Privacy notice

Controller

The Firebase and Google Cloud environments, administrative functions, and the info@uistio.fi mailbox are currently accessible only to Juuso Lehestö in his role as the entrepreneur operating Uistio Oy.

Uistio Oy's policy is not to maintain separate user-data spreadsheets, screenshots, exported logs, device backups, or test-device copies outside Firebase/Google Cloud and Google Workspace.

Data we process and where it comes from

Data comes from user input, application usage, the authentication provider and data generated by the service.

Why we process data and the legal basis

Uistio Oy documents its legitimate interests and balances them against users' rights and interests. The basis and scope are assessed for the relevant purpose.

What is private and what is public

Exact catch information and saved fishing spots are private by default. Only content the user chooses to publish is shown publicly. Exact coordinates are not published automatically; public views may show content selected by the user and information limited to a regional level.

Service providers and international transfers

• Firebase and Google Cloud store and process application data. More information: Firebase privacy information and the Google Cloud Data Processing Addendum.
• Google Workspace receives messages sent to info@uistio.fi. More information: Google Privacy Policy.
• Mapbox receives information required to serve map requests. More information: Mapbox Privacy Policy.
• OpenWeatherMap receives the location required for a requested weather result through Uistio's backend. More information: OpenWeather Privacy Policy.
• Apple and Google receive data when their sign-in, store or push services are used. More information: Apple Privacy Policy and Google Privacy Policy.

A provider's role and the safeguard for any international transfer depend on the specific service and agreement. Current service-specific details should be checked in the terms and public privacy information linked above.

Data retention

• User content: until the user deletes it or deletes the account.
• Push tokens: until notifications are disabled, the token becomes invalid, or the account is deleted.
• Support email: while the request is handled and while needed to establish, exercise or defend related rights.
• Security and moderation records: while the incident, report or appeal is active and while needed to prevent repeated abuse.
• Provider logs and backups: according to the applicable provider-controlled deletion cycle after active data is removed.
• Deletion lock: the current implementation retains it without automatic expiry until a bounded rule or documented review cycle is implemented.

After account deletion, the system retains a technical deletion lock containing the user's UID, processing status, and creation and update timestamps. It does not contain catches, photos, notes or exact locations.

On-device storage and offline cache

Firestore offline persistence and authentication data may remain in IndexedDB or application storage on the device. Server-side account deletion does not remotely wipe every device cache. On a shared device, the user should sign out and clear the application data or remove the application. More information: Firestore offline data documentation.

Security

Access to application environments and administrative functions maintained by Uistio Oy is restricted as described above. Authentication, access restrictions and provider safeguards are used to protect the service. No internet-based service is entirely free of risk.

Your rights

Where the conditions of applicable data-protection law are met, users have rights of access, rectification, erasure, restriction of processing, to object to processing, and to data portability for data they provided. Whether a right applies depends on the legal basis and circumstances of the processing.

Send a request to info@uistio.fi. Uistio Oy may request verification of identity or account ownership. It responds without undue delay and normally within one calendar month. More information: data-subject rights.

Account deletion

Deletion is primarily started in the application. The exact path, email fallback, response period and residual technical record are described in the account-deletion instructions.

Automated processing

BiteIndex provides condition-based fishing guidance. It does not make a legal or similarly significant automated decision about a person.

The Uistio website does not use analytics, advertising, marketing tracking or non-essential cookies, so it does not display a cookie-consent banner. If any of these technologies are added later, privacy and consent requirements will be reviewed before release.

Children

Children under 13 may not create a Uistio account. Uistio does not collect date of birth and does not offer a guardian-consent verification flow.

Complaints to the supervisory authority

Users may lodge a complaint with the Office of the Data Protection Ombudsman in Finland if they consider that the processing of their personal data infringes data-protection law. Instructions are available at tietosuoja.fi.

Changes and contact details

This notice is updated when processing, services or legal requirements change. The current version and its effective date will be published on this page. Send privacy questions to info@uistio.fi.