Data collected

Account/identity

• Apple ID token, and optionally name/email if using Sign in with Apple (Apple lets users hide their real email via relay)
• Email address + password if using email sign-in (password itself is never stored by you — Firebase Auth handles it)
• A profile doc (display name) stored in Firestore

Location

• Precise GPS (“when in use” only, never “always”) — used to pin outings, reverse-geocode a place name, and fetch weather
• Stays local by default. Only leaves the device if the user taps Share to Feed — and even then it’s fuzzed to ~1mi unless they explicitly opt into “share exact location” (the hotspot warning)

Photos

• Photos the user selects from their library (via the system picker — no separate photo-library permission is even requested). Stays local unless shared to the feed, in which case it’s uploaded to Firebase Storage

Journal content

• Outing notes, species, fly patterns, catch details — local-only (SwiftData on-device) unless explicitly shared
• Notes-to-self — always local, never transmitted anywhere

Social graph

• Friend relationships/requests and shared posts — stored in Firestore, visible only to the author + their friends (enforced by security rules)

Sub-processors

Service	What it gets
Firebase Auth (Google)	Email/password or Apple credential, for sign-in
Cloud Firestore (Google)	Profile, friends, posts
Firebase Storage (Google)	Shared photos
Apple	Identity token, if using Sign in with Apple
Open-Meteo	Latitude/longitude + date/time, to fetch weather — no account, no auth, but it’s still an outbound data flow worth naming

What you’re not doing

• No analytics or crash-reporting SDKs
• No advertising/tracking SDKs, no IDFA
• No selling or sharing data with data brokers

For app support, email: jkiles12@gmail.com