1. Who is responsible
The controller for FishComp (fishcomp.com and the FishComp app) is Simen Vikdal, private individual, Lindåsvegen 143, 5916 Isdalstø, Norway. Privacy contact: support@fishcomp.com.
Organisers who create competitions on FishComp are themselves responsible for the information they receive about their participants (see section 5).
2. What information we process
Account
- Name, email address and password (stored only as an encrypted hash).
- Optional: profile photo, short bio, date of birth (used only to place you in the right class, for example junior) and gender (used only for women’s lists in competitions; never shown to others).
- If you sign in with Google or Apple, we receive an ID from them, and your name and email if you allow it. With Apple you can hide your email address.
- Language choice and notification settings.
Catches
- Species, length, weight, time, photos and video.
- Location (GPS) when you allow the app to use it, and information from the photo (for example the time it was taken) to check the catch. You choose in your profile how precisely your location is shown to others; in competitions the organiser can hide locations from the other participants.
- The jury’s decisions, deductions, complaints and comments on the catch.
Competitions and teams
- Entries, class, team and crew, results and placings.
- Invitations you send (the name and email of the person you invite).
Payment
- When you pay an entry fee, Stripe processes the card details. We do not store card numbers, only the payment’s ID, amount, status and who the payment is for.
Messages and notifications
- Messages you send to other users, notifications in the service, and a push token for your phone if you turn on push notifications.
Child accounts
- A parent or guardian can create child accounts and enter the children in competitions. The parent sees and manages their child accounts. Children cannot send messages to or receive messages from other users, only from organisers and judges in competitions they take part in.
Historical results
- We may import results from previous years from organisers (for example Havfisker'n 2023–2026): the name, species, length and date of each catch, as the organiser recorded them. These are not linked to any account until the person asks for it (“Is this you?”) and a FishComp administrator approves.
Technical
- IP address and time in server logs, login sessions and login attempts (for security and to prevent misuse).
- We do not use analytics or tracking tools, and no advertising. We receive crash reports from the app in anonymised form through the App Store and Google Play.
3. Why, and on what legal basis
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and running your account, logging catches, competitions, results, messages | Contract (1 b) |
| Payment of entry fees and accounting | Contract (1 b) and legal obligation (1 c, the Norwegian Bookkeeping Act) |
| Location from your phone, push notifications, optional fields such as gender and date of birth | Consent (1 a) — can be withdrawn at any time |
| Security, preventing cheating and misuse, server logs | Legitimate interest (1 f) |
| Showing historical competition results that the organiser has published | Legitimate interest (1 f) — the organiser has already made the results public |
| Email about your account (confirmation, new password, invitations, receipts) | Contract (1 b) |
4. What others can see
- Your name, your profile photo, the catches you have made public and your competition results are visible to others, including people without an account, and can be shown on organisers’ websites through embedded results pages.
- Catches you have set as private are shown only to you (and to the jury in competitions you take part in).
- Your email address, date of birth and gender are never shown to other users.
5. Who we share information with
Organisers of competitions you enter see your name, your email address, class, team, payment status and your catches in the competition. They are themselves responsible for how they use this information.
Service providers (data processors) that process information on our behalf:
| Provider | What | Where |
|---|---|---|
| DigitalOcean | Servers and database | Data centre in Amsterdam (EU); US company |
| Cloudinary | Storing and showing photos and video | USA (EU–US Data Privacy Framework) |
| Stripe | Card payments | Ireland/USA |
| Brevo | Sending email | France (EU) |
| Sign in with Google; push notifications to Android | USA (Data Privacy Framework) | |
| Apple | Sign in with Apple; push notifications to iPhone; support email | USA (Data Privacy Framework) |
| Expo | Delivers push notifications to the app | USA (Data Privacy Framework) |
| Norwegian Meteorological Institute (MET) | Weather for the catch (receives the catch’s location, not who you are) | Norway |
| Kartverket (the Norwegian Mapping Authority) and OpenStreetMap | Map tiles (receive your IP address when the map loads) | Norway / EU |
| jsDelivr, cdnjs (Cloudflare) and unpkg | Deliver scripts and stylesheets (Bootstrap, Font Awesome, Leaflet); receive your IP address when the page loads | USA/EU (Data Privacy Framework) |
Transfers to the USA are based on the EU–US Data Privacy Framework or the EU’s standard contractual clauses.
Merch: If you buy FishComp merch, the purchase is made with Spreadshop/Spreadshirt, which is independently responsible for your order.
We never sell personal data, and we do not share it for advertising. We disclose information to authorities only when the law requires it.
6. How long we keep information
- Your account is kept until you delete it. When you delete your account, your name, email, profile photo and other personal data are removed. Results in finished competitions remain under the name “Slettet bruker” (“Deleted user”), so that the results lists still add up.
- Photos of catches are deleted when the catch or the account is deleted.
- Payment information is kept for five years under the Norwegian Bookkeeping Act.
- Server logs (IP address and which pages were visited) are deleted after 14 days. Logs of login attempts are used for security and deleted when they are no longer needed.
- Historical results are kept as long as the organiser publishes them. If you ask us to, we remove your name.
7. Your rights
You have the right of access, rectification, erasure, restriction and data portability, and the right to object to processing based on legitimate interest. You can do much of this yourself in your profile (change your information or delete your account). If you would like a copy of your information, or anything else, write to support@fishcomp.com and we will reply within 30 days.
You can complain to Datatilsynet, the Norwegian Data Protection Authority (datatilsynet.no), if you believe we process your information in breach of the rules.
8. Children
Children under 13 can only use FishComp through a child account that a parent or guardian creates and is responsible for. The parent can change or delete the child account at any time. If you believe a child has created their own account without consent, contact us and we will delete it.
9. Cookies
We use only necessary cookies: the login session, “Remember me” (keeps you logged in for up to 30 days if you choose it), protection against forged forms, and your language choice. We do not use tracking or advertising cookies.
10. Security
Traffic is encrypted (HTTPS), passwords are stored as hashes, payments are handled by Stripe, and access to the database is restricted. No system is completely secure; if we discover a breach that may affect you, we will notify you and Datatilsynet as the rules require.
11. Changes
For significant changes we will notify you in the service or by email. The date at the top shows when this policy was last changed.