Privacy and Personal Data Processing Notice

Data controller

The controller is Elif KARAGÖZ; service address: Topçam Mah. Yazıcıoğlu Cad. Yenikent Sitesi 80B Blok Kat: 7 Daire: 45 60150 Merkez TOKAT; privacy request email: kvkkwavuna@gmail.com. If these fields are not configured, this notice is not ready for publication.

Data categories and collection methods

During registration and use, Wavuna processes identity/account data (username, display name, email, and password hash), profile, session, and security records; live-session verification and the selected public location; Bite, Catch, report, and photo data; follows, likes, comments, saves, blocks, and notifications; moderation/abuse signals; OIDC Community mapping; and optional Fishing Insights data. Data is collected electronically from user input, browser/device features, and service events.

Purposes and legal-basis approach

Account and core product data is processed to provide the service, secure it, fulfill requests, and moderate the community. Depending on the activity, the applicable basis may include contract necessity, legal obligations, and legitimate interests balanced against individual rights. Fishing Insights runs only with separate, optional consent. The controller must verify final legal bases and international-transfer safeguards before publication.

Location and public visibility

Browser GPS is used to verify proximity to water. Successful verification does not by itself decide how a location is published; the user separately selects EXACT, APPROXIMATE, or CITY.

• With EXACT, the verified point becomes the public live-session location.
• With APPROXIMATE, the point is consistently generalized by about 1–2 km; with CITY, only province-level information is shown.
• Fishing Insights consent does not change this visibility setting. Private Insights exact location is temporary during derivation; neither exact location nor Wavuna identity is sent to MET Norway or NASA POWER.

Recipients and transfers

Only data necessary for the service may be shared with the recipient groups below. Wavuna infrastructure is hosted in Bremen, Germany; the hosting provider's identity and appropriate transfer safeguard must be documented before publication.

• Resend: recipient email and message content for transactional verification, password-reset, and deletion emails.
• Wavuna Community / Discourse: OIDC identity and community profile for single-account access; the linked identity is anonymized on deletion.
• MET Norway: only coarse query coordinates for live weather/fishing conditions; no Wavuna identity.
• NASA POWER / MERRA-2: only a coarse environmental grid location for delayed historical enrichment; no Wavuna identity.
• OpenStreetMap/OpenFreeMap and the browser's Web Push service: technical requests for map tiles/fonts or an enabled device subscription; providers may see connection data such as IP address and user-agent.
• Competent public authorities: only where an applicable legal obligation requires it.

Country and water verification — limited pilot

Country verification uses Overture Maps; Turkey uses the existing local water dataset, while the limited foreign pilot uses lakes only. The precise GPS point is evaluated transiently on the server; coordinates, account identity and session tokens are not sent to the external provider. Official STAC/S3 object and range requests may reveal an approximate data region; the provider can observe connection metadata. The full dataset is not downloaded. Source data is subject to ODbL and applicable upstream terms; credits are linked from verification and session pages. Boundaries are approximate data geometries, not a guarantee of legal sovereignty, fishing permission, safety or complete water coverage. The foreign pilot supports only lakes within reliable land-country coverage and EXACT/APPROXIMATE sharing; CITY and open sea are unsupported. Busy, ambiguous or unavailable source data cannot authorize a new start. Fishing Insights collection consent does not replace this verification.

Retention and deletion

Data is kept for the life of the relevant account/content and as needed for security or legal requirements. Auth sessions expire after seven days, verification/reset links after one hour, and deletion links after 30 minutes. Fishing Insights exact location is removed when derivation completes and no later than seven days; environmental cache entries are cleaned after seven days. A minimal non-identifying deletion-operation record is kept for at least three years. Final log and backup retention periods are not yet configured as policy.

Security

Wavuna uses secure HttpOnly session cookies, authorization checks, rate limits, private analytics tables, media-metadata removal, and a controlled deletion procedure. No technical control can guarantee absolute security.

Rights and requests

Subject to applicable law, you may have rights to learn whether data is processed; request information and recipients; learn whether use matches the purpose; seek correction, erasure/destruction, and recipient notification; object to solely automated adverse analysis; and seek compensation for unlawful processing. Use /privacy/requests; the Delete Account button does not replace these rights.