Privacy Policy — Ureel

1. Who We Are

Ureel ("we", "us", "our") operates the Ureel website at ureel.app and the Ureel mobile application (together, the "Platform"). We are a social platform for anglers, fishing venues, and tackle businesses. For the purposes of data-protection law, we are the data controller of the personal information described in this policy.

If you have any questions about this policy or your data, contact us at privacy@ureel.app.

2. Information We Collect

2.1 Account Information

When you register we collect:

Email address and password (securely hashed by our authentication provider)
Username and display name
Account type (Angler, Venue, or Shop / Business)

2.2 Profile Information

You may optionally provide:

Profile photo and banner image
Biography and location
Personal-best fishing records

2.3 Fishing & Session Data

When you log fishing activity we store:

Session details (dates, type, venue, swim, notes)
Catch records (species, weight, bait, rig, hookbait, depth, distance, photos)
Swim annotations, photos, and markers
Environmental conditions (weather, temperature, pressure, wind — retrieved from the Open-Meteo API or entered manually)

2.4 Social Content

Posts (text captions, photos, videos)
Comments, likes, and shares
Direct messages between users
Follow relationships

2.5 Marketplace & Shop Data

Marketplace listings (title, description, price, images, category, condition, location)
Shop storefront information (business name, description, contact details, address, website, social links)
Shop team member associations

2.6 Venue Data

Venue profiles (name, description, county, GPS coordinates, facilities, fish stocks, day ticket price, contact information)
Venue images

2.7 Location Data

We collect location data in two ways:

Explicitly provided — venue coordinates, catch locations, and your optional profile location.
Device GPS — when you use the Lake Mapper, weather auto-fill, or nearby-venue features in the mobile app, we request your device's precise location. This is used only while you are using the app and is never tracked in the background.

The mobile app may also request camera or photo library access to allow you to upload images.

2.8 Technical & Usage Data

IP address (recorded for security and admin audit purposes)
Last-seen timestamp
Authentication tokens stored securely on your device
Browser type, device type, and operating system (standard HTTP headers)

3. How We Use Your Information

We use your data for the following purposes:

To provide the service — creating your account, displaying your profile, enabling social interactions, logging fishing data, and operating the marketplace and shop features.
To personalise your experience — showing you relevant content, generating catch analytics and personal insights, and providing weather data for your sessions.
To facilitate communication — delivering direct messages, notifications, and system alerts.
To maintain safety and security — processing abuse reports, enforcing bans and suspensions, maintaining admin audit logs, and detecting fraud or misuse.
To improve the Platform — understanding how features are used, fixing bugs, and developing new functionality.
To comply with legal obligations — responding to lawful requests from authorities and enforcing our terms of service.

4. Legal Bases for Processing (UK GDPR)

We rely on the following lawful bases under the UK General Data Protection Regulation:

Contract — processing necessary to provide you with the services you signed up for (Articles 6(1)(b)).
Legitimate interests — platform security, fraud prevention, analytics, and service improvement (Article 6(1)(f)).
Consent — where you voluntarily provide optional data such as your bio, location, or photos. You can withdraw consent at any time by deleting or editing your data.
Legal obligation — where we are required to retain or disclose data by law (Article 6(1)(c)).

5. Data Sharing & Third Parties

We do not sell your personal data. We share data only in the following limited circumstances:

5.1 Service Providers

Supabase (authentication, database hosting, file storage) — your account credentials and uploaded media are processed by Supabase. See Supabase Privacy Policy.
Open-Meteo (weather data) — we send venue GPS coordinates to retrieve weather conditions. Open-Meteo is a free, open-source API and does not require personal-data transfer.

5.2 Public Content

Posts, comments, profile information, venue pages, shop storefronts, and marketplace listings you create are visible to other users of the Platform and may be indexed by search engines. You can control the visibility of certain content through your privacy settings (e.g. message privacy).

5.3 Law Enforcement

We may disclose your data to law enforcement or regulators where required by law or to protect the safety of our users.

6. Data Retention

Account data is retained for as long as your account exists. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are legally required to retain it.
Posts, catches, sessions, and listings are deleted when you delete them individually or when your account is deleted.
Direct messages are retained until you or the other participant deletes them, or until your account is deleted.
Admin audit logs (including IP addresses) are retained for up to 12 months for security purposes.
Abuse reports may be retained after account deletion where needed for ongoing investigations.

7. Your Rights

Under UK GDPR you have the right to:

Access — request a copy of the personal data we hold about you.
Rectification — correct inaccurate data via your profile settings or by contacting us.
Erasure — request deletion of your account and associated data.
Restriction — ask us to restrict processing in certain circumstances.
Data portability — receive your data in a structured, machine-readable format.
Object — object to processing based on legitimate interests.
Withdraw consent — where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, email privacy@ureel.app. We will respond within one month as required by law.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your rights have been infringed.

8. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

Encrypted connections (HTTPS/TLS) for all data in transit
Passwords are securely hashed — we never store plaintext passwords
Authentication tokens are stored in secure device storage (Keychain / Keystore) on mobile devices
Role-based access controls for administrative functions
Admin action audit logging for accountability

While we take every reasonable precaution, no system is 100% secure. If you become aware of a security vulnerability, please report it to security@ureel.app.

9. Children

The Platform is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us so we can delete it.

10. Cookies & Local Storage

We use essential cookies and browser local storage to keep you signed in and to store your authentication session. We do not use third-party advertising or tracking cookies. No data is shared with ad networks.

11. International Transfers

Your data may be processed and stored on servers located outside the United Kingdom, including in the European Union and the United States (via our service providers). Where data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

12. Changes to This Policy

We may update this privacy policy from time to time. If we make significant changes, we will notify you via the Platform or by email. The "Last updated" date at the top of this page indicates when the policy was last revised.

13. Contact Us

If you have any questions about this privacy policy or wish to exercise your data rights, please contact us:

Email: privacy@ureel.app