from doing so. Nothing like that has happened.

Us: only when you ask us to. There is no internal dashboard of customers' fishing grounds. Someone with administrative access to the server could in principle read the database - that is true of every hosted service that is honest about it - and what stands behind that is that the access is limited to the operator, it is not part of any routine, and there is no tooling built to make it easy. The one thing we do look at routinely is the questions people type into Ask, described below, which are kept apart from accounts and records.

Other companies: no. There is no analytics service, no crash reporting, no advertising SDK, no third-party tracker anywhere in the app or on this site. An earlier version fetched weather from an outside service, which meant sending a fishing position to a third party; it was removed for that reason. The sea charts come from LINZ through our own server, so LINZ sees our server asking for map tiles and never your device.

The one exception is Ask, and only if you use it. Ask is the question box on the map and on the dashboard. When you ask it something, our server sends your question, your last few questions and answers, and the app's own help text to Google's Gemini service, which writes the answer. That is all it sends: your position, marks, catches, areas and email address are never part of it, and the app adds your position itself, on the phone, only when you tap a button under an answer. We use Google's paid Gemini service, whose terms say what is sent is not used to train Google's models. If you never use Ask, nothing goes to Google.

We keep the questions you ask, not linked to you. Each question and the answer it got is kept on our server for 180 days so we can see where the app is hard to use, what people want that it does not do, and where this help falls short - then it is deleted by the same daily job that clears deleted records. A kept question carries which screen it came from (phone, dashboard or front page) and which plan the account is on, and nothing else about who asked: no account, email address, IP address or device. Anything in it that looks like a position, a phone number or an email address is removed before it is saved; a place name is not. Only the operator reads them, and they may send a batch of them back to Gemini to be summarised - the same words Gemini has already seen, with nothing added. With each question we also keep whether you said the answer helped, which button under it you tapped, which suggested question you picked, and - on the phone - what you asked when there was no signal, which the phone sends once it has signal again. With only a handful of people using Ask, the operator could sometimes guess who asked something, so please type nothing in a question you would not want read. The chat itself lives on your phone until the app closes. When you first open Ask it tells you all this and waits for you to agree.

The question bar on the front page works the same way, without an account. If you type a question into it, our server sends that question and your last few questions and answers from that visit to Google's Gemini service, along with a text about Catch Log that we wrote, so it can explain what the app is. Please do not put personal details in it. To stop one connection from running up the bill, we count questions per IP address for an hour in a short-lived counter; the question itself is not stored with the question. The question is kept as described above, for 180 days, and the questions on that bar are not linked to anyone.

How it is kept safe

The section above is about who is allowed to see your marks. This one is about the other question, which is the one people usually mean: what stops somebody taking them anyway.

Almost nothing that goes wrong in practice is a clever attack. It is a weak password, a login page that lets somebody guess ten thousand times, a database left open to the internet, or an account that can quietly ask for someone else's records and get them. So rather than say "we take security seriously", here is each of those doors and what is on it.

Getting in as you

• Your password is never stored anywhere in a form we or anyone else could read back. What is kept is a one-way scramble of it, using the standard mechanism that ships with the framework this runs on. If somebody took the whole database tomorrow, the passwords in it would still not be passwords.
• Short, obvious and commonly-used passwords are refused when you set one.
• Guessing is rate limited per connection, and repeated failures lock that connection out for increasing lengths of time. Somebody working through a list does not get thousands of attempts, they get a handful.
• The lock is checked before the password is, so a locked-out attacker cannot use the difference in responses to work out when they have guessed right.

Staying signed in

• Your phone holds a short-lived pass that expires every fifteen minutes and is renewed in the background. A copy taken off a device is worth very little for very long.
• The longer-lived renewal key is itself stored scrambled on our side, and it changes every time it is used. If one is ever used twice, that is a sign it was copied, and every session on that account is cancelled immediately rather than the suspicious one being allowed to continue.
• On the phone, all of that lives in the device's own secure store, the same place your banking app keeps its credentials, rather than in ordinary app storage.
• Deleting your account cancels every signed-in device at once, before the thirty day clock even starts.

Getting at everybody's at once

• The database is not on the internet. It has no public address and nothing outside the server can open a connection to it. The only thing exposed is the web server in front of it.
• Everything is served over HTTPS, and browsers are told to refuse the unencrypted version of the site from then on.
• Photos are held in private storage with no public web address, so there is no guessable link to anybody's pictures.

The one that matters most

Even with a completely valid login, there is no way to ask this system for somebody else's records. That is worth being precise about, because it is the difference between a lock and a sign saying please do not enter.

It is not that we look up the record and then check whether you are allowed it, which is the arrangement that fails the day one check gets forgotten. It is that your account is part of the question itself: every request for a mark, a catch or an area asks for your ones, and asking for a mark belonging to another diver comes back the same as asking for a mark that never existed. There is nowhere in the system to phrase the other question.

Not keeping what we do not need

• Fishing positions are not written into our server logs at all. Asking whether a spot is closed sends the position in a way that logs do not record, specifically so that tapping the map does not slowly build a record of where you fish.
• Photos have their GPS metadata stripped on the way in, so the position is not hiding inside the file.
• Nothing is sent to any other company, so there is no second organisation whose security you would also be trusting without being told.

If it went wrong anyway

If your data were exposed and it could cause you harm, we are required by the Privacy Act 2020 to notify you and the Office of the Privacy Commissioner, and we would. You would hear it from us, in plain words, including what we did and did not know.

The honest limit on all of the above is the first item in what we have not done: nobody independent has been paid to try to get past any of it. It is a careful account of a system by the person who built it, which is worth something and is not the same as somebody having checked.

Photos and their hidden position

A photo of a reef is location data. Cameras write GPS coordinates into a photo's metadata, so we strip that out of every image on the way in and store the picture without it. Photos are kept in private storage with no public web address, and they are off by default when you export.

Getting your data out

Any time, from the app: it hands you your marks, catches and areas as a GeoJSON file that opens in QGIS or anything else that reads maps. Before it writes the file it shows you every record and every field it is about to include, so you can see there is nothing else attached. The data is yours and it should not need our permission or our continued existence.

Deleting it

Deleting a single mark, catch or area keeps it recoverable for 30 days in case you did it by accident, then it is destroyed for good.

Deleting your account signs every device out immediately and starts the same 30-day clock, after which the account and everything attached to it - marks, catches, areas, photos - is permanently removed. A job runs every day to do exactly that. It is not a flag that hides your data while keeping it.

How long it is kept otherwise

For as long as you have an account. We do not expire or thin out old records: a diver with fifteen seasons of marks has fifteen seasons of marks, and that history is most of the point. Web server logs are kept short-term for security and troubleshooting, and contain no fishing positions.

Your rights

Under the Privacy Act 2020 you can ask what we hold about you, ask us to correct it, and complain to the Office of the Privacy Commissioner if you think we have got it wrong. In practice the export above answers the first one faster than we could, and the app lets you correct or delete anything directly. Email admin@catchlog.co.nz for anything the app cannot do.

What we have not done

The honest list, because the rest of this page is worth less without it.

• No independent security audit. Nobody outside this project has been paid to try to break in. Everything above is our own account of our own system.
• The database is not encrypted on the server's own disk. It is protected by the machine not being reachable and the account not being shared, not by a second lock underneath. Encryption there would mostly protect against the hosting company or a stolen physical disk, and we would rather say so than imply a protection we have not built.
• Off-site backups are not running yet. Being straight about it: if that server were lost today, recent records that had not synced back to a phone could be lost with it. Your phone keeps its own copy of everything you recorded, and the export exists, but that is not the same as a backup and we are not going to pretend it is. When backups do run they will be encrypted before they leave the machine and destroyed on the same 30-day schedule as everything else.
• There is no two-factor sign-in yet. A password and the rate limiting described above are what stand between somebody and your account. Two-factor is the single biggest thing that would improve this, and it is not built.
• This page has not been reviewed. See the note at the top.

Changes to this page

If we change what we collect or who can see it, this page changes and the date at the top changes with it. A change that meaningfully widens who can see your records is not something we would do quietly, or, on present intentions, at all.

Contact

admin@catchlog.co.nz. If you think something here is wrong, that is the most useful message you can send.

Isoline Limited is based in Wellington, New Zealand. Its registered office address is on the company's entry in the Companies Register.