Privacy Policy
Last updated: 7 October 2026
The short version, for young spotters
- We ask how old you are, and keep only your age group, never your birthday.
- If you're under 13, you pick a nickname from ones we make up, and we never ask for your email.
- Your score is private unless you're 13 or over and choose to show it.
- Under-13s can't post comments, and nobody sees your name in public.
- To keep your account for good, or to get a prize, a grown-up has to say yes first.
- We never sell your information, and there are no adverts.
- Grown-ups can see, download or delete what we hold at any time: fishspotter.app/parent.
Who we are
FishSpotter is operated by Plant Ecology Beyond Land (PEBL) CIC, a Community Interest Company registered in England and Wales (company number 12076622). Our registered office is PO Box SA29JA, 29 Glan Yr Afon Road, Sketty, Swansea, United Kingdom, SA2 9JA. Our contact email is hello@pebl-cic.co.uk and our website is pebl-cic.co.uk.
We are the data controller for the personal data described in this policy, and the operator of FishSpotter for the purposes of the US Children's Online Privacy Protection Act (COPPA). We process data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and the ICO's Age Appropriate Design Code (the Children's Code).
What data we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Age group (under 13, 13 to 17, or 18 and over) | Applying the right protections for your age (see Children) | Legal obligation (Children's Code); legitimate interests in keeping children safe |
| Email address (13 and over only) | Account creation, login, transactional emails | Contract (UK GDPR Art. 6(1)(b)) |
| Display name, or for under-13s a nickname chosen from names we generate | Showing you your own score; the leaderboard and comments, where your age and settings allow | Contract |
| Hashed password (13 and over only) | Authentication (bcrypt; your plain-text password is never stored) | Contract |
| Quiz answers (species guesses, timestamps) | Score calculation, streak, community identification statistics, ecological research | Contract; Legitimate interests, generating anonymised, aggregated species-distribution datasets for UK marine biodiversity science (Art. 6(1)(f)) |
| A parent or carer's email address (for a child's account or prize) | Asking for, recording and managing their consent | Legal obligation (COPPA, Children's Code); legitimate interests |
| Postal address (prize winners only) | Posting the prize | Contract; for a child, the parent's consent |
| Comments you post on clips (13 and over only), and any comment you report | Running the discussion threads; improving clips, tracking overlays and our species catalogue; moderating the service | Legitimate interests, operating a community identification service and keeping it safe (Art. 6(1)(f)) |
| IP address | Rate-limiting and abuse prevention (held in memory only; never persisted; cleared on server restart) | Legitimate interests, preventing abuse and protecting service availability |
| Server access logs (IP, User-Agent, request path, timestamp) | Security, debugging, abuse prevention | Legitimate interests |
| Cookies and device storage (see Cookies section) | Keeping you signed in; remembering your age group in the current tab; stable personalised feed ordering | Strictly necessary (session, age group); Consent (functional) |
| Anonymous usage events (session start, clips viewed, active watch-time) | Showing our funder the project engages people; improving the app | Consent (analytics), only if you choose "Accept" on the banner, and never for accounts that are under 13 or have not told us their age |
We do not collect payment data, precise device location, photos, audio, or any special-category data. We do not use your data for advertising or profiling.
Server access logs are generated and retained by Vercel, our hosting sub-processor, in accordance with Vercel's own log-retention period; we do not maintain a separate persistent copy.
For the quiz-answer research processing carried out under legitimate interests, PEBL maintains a Legitimate Interests Assessment and a Data Protection Impact Assessment, available on request. Research outputs use only pseudonymised or aggregated data, in line with the safeguards for scientific research processing under UK GDPR Art. 89.
How we use your data
- To authenticate you and maintain your account.
- To calculate your points, streak, and leaderboard rank, and to show you your own rank when your score is private.
- To aggregate quiz answers in anonymised form so the community can see identification trends per clip.
- To send transactional emails (account verification, password reset, and messages to parents about their child's account or prize) via our email processor, Resend.
- To post prizes to winners who ask for one.
- To support ecological research into UK marine biodiversity by PEBL CIC as part of our community-benefit mission. Any research outputs use aggregated, anonymised data only.
Automated processing of community identifications
We use automated processing to aggregate community identifications. When three or more users independently submit the same identification for a clip that has no reference answer, our system records a community consensus and may retroactively award points to those users. This affects only your score within the game and has no legal or similarly significant effect on you, so it is not solely-automated decision-making of the kind restricted by UK GDPR Article 22.
Children
FishSpotter is used by people of all ages, including children at home and at school. We ask everyone their age group before they play, and what we collect and show depends on the answer.
| Under 13 | 13 to 17 | 18 and over | Not told us yet | |
|---|---|---|---|---|
| Name they play under | A nickname they pick from names we generate | Their chosen name | Their chosen name | Their chosen name |
| Their own email address | Never collected | Optional | Optional | Optional |
| Public leaderboard and profile | Never | Off unless they switch it on | On unless they switch it off | Hidden until they answer |
| Posting comments | No | Yes | Yes | Not until they answer |
| Optional emails (weekly digest, new clips) | No | Only if they opt in | Only if they opt in | No |
| "Streak about to end" reminders | No | No | Only if they opt in | No |
| Usage analytics | No | With consent | With consent | No |
| ID-guide chat (AI) | No | No | Yes | No |
| Keeping the account on more than one device | A parent or carer's consent | Their own email | Their own email | Their own email |
| Receiving a prize | A parent or carer's consent | A parent or carer's consent | Yes | Not until they answer |
We ask for an age group, not a date of birth, and the answer cannot be changed in the app. If a wrong option was chosen, email us.
Children under 13
A child under 13 can play without giving us their real name or any way to contact them. We keep only their nickname (which they choose from our generated list, so it cannot be their real name), the species they identify and when, their points, and a cookie that keeps them signed in on their device. We use these only to run the game for them. We do not ask for their name, email address, location, photos or contact details, and nothing about them is shown publicly.
To keep a child's account beyond the device they are using, or to post them a prize, we need their parent or carer's consent:
- The child gives us a parent or carer's email address. We use it only to ask for consent.
- We email the parent a notice explaining what we keep, why, and who can see it, with a link to agree or say no.
- If the parent agrees, we email them again the next day to confirm, with a link to change their mind.
- If the parent says no, or does not answer within 14 days, we delete their email address and the request.
A parent who has agreed can use the parent page at any time to:
- see the information we hold about their child and download a copy;
- sign their child in on another device;
- stop us collecting any more information, by withdrawing consent;
- delete their child's account and everything in it.
We never disclose a child's information to anyone other than the service providers listed below, who handle it only on our behalf, and we never make it public.
Children aged 13 to 17
Teenagers can create their own account with their own email address. Their name is kept off the public leaderboard, their profile page and comments unless they choose otherwise, and they get no "streak about to end" reminders. We ask them to check with a parent or carer before signing up. We will not post a prize to anyone under 18 until a parent or carer has agreed by email, and we then arrange delivery with the parent.
If you think a child gave us information without permission
Tell us at hello@pebl-cic.co.uk and we will delete it.
How long we keep children's information
We keep children's information only as long as we need it for the reasons above:
- A parent's email address on a request that is not answered: deleted when the request expires after 14 days.
- A parent's email address on a request they decline: deleted straight away.
- An under-13's account (nickname, identifications, points): kept while it is used, and deleted after 12 months with no identifications, or as soon as a parent asks or withdraws consent.
- A parent's email address on a consent they gave: kept for as long as the child's account (for an account consent), or until 90 days after the prize is posted (for a prize consent), so that we can show consent was given and handle any delivery problem.
- A prize winner's postal address: used only to post the prize and deleted within 90 days of posting. For a child, we get it from the parent, never the child.
- A school email address on an account that had not told us its age: we emailed the account once to explain these rules, and remove the address on the date given in that email (14 days later). The account's progress stays.
These deletions run automatically every day, apart from postal addresses, which are handled by email and deleted by our staff.
Third-party processors
We share data only with the processors listed below, each under a contract that requires them to protect your data and to use it only on our instructions:
| Processor | Role | Location | International transfer mechanism |
|---|---|---|---|
| Vercel | Application hosting and edge delivery | US | UK International Data Transfer Agreement (IDTA), incorporated into the Vercel DPA, layered with the EU Standard Contractual Clauses (Commission Decision 2021/914) |
| Supabase | Database and video/thumbnail file storage | West EU (AWS eu-west-1, Dublin, Republic of Ireland), personal data stays within the EU/EEA | No transfer outside the UK/EEA |
| Resend (Plus Five Five, Inc.) | Transactional email delivery, including emails to parents | US company; our sending region is the EU (AWS eu-west-1, Dublin, Republic of Ireland) | UK Extension to the EU-U.S. Data Privacy Framework (UK-US Data Bridge), under which Resend is certified, and the EU Standard Contractual Clauses (Commission Decision 2021/914) as amended by the UK Addendum, both in the Resend DPA |
| Anthropic | ID-guide chat (processes user-typed free-text questions), for users aged 18 and over only | US | UK International Data Transfer Agreement (IDTA), Standard Contractual Clauses |
Where we transfer personal data outside the UK, we rely on an appropriate safeguard under UK GDPR Article 46 (such as the UK-US Data Bridge, the UK International Data Transfer Agreement, or the UK Addendum to EU Standard Contractual Clauses), as noted per processor above.
We also read publicly available ecological data from iNaturalist, GBIF, and OBIS to populate the species photo cache and probability data. We do not send them any information about you.
We do not sell your data. We do not use advertising networks or social-media tracking pixels.
Cookies
We use the following first-party cookies and browser storage:
| Name | Type | Duration | Purpose | Consent |
|---|---|---|---|---|
| NextAuth session | Strictly necessary | Until sign-out, or after 7 days without a visit (90 days for a guest player, who has no email or password to sign back in with) | A signed, HTTP-only token that keeps you authenticated. For a child, this is the persistent identifier that keeps their game on their device; it is used for nothing else | Exempt from consent under PECR Reg. 6(1) |
fishspotter:ageBand |
Strictly necessary | Until you close the tab (sessionStorage) | Remembers the age group chosen in this tab, so a child's answer cannot simply be changed by going back | Exempt from consent under PECR Reg. 6(1) |
| fs.anon_seed | Functional / preferences | ~12 months | Stable, personalised feed ordering for anonymous visitors (deterministic shuffle that stays consistent across page loads) | Covered by the consent banner |
pebl_consent |
Strictly necessary | ~12 months | Records your cookie-consent choice so we do not ask you again on every visit | Exempt from consent under PECR Reg. 6(1) |
fishspotter:sid |
Analytics (functional) | Until you close the tab (sessionStorage) | A random per-tab id used only to count anonymous usage (see below). It is not a cookie and does not follow you between visits | Set only with your consent (Accept) |
The fs.anon_seed cookie is a functional cookie, not strictly necessary, so it is covered by the consent banner shown on your first visit; we only set it where consent permits. You can withdraw your consent for functional cookies at any time by clearing your cookies or by using the cookie controls on the site.
Anonymous usage measurement
With your consent (the Accept option on the banner), we record a small amount of first-party, anonymous usage data so we can show our funder, the National Lottery Climate Action Fund, that the project is engaging people. We measure only: when a viewing session starts, which clips are viewed, and how long clips are actively watched. We deliberately do not store your IP address, device or browser details, your location, or any identifier that follows you between visits. We do not use third-party analytics, advertising networks, or social-media tracking pixels. If you choose Essential only, none of this is recorded. Nothing is recorded for a signed-in account that is under 13 or has not told us its age, whatever the banner says, because a child under 13 cannot give this consent. You can withdraw consent at any time by clearing your cookies/site storage.
How long we keep your data
- Account data (email, display name, hashed password, age group): retained while your account is active and for 24 months after your last sign-in, after which we prompt you or delete it. Children's information follows the shorter rules in Children.
- Quiz answers linked to your account: retained for the same period as your account data.
- Comments you post: retained for the same period as your account data, and deleted with your account. Comments are public to other spotters who have identified the same clip. If your leaderboard visibility is switched on and you are 13 or over, they are shown with your display name; otherwise (the default for spotters aged 13 to 17, and always for anyone who has not told us their age) other spotters see an anonymised handle instead, though PEBL staff can still identify you internally to moderate the service. Records of moderation decisions (for example that a comment was hidden, and why) may be kept for a reasonable period after deletion where we need them to meet our legal obligations.
- Anonymised aggregates derived from quiz answers: retained indefinitely for ecological research purposes; they cannot be used to identify you.
- IP addresses: held in memory only, never persisted, cleared on server restart.
- Server access logs: retained by Vercel, our hosting sub-processor, per Vercel's log-retention period (see "What data we collect and why").
- Survey footage (the underwater video clips): scientific data collected by PEBL CIC in the field and retained indefinitely. Clips do not contain personal data.
Separately, if you make an erasure request, we will respond and delete your personal data within 30 days. (This is our response time, not a retention period.)
How we protect your data
Data is encrypted in transit, passwords and emailed links are stored only as one-way hashes, and access to personal data is limited to the PEBL staff who run the service. We keep a written security programme for children's information, review it at least once a year, and choose service providers who commit in writing to protecting the data they hold for us.
Your rights under UK GDPR
You have the right to:
- Access, request a copy of the data we hold about you (available at /api/account/export when signed in, or by emailing us). Parents can do this for a child on the parent page.
- Rectification, correct inaccurate or incomplete data.
- Erasure, ask us to delete your account and associated personal data (Art. 17). You can do this yourself from your account settings, or email hello@pebl-cic.co.uk with the subject "Erasure request".
- Portability, receive your quiz answers in a machine-readable format.
- Object, object to processing we carry out under legitimate interests (for example, the research use of quiz answers, or abuse-prevention use of your IP address and access logs). If you object, we will stop that processing unless we can show compelling legitimate grounds that override your interests, rights, and freedoms, or that the processing is needed to establish, exercise, or defend legal claims.
- Restrict processing, ask us to pause processing while a dispute is resolved.
Where processing relies on consent (the fs.anon_seed functional cookie, usage analytics, and a parent's consent for a child), it can be withdrawn at any time through the site's cookie controls, by clearing your cookies, or for a parent on the parent page; this does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, email hello@pebl-cic.co.uk. We will respond within one calendar month.
Complaints
If you have a concern about how we handle your data, please contact us first at hello@pebl-cic.co.uk with the subject "Data protection complaint". We will acknowledge your complaint within 30 days and tell you what we are doing about it. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
Changes to this policy
If we make material changes, we will update the "Last updated" date above and, where appropriate, notify you by email. If a change would let us collect or use a child's information in a new way, we will ask their parent or carer again first.