Privacy notice
Because we are established in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply to how we use your data. Where other data protection laws also apply to you (for example where you live in the European Union or in Nigeria), we respect the rights they give you as well.
Who Fishes is for
Fishes is for people aged 18 or older. When you create an account, you confirm “I confirm I am 18 or older”. This is a self-declaration: we do not verify age. We record when you confirmed and which version of the terms applied. If we learn that an account belongs to someone under 18, we will close it.
What we collect and why
| Data | Why | Who can see it |
|---|---|---|
| Handle, email address, password (stored only as a one-way hash) | Your account and sign-in | Your handle is public once moderation approves it. Your email address is never shown to other players |
| Account emails sent to your address: address confirmation and password reset | Confirm your address and let you reset your password | Only you |
| 18+ confirmation (time and terms version) | Record of the age self-declaration | You and staff |
| Settings (including trash-talk and “Allow bot opponents”) and your built-in avatar choice | Your preferences | Your avatar is shown beside your name; settings only to you |
| Signed-in devices (device name, platform, first and last use) | Show and sign out your app sessions | Only you |
| Games: moves, clocks, results, ratings and rating changes, including rated games against bot opponents | Play, ratings, history and leaderboards | Matchmaking games are public; spectators see them live with a 15-second delay. Friend challenges are private to the two players |
| Matchmaking searches (time format, rating at the time, when you searched) | Find you an opponent | Only you and staff |
| Pre-game and post-game chat, and the trash-talk mode you chose | Banter between the players of a game | The two players |
| Public post-game comments | Comments on public games | Everyone who can view the game |
| Tournament entries and results | Run tournaments and award prizes | Public with the tournament |
| Inbox messages (for example challenges, tournament news, appeal outcomes, prizes) | Tell you about things that concern you | Only you |
| Reports, blocks, mutes and appeals | Safety and moderation | Staff; a block is visible in its effect |
| Moderation records: the original text of a submission, the decision and the reason | Enforce the rules and handle appeals | Staff; you see your own held text |
| Relationship labels (for example Rival) and achievements | Community features | Public unless you turn them off in settings |
| Subscription records: the store (App Store or Google Play), plan, status, trial and period dates, renewal setting, the store’s purchase or transaction identifiers, whether a free trial was used, and refunds. No card or bank details: the store takes the payment | Give you the Premium you paid for, apply the free-trial rules (on Google Play, one free trial per Fishes account; on the App Store, Apple decides), handle renewals, cancellations and refunds, and keep accounting records | You and staff |
| Premium from promotions and tournament prizes (dates and reason) | Give and record Premium days | You and staff |
| Emails you send to us | Answer you | Us |
| Server logs, including IP addresses | Security, abuse prevention and troubleshooting | Staff |
Not used: analytics, advertising, tracking pixels or third-party trackers. Switched off for now: avatar photo uploads (you choose from built-in avatars) and push notifications. We will update this notice before turning either of them on.
Cookies and local storage: the website uses only a session cookie and a security (CSRF) cookie, both needed to sign in. It also keeps a capture-sound preference and an optional diagnostics switch in your browser’s local storage. The app keeps your sign-in tokens in the device’s secure storage.
Who processes data for us, and where
| Provider | What | Where |
|---|---|---|
| Hetzner Online | Hosting from our move on 7–8 November 2026: the Fishes server and database, and encrypted off-site backups | Germany (server) and Finland (backups) |
| DigitalOcean | Hosting: our bot-opponent server; until our move on 7–8 November 2026 also the Fishes server and database and off-site backups in a private storage bucket (the old copies are deleted within 30 days of the move) | London, United Kingdom |
| OpenAI | Automated moderation: chat messages, handles and comments are checked before anyone else sees them. OpenAI does not use this data to train its models and, according to OpenAI, does not keep moderation requests for abuse monitoring | United States |
| Amazon Web Services (Amazon SES) | Sending account emails: your email address and the message | London, United Kingdom |
| ImprovMX | Forwarding email sent to our @fishes.com.ng addresses to our inbox. Messages are held only until delivered; delivery records (sender, subject, time) are kept for 7 days | Received in France (Paris); ImprovMX is a US company, and delivery may pass through the United States |
| Google (Gmail) and Yahoo (Yahoo Mail) | Our email inboxes, where emails you send to us are kept | Their own data centres, including in the United States |
| GitHub | Source code and build pipeline (no player data) | United States |
Our bot-opponent server (run by us at DigitalOcean in London) plays the bot accounts. For each game a bot plays, it keeps the moves, the result and the opponent’s rating at the time (not the opponent’s handle) and uses them to adjust the bots’ playing strength.
Apple and Google sell Premium subscriptions in their stores. They handle the payment and your store account as independent providers under their own privacy policies (Apple, Google), and send us confirmations of purchases, renewals, cancellations and refunds. When you buy, the app gives the store a random identifier for your Fishes account (not your handle or email) so the purchase can be matched to it.
Transfers outside the United Kingdom: to Germany and Finland (Hetzner, in the European Economic Area) under the UK’s adequacy regulations for the EEA; to the United States and France, as listed above, under the safeguards each provider offers, such as the standard contractual clauses for international transfers with the UK addendum. You can ask us for details of these safeguards.
Why we may use your data (lawful bases)
| Purpose | Basis |
|---|---|
| Your account, games, ratings, chat, tournaments, Premium and its subscription records, account emails | Needed to provide the service you signed up for (our contract with you) |
| Automated moderation, reports and appeals, blocking abuse and cheating, security logs, bot-strength tuning, backups | Our legitimate interests in keeping Fishes safe, fair and working, balanced against your rights; you can object (see below) |
| Keeping subscription and payment records after a subscription ends | Our legal obligations (accounting and tax records) and our legitimate interest in handling refunds and legal claims |
| Answering your emails and requests | Our legitimate interest in responding to you, or our legal obligation when you exercise your rights |
We do not use your data for marketing or advertising, and we do not ask for consent for any optional processing.
Automated decisions
Chat messages, handles and post-game comments are checked automatically before others see them. If the automated check flags something, it is held (visible only to you) or not published, and a handle must be changed. These decisions are made without a person at first. You can appeal any moderation decision in the app, and a member of staff reviews the appeal. Matchmaking and ratings are also calculated automatically, by fixed rules that apply to everyone.
How long we keep data
| Data | How long |
|---|---|
| Account data | While the account exists |
| After you delete your account | Your handle and email are anonymised. Your chat and comments are removed from view. Finished games and ratings are kept, anonymised, because other players’ ratings depend on them |
| Matchmaking searches that did not lead to a game | At present, while the account exists; after you delete your account they stay linked only to the anonymised account. We intend to delete them after 7 days and will update this notice when that starts |
| Moderation originals and decisions | 90 days |
| Reports and appeals | 180 days after they are closed. Unresolved cases are kept until they are resolved |
| Subscription and payment records | For as long as UK tax law requires business records to be kept (at least 5 years after the 31 January online tax-return deadline for the tax year of the payment, so about 6 to 7 years), and for legal claims, then deleted. They are kept after you delete your account, no longer linked to your handle or email |
| Bot-opponent game records (bot server: moves, result and rating, no handle) | At present, kept. We intend to delete them 90 days after the game and will update this notice when that starts |
| Bot-opponent server logs | 30 days |
| Server logs (including IP addresses) | 30 days |
| Email forwarding records (ImprovMX) | 7 days |
| Backups (database) | 14 days on the server and 30 days off-site |
Backups are not edited, so deleted data can remain in them until they expire (at most 30 days). If we ever restore a backup, we apply the deletions made since it was taken again.
Your choices and rights
- Change your settings, avatar and visibility choices at any time, including whether matchmaking may pair you with bot opponents.
- Delete your account yourself (Profile or Me → Delete account), or ask us if you cannot sign in: see Delete your account. See above for what is anonymised and what is kept. Deleting your account does not cancel an App Store subscription: cancel it in your Apple account settings.
- Object to processing based on our legitimate interests, or ask for a person to review an automated moderation decision (in the app, through an appeal).
- Ask for access to, correction or deletion of, or a copy of your data, or object to how we use it, by emailing jibrinsadiq@yahoo.com. We reply within one month (longer only where the law allows it for complex requests, and we will tell you).
- If you are unhappy with our answer, you can complain to the Information Commissioner’s Office (ico.org.uk), the UK data protection regulator, or to the data protection authority where you live (for example in your EU country, or the Nigeria Data Protection Commission in Nigeria).
Changes
We will update this notice before changing what we collect or who processes it, and show the new version date at the top.