Privacy Policy

Last updated: 25 October 2026 · Applies to the SpotNav app (iOS and Android) and the website spotnav.app

This policy explains which data is processed when you use SpotNav, what for, on which legal basis, and which rights you have. We built the app so that as little data as possible leaves your device. This is an English translation of the German version; in case of discrepancies, the German version prevails.

Contents

1. Controller
2. What the app does not do
3. Data on your device
4. Location, camera, photos and sensors
5. Map: Google Maps
6. Weather data: Deutscher Wetterdienst via Bright Sky
7. iCloud backup (Premium)
8. Sharing by link
9. Advertising: Google AdMob
10. Usage analytics: Firebase Analytics
11. Premium: purchases and subscriptions
12. Contact, wishes and bug reports
13. Website spotnav.app
14. Transfers to the USA
15. Your rights
16. Minimum age
17. Data security, no automated decisions
18. Changes

1. Controller

The controller for data processing in the app and on this website is:

krk:services GmbH
Fliederweg 25a
48499 Salzbergen
Germany
Email: info@krk.services

Further company details are in the legal notice (Impressum, in German). For privacy questions, just email us at the address above.

2. What the app does not do

• No user account, no registration, no sign-in.
• No transfer of your spots, photos, notes or waters to us or to third parties, unless you share them yourself by link; even then only encrypted, so that we cannot read them (section 8).
• No backend for your data: for the app, our server stores only encrypted packages that you share yourself (section 8) and the Premium purchase log without details about you (section 11). Your backup is kept in your own iCloud (section 7).
• No microphone, no access to your contacts or other apps. No access to your photo library: the app receives only the pictures you select yourself in the iOS or Android photo picker for a spot, catch or session. If you save a catch or session picture to your photos, it adds only that picture (section 4).

Data leaves your device only in the cases described in sections 5 to 11: map display, weather data, iCloud backup, sharing by link, advertising, usage analytics and purchases, and when you send us a wish or bug report (section 12).

3. Data on your device

The app stores the following data locally, in the app's protected storage area on your device. Copies are only made if you turn on the iCloud backup (section 7) or share something by link (section 8):

• Spots: name, note, photos, GPS coordinates, assigned water, date and details about the spot such as water depth, bottom and structure.
• Logbook: catches with species, weight, length, bait, rig, note, time, position and weather; sessions with start and end, water, note, position, weather, water temperature and water level; feedings with the feed used, amount and time.
• Photos of spots, catches and sessions that you have taken or selected from your library, reduced to at most 2048 pixels on the longer side and stored together with the time they were taken (section 4).
• Waters you have created.
• Settings such as rod length and sort order.
• Premium status (whether a subscription is active) and your consent choices from the privacy dialog.

You can delete spots, logbook entries, photos and waters in the app at any time; if you delete a spot, catch or session, its photos are deleted with it. If you delete the app, all of this data is removed from the device. Apart from the app's own backup (section 7), the operating system's device backup (iPhone iCloud Backup or Google backup) may also include the app's data, including photos; you control this in your device settings, and Apple's or Google's privacy terms apply to it. We have no access to this data.

Legal basis: insofar as this involves any processing by us at all, it is the provision of the app features you want to use (Art. 6(1)(b) GDPR).

4. Location, camera, photos and sensors

Location

The app requests your location only while you are using it (no background location). It needs it to show your position on the map, to save a new spot at your current position and to calculate distance and direction to saved spots. The location is processed on the device. Only the coordinates of the spots you create yourself are stored permanently. No location data is transferred to us. For the map display, however, Google receives the map section being shown (section 5).

Without location access, the map and navigation do not work. You can change the permission at any time in your device settings.

Camera

The app uses the camera for three things: as an aiming aid when capturing a spot, where you point the camera image at the place in the water; for camera navigation, which overlays the spot on the live camera image; and for photos that you take yourself for a spot, catch or session. The camera image of spot capture and camera navigation is only displayed and is neither stored nor transmitted. Photos are stored by the app only locally on your device, reduced to at most 2048 pixels on the longer side. The microphone is not used.

Photos from your library

Instead of taking a photo, you can add pictures from your photo library. For this, the app opens the operating system's photo picker (iOS or Android). It receives only the pictures you select there and has no access to the rest of your library. Added pictures are reduced in size and stored locally only, just like your own shots; to sort them, the app reads the time the picture was taken from the image.

Saving pictures to your photos

To share a catch or session, for example on Instagram, the app creates a picture on your device with the photo and the key details. It contains no coordinates; the water and the spot name only if you switch them on before sharing. If you tap “Save to Photos”, the app adds the picture to your library. For this it only asks for the “Add Photos” permission, which does not allow it to read your library. If you share the picture through the share menu, you choose the app it goes to; that app's terms apply there. The picture is not sent to us.

Compass and motion sensors

For the direction display and camera navigation, the app reads your device's compass and motion data. This data is used only at the moment of display and is not stored.

Legal basis: provision of the features you want to use (Art. 6(1)(b) GDPR). Access to your device's location, camera and sensors, and receiving the photos you select, are strictly necessary for these features (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); you grant and revoke the permissions through the operating system.

5. Map: Google Maps

The map in the app is provided by the Google Maps SDK. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, for users in the European Economic Area and Switzerland; the parent company is Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

When the map loads, your device sends to Google: your IP address, the requested map section and zoom level (that is, the area you are looking at, usually your surroundings) and technical details about your device, operating system, the app and the SDK version. Google uses this data to deliver the map and to secure and improve its services; details are in Google's Privacy Policy. Google processes this data under its own responsibility. The Google Maps Additional Terms of Service also apply to use of the map.

Legal basis: provision of the map feature, which is the core of the app (Art. 6(1)(b) GDPR). For transfers to the USA, see section 14.

6. Weather data: Deutscher Wetterdienst via Bright Sky

When you log a catch or start a session in the logbook, the app fetches the current weather conditions from the weather station of Germany's national meteorological service, the Deutscher Wetterdienst (DWD), that is closest to the position of the entry: air temperature, air pressure at sea level with its trend over the past 24 hours, wind speed and direction, weather condition and cloud cover. The moon phase is calculated by the app itself on your device. The readings come from the DWD's open data (licensed under CC BY 4.0), which is why the app shows the source “Deutscher Wetterdienst” with a link next to all weather values. The data is retrieved through Bright Sky (brightsky.dev), a free, open-source service for DWD open data that can be used without a key and without an account. The DWD itself receives no data from you; Bright Sky keeps a copy of the DWD data on its own servers.

For this, your device sends directly to Bright Sky the coordinates of the position, rounded to two decimal places (roughly one kilometre), and, for technical reasons, your IP address; each lookup consists of two requests (current weather and the hourly readings of the past 24 hours). No identifiers, account details or content from the app are transmitted. According to the project, the public Bright Sky API runs on a server of Hetzner Online GmbH (Gunzenhausen, Germany); when we checked, this server was located in a data centre in Germany. The project does not publish a privacy policy of its own or details about access logging (brightsky.dev).

The app caches the response for 30 minutes so that not every entry triggers a new request. The conditions are stored together with the catch or session only on your device; sections 3 and 7 apply to backups. The DWD's stations essentially cover Germany. Outside Germany, without an internet connection, or if the service is unavailable, the entry is simply saved without weather details; the logbook works regardless.

Legal basis: provision of the logbook feature you want to use (Art. 6(1)(b) GDPR) and our legitimate interest in automatically adding the matching weather conditions to your entries without running servers of our own (Art. 6(1)(f) GDPR).

7. iCloud backup (Premium)

With SpotNav Premium you can turn on an automatic backup to your own iCloud on iPhone and iPad (“More” › “iCloud backup”). It stays off until you activate it yourself. After that, the app backs up your spots, waters, settings and logbook (catches, sessions, feedings) as well as the photos in all galleries of spots, catches and sessions whenever something changes and when you open the app. Photos you delete in the app are also removed from the backup. The backup is not yet available on Android.

The backup is kept in the app's iCloud storage area in your Apple Account. We run no server for it and have no access to it. All content is encrypted on your device before it is uploaded (AES-256-GCM). The app generates the key at random; it is kept in your device's keychain and reaches your other devices through iCloud Keychain, which Apple protects with end-to-end encryption. Neither we nor Apple can read the backup files. The only unencrypted item is a small status file with the time of the last backup, a randomly generated device identifier, an identifier of the key and the number of spots and photos, so that the app can show the backup status.

In the app you can display the key as a recovery code and enter it on another device. Keep it safe: the code can be used to read your backup. Restoring works without Premium too, so you are never locked out of your data. If you turn off “Back up automatically”, the app stops backing up; the existing data stays in your iCloud until you delete it in your device's iCloud storage management. Apple's privacy policy applies to iCloud.

Legal basis: provision of the backup feature that you turn on yourself (Art. 6(1)(b) GDPR).

8. Sharing by link

You can share individual spots, the spots of a water, catches and sessions with others by link. This only happens when you tap “Share” yourself. The app puts together a package with the content the recipient is meant to see:

• Spots: name, note, water and coordinates.
• Catches: species, weight, length, bait, rig, note, time and the weather, plus the names of the water and spot if they are switched on before sharing (by default: water yes, spot no), but no position.
• Sessions: start and end, water, note, water temperature, water level, weather, the catches of the session (as above) and the feedings.
• Photos: depending on the entry and the app version, its photos are included, reduced to about 1024 pixels on the longer side, at most ten per link.

The package is encrypted on your device with a random key (AES-256-GCM) and sent to our server at spotnav.app. The key is only contained in the link after the “#” character; browsers and apps do not send this part to the server. The server stores only the encrypted data with the time of creation and expiry and assigns a random identifier. We cannot read the content. Anyone who has the complete link can read it, so only pass it on to people you want to show the content to.

Links expire after 180 days. The server no longer releases expired packages and deletes them at the next clean-up. If you want a package deleted earlier, send us the link address up to the “#” character (without the key) at info@krk.services.

When a package is uploaded or retrieved, the server processes the IP address for technical reasons; section 13 applies to the access logs. To limit abuse (at most 60 links per hour and connection), it also stores a checksum (hash) of the IP address together with a counter. Once the hour is over, it is no longer used and is deleted at the next clean-up. Like the website, the server is hosted by netcup (section 13).

When someone opens your link

If the recipient has SpotNav installed, the link opens in the app, which shows the content and adds shared spots on request. Catches and sessions are only shown, in the app and on the page. Without the app, the page spotnav.app/s opens in the browser and decrypts the package there. This page loads the map library Leaflet from unpkg.com, a public distribution network for open-source software that is delivered through Cloudflare. For shared spots it also loads satellite imagery from Esri (Environmental Systems Research Institute, Inc., 380 New York Street, Redlands, CA 92373, USA). These providers receive the recipient's IP address, and Esri receives the map area around the shared spots, but neither receives the key or the rest of the package's content. Details are in Esri's privacy statement. For transfers to the USA, see section 14.

Legal basis: provision of the sharing feature you use (Art. 6(1)(b) GDPR). For limiting abuse and for the map view in the recipient's browser, we rely on our legitimate interest in running the service securely and in showing shared content without the app (Art. 6(1)(f) GDPR).

9. Advertising: Google AdMob

The free version of SpotNav shows ads in a few places, for example when saving, searching, navigating and before sharing by link. These ads are delivered by Google AdMob through the Google Mobile Ads SDK (Google Ireland Limited and Google LLC, addresses in section 5). With SpotNav Premium, no ads are requested or shown.

Your privacy dialog

Before the app loads any ads, it asks for your consent in a dialog. The dialog is provided by Google's User Messaging Platform and follows the IAB Europe Transparency and Consent Framework (TCF). You can choose “Consent” or “Do not consent”, or select individual purposes and vendors under “Manage options”. The dialog lists all advertising partners that may be involved in delivering ads.

• With consent, Google shows personalised ads. For this, Google and the partners named in the dialog process your device's advertising identifier (IDFA on iOS, advertising ID on Android), your IP address (also to determine your approximate location), details about your device and the app, the ads shown and how you respond to them. This may be used to build interest profiles and to measure ad performance.
• Without consent, Google delivers only limited, non-personalised ads based on context. Google then processes your IP address and technical device details only to the extent necessary to deliver the ads and to prevent fraud and abuse, but no advertising identifier and no interest profiles.
• On iOS, the system additionally asks you through App Tracking Transparency whether the app may track you across apps and websites. Only if you allow this can Google use your iPhone's advertising identifier. If you decline, it remains blocked for Google even if you consented in the privacy dialog.

Google's role

For personalised advertising, Google is an independent controller; Google's Privacy Policy and its explanation “How Google uses information from sites or apps that use our services” apply. You can manage your Google ad settings at adssettings.google.com. We ourselves receive only aggregated statistics from AdMob (number of ads, clicks, revenue) with no reference to individual persons.

Legal bases

• Personalised and non-personalised ads, and storing and reading the advertising identifier on your device: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).
• Limited ads without consent and measures against fraud and abuse: our legitimate interest in financing the free version through advertising and preventing ad fraud (Art. 6(1)(f) GDPR).

Withdrawal and retention

You can change or withdraw your consent at any time with effect for the future: in the app under “More” › “Privacy” › “Privacy settings” (the dialog opens again). On iOS you can also turn off tracking under “Settings” › “Privacy & Security” › “Tracking”; on Android you can reset or delete the advertising ID under “Settings” › “Google” › “Ads”.

The app stores your choice on your device until you change it or delete the app; in line with the TCF rules, you are asked again at regular intervals. How long Google retains advertising data is described at policies.google.com/technologies/retention.

10. Usage analytics: Firebase Analytics

To understand which features are used and where the app has problems, we use Google Analytics for Firebase (“Firebase Analytics”) from Google Ireland Limited and Google LLC. Analytics is active only if you have agreed in the app's privacy dialog. Without your agreement, no analytics data is sent.

What is transmitted

• Events such as app start, screen view, “spot created”, “photo added” (only whether to a spot, catch or session and how many, never the picture itself), “navigation started”, “camera search started”, “backup completed” and “link shared” (each only with counts such as the number of photos) or “Premium purchased” (with product and price), each with a timestamp.
• A randomly generated installation ID (app instance ID) that groups events from the same installation. It contains neither your name nor any account details. Your device's advertising identifier is used for analytics only if you have also consented to personalised advertising.
• Device and app data: device model, operating system and version, app version, language, screen resolution and approximate region (country, region, city).

Not transmitted: your location from location services, spot coordinates, photos, notes, water names, links or any other content you enter in the app.

IP address: Google derives only the approximate region from the IP address and then discards it. According to Google, IP addresses of users from the EU, the United Kingdom and Switzerland are not logged or stored.

Retention: event-level and user-level data is automatically deleted from Google Analytics after 14 months. Aggregated reports without personal reference are kept longer. In the Firebase and Analytics consoles we see only such aggregated reports.

Google's role: Google processes the analytics data on our behalf (Art. 28 GDPR) under Google's data processing terms. For transfers to the USA, see section 14.

Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time under “More” › “Privacy” › “Privacy settings” in the app; after that, no new data is sent, and data already collected is deleted when the retention period expires.

11. Premium: purchases and subscriptions

You buy SpotNav Premium as a yearly subscription or one-off purchase (Lifetime) through the Apple App Store (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland) or Google Play (Google Commerce Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Payment is handled entirely by the respective store; its privacy policy and terms apply (Apple, Google). We receive no payment details, names or addresses.

The app queries the purchase status from the store (product, active or expired, expiry date, transaction identifier) and stores it on your device to unlock Premium and to enable “Restore purchases”. In Apple's and Google's sales reports we see purchases only in aggregated or pseudonymous form (order number, product, country, amount), with no details about you.

Purchase log on our server

So that we can help with questions about a purchase and trace errors, we keep a purchase log on our server at netcup (section 13). It contains: store (Apple or Google), product, transaction and order numbers, purchase, renewal and expiry times, status (e.g. trial, active, cancelled, refunded), store country, price and currency, app version and a support ID. The support ID is a random identifier the app creates once; you find it under “More”. It is passed to the store when you buy and comes back to us with the store's notifications.

We receive the data in two ways: Apple and Google notify our server about purchases, renewals, cancellations and refunds, and the app reports the store-signed purchase receipts after a purchase, when restoring and occasionally at start-up. Names, email addresses, payment details or locations are not included; Apple and Google do not give them to us. If you give us your order number for a support request, we look it up with Apple.

Legal basis: performance of the Premium contract (Art. 6(1)(b) GDPR) and our legitimate interest in resolving purchase problems and detecting abuse (Art. 6(1)(f) GDPR). Retention: the purchase status stays on your device until you delete the app. We delete purchase-log entries three years after the subscription ends or after the one-time purchase (regular limitation period, Section 195 of the German Civil Code, BGB). Billing data from the store reports is kept as long as commercial and tax law requires (up to ten years, Section 147 of the German Fiscal Code, AO, and Section 257 of the German Commercial Code, HGB).

12. Contact, wishes and bug reports

If you write to us at info@krk.services, we process your email address, the content of your message and the details you give us in order to answer your request. The legal basis is Art. 6(1)(b) GDPR for questions about your subscription or the app, and otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete the correspondence once your matter is settled and no statutory retention obligations stand in the way (six years for business letters, Section 257 HGB).

Wishes and bug reports from the app (“Have your say”)

Under “More › Have your say” (“Mehr › Mitgestalten” in the German app) you can send us wishes and bug reports. For this we store on our server at netcup (section 13): the type (wish or bug), title and description, an image if you attach one, your email address if you provide it, as well as app version, operating system and version, device type (e.g. iPhone), whether the app reports Premium, and your support ID (section 11). Via the support ID the app shows you the status and our reply, and we can give priority to wishes from Premium users. We use the email address only for questions about your submission; the app remembers it on your device for next time.

Legal basis: your interest in an answer and our legitimate interest in improving the app and fixing bugs (Art. 6(1)(f) GDPR); providing the email address is voluntary. Retention: we delete submissions including image and email two years after they were last handled, or immediately on request (an email with your support ID is enough).

13. Website spotnav.app

When you visit this website, the web server automatically stores access logs: IP address, date and time, page requested, amount of data transferred, status code, browser and operating system (user agent) and the previously visited page (referrer). We need them to deliver the site, find errors and fend off attacks (Art. 6(1)(f) GDPR). The logs are deleted after 30 days at the latest.

The website is hosted by netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany, in a data centre in the EU; we have a data processing agreement with netcup (Art. 28 GDPR).

The website sets no cookies, uses no analytics or advertising services and embeds no fonts or content from third-party servers. The only exception is the page for shared links at spotnav.app/s, which loads a map library and satellite imagery (section 8). The links to the App Store and Google Play lead to Apple's and Google's services, where their privacy policies apply.

14. Transfers to the USA

Google and Apple also process data on servers in the USA, as do Esri for the map view of shared spots and Cloudflare for delivering the map library (section 8). Google LLC, Apple Inc., Esri (Environmental Systems Research Institute, Inc.) and Cloudflare, Inc. are certified under the EU-US Data Privacy Framework; for certified companies, the European Commission has determined an adequate level of data protection (adequacy decision of 10 July 2023, Art. 45 GDPR). In addition, the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR), which form part of Google's data processing terms, safeguard the transfer. You can check the certifications at dataprivacyframework.gov/list.

15. Your rights

Under the GDPR you have the following rights:

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20).
• Objection (Art. 21): you can object at any time, on grounds relating to your particular situation, to processing that we base on our legitimate interest.
• Withdrawal of consent (Art. 7(3)): at any time with effect for the future, most easily in the app under “Privacy settings” or by email to us.
• Complaint to a supervisory authority (Art. 77): the authority responsible for us is the Lower Saxony State Commissioner for Data Protection (Die Landesbeauftragte für den Datenschutz Niedersachsen), Prinzenstraße 5, 30159 Hannover, Germany, phone +49 511 120-4500, email poststelle@lfd.niedersachsen.de, lfd.niedersachsen.de. You can also contact the authority where you live.

For requests, write to info@krk.services. We reply within one month. Please note: because there is no user account and your spots are only on your device or encrypted in your iCloud, in most cases we cannot identify you (Art. 11 GDPR). You delete spots and photos yourself in the app. We delete shared packages early if you send us the link address (section 8). For advertising data that Google processes under its own responsibility, you can also exercise your rights directly with Google (policies.google.com/privacy).

16. Minimum age

SpotNav is not aimed at children. You can validly consent to advertising and usage analytics only if you are at least 16 years old (Art. 8 GDPR). If you are younger, choose “Do not consent” in the privacy dialog or let your parents decide. We do not knowingly collect personal data from children under 16.

17. Data security and no automated decisions

All connections of the app and the website are TLS-encrypted. Backups and shared packages are additionally encrypted on your device before they leave it (sections 7 and 8). The operating system protects the data on your device through the app sandbox and device encryption, so secure your device with a passcode or biometrics. We make no automated decisions within the meaning of Art. 22 GDPR and create no profiles. Google personalises ads only after your consent (section 9).

18. Changes

We update this privacy policy when the app, our service providers or the legal situation change. The current version is always available at spotnav.app/en/privacy. If a change requires new consent, the app asks you again. This policy is also available in German and Dutch; in case of discrepancies, the German version prevails.

Terms of Use Legal notice (German) Back to the home page