BirdTrout

Privacy

BirdTrout is a map of trout water and bird cover. It knows your email address, the spots you save and a handful of settings. That is the whole list, and this page explains each one.

Last updated 22 August 2026 · dotonesix llc, Michigan

You can use most of BirdTrout without an account at all. Open the map, read the water temperatures, save spots — none of that requires signing in, and until you do, everything you save lives in your own browser and never reaches us.

What we collect, and why

Your email address

If you make an account, we store your email address. It reaches us one way: you choose "Continue with Apple" or "Continue with Google", and Apple or Google tells us your address after you approve it. We ask for your email and basic profile only — not your contacts, calendar, Drive, or anything else. Apple lets you hide your real address behind a relay, and that works here.

The email address is the account. It is how your saved spots find you on a second device, and it is how we would reach you if something about the service changed. There is no password anywhere in BirdTrout, so there is no password for us to store or for anyone to steal. We do not send marketing email; if that ever changes, it will be something you opt into, not out of.

The spots you save

A saved waypoint is a name, a latitude and longitude, any notes you typed, and a note of what kind of thing it was (a dropped pin, a stream, a campground). Signed out, those live only in your browser's local storage. Signed in, they are also written to our database so the spot you saved standing in the river is on the laptop when you get home.

We understand what these are. A list of the places someone fishes or hunts is about as personal as a map gets. They are yours: no other account can read them, we don't aggregate them into anything, we don't sell them, and they are not part of any analytics event.

Your settings

A dozen small preferences travel with your account: your home place (the name and approximate coordinates of the town or spot you set as home), whether you're in fishing or hunting mode, which states you picked, which species you're after, which basemap you like, and whether you've been through the setup questions. They exist so a second device opens into your map rather than into a stranger's default.

Your location, if you offer it

Tapping the locate control asks your browser or your phone for a position fix, and it asks you first. Say no and everything else on the map still works.

The full-accuracy fix never leaves your device. It is used in the page, and only in the page: to move the camera to where you are, to work out which watershed you're standing in, and to rank the water within a couple of hours' drive of you. None of that is written down and none of it is sent anywhere.

What does leave is rounded first, to two decimal places — about a kilometre, which is a town rather than a street. That happens once, at the point where a position becomes your home place, and everything downstream uses the rounded version. There are exactly three things that see it:

• Our database, if you have an account. Your home place is one of the settings that syncs, so it is stored against your account — that is how a second device opens into your map.
• Nominatim (OpenStreetMap), to turn the rounded position into the name of a town, so your home has a name on it instead of "Dropped pin".
• OSRM, as the starting point for drive times to streams, so the list can tell you that one river is twelve minutes away and a better one is fifty.

Rounding costs those three nothing: a town's name is a town's name, and a drive time from a kilometre away is the same drive time. It is done because a coordinate good to the metre is a home address, and none of them need one.

Saved waypoints are a separate thing and are not rounded — a spot on a river is only useful if it is the actual spot. Those are yours, described above, and they are never sent to Nominatim, OSRM or anyone else.

Where it lives

Supabase holds the account and the synced data — the email address, the waypoints, the settings — in a Postgres database in the US East (Northern Virginia) region. Every table has row-level security switched on, which means the database itself refuses to return one person's rows to another person's session, rather than trusting our code to remember. Supabase also runs the sign-in flow and issues the session token your browser holds.

Vercel hosts the site: the map, the data files, the pages. Like any web host it processes the requests your browser makes, which includes your IP address in its ordinary server logs. We don't build anything on top of those logs.

Third parties BirdTrout talks to

The map is assembled in your browser from several public sources. Some of these your browser contacts directly, which means those services see your IP address the same way any website you visit does. None of them are sent your email address, your waypoints or your notes.

• Google — only if you choose Google sign-in. Google tells us your email; we tell Google nothing about what you do here.
• Supabase — accounts, database, sync.
• Vercel — hosting and analytics.
• Open-Meteo — air temperature and the weather forecast, requested for map coordinates, never for you.
• USGS — live gauge readings for water temperature and flow, requested by gauge number.
• CARTO and ArcGIS Online — the basemap and satellite tiles under everything.
• OpenStreetMap Nominatim — turns a place you type in the search box into coordinates, and turns your home place back into the name of a town. What you type goes to them, and so does your home place, rounded to about a kilometre.
• OSRM — drive times from your home place to a stream. Your home place goes to them, rounded to about a kilometre; nothing that identifies you does.

Analytics

We use Vercel Analytics, which is cookieless and aggregated: page views, and a short list of events like "someone exported a GPX file". Every event is filtered before it leaves the browser — strings, numbers and booleans only, nothing free-text, no coordinates, no waypoint names, no notes, no email address. The point is to know that a feature is used, not who used it. There are no advertising or cross-site tracking scripts on this site, and no third-party ad cookies.

We also keep a small count of our own, in our own database, and it exists to answer one question: of the people who find a river or bird page through a search engine, how many go on to open the map. Each row is a step — "a page was read", "the map was opened", "someone signed in" — tagged with an anonymous id described under Cookies and storage below, and with the kind of page it happened on ("a river page", "a bird page"). Never the address of the page, never a referrer, never a coordinate, never anything you typed. Nobody outside this project can read that table, and nothing in it is shared with anyone.

What we don't do

• No ads, anywhere, and no ad networks embedded in the page.
• We do not sell your data, and we do not share it with anyone beyond the infrastructure providers listed above — the ones that have to see it to store it or serve it.
• We do not publish, share, or show your saved spots to other users.
• We do not build a profile of you or buy data about you from anyone else.
• We would only hand data to law enforcement if we were legally required to, and we have never been asked.

Your rights

These aren't ceremonial. Here is how each one actually works today.

• See it. Everything we hold about you is visible in the app: your email in the drawer, your spots in the saved list, your settings in the controls that set them. There is nothing behind the curtain.
• Export it. The saved-spots list exports to GPX or GeoJSON, which opens in Garmin, onX, Gaia, CalTopo and most everything else. If you want your settings and account record too, email us and we'll send you the rows.
• Correct it. Rename or move a waypoint in the app and the change syncs. For your email address, email us.
• Delete it. Deleting a waypoint deletes it. To delete the whole account — email address, spots, settings, all of it — open the drawer, tap your email address to open the Account section, and tap Delete account. We ask twice, then it happens immediately: your waypoints, your settings and your account record are erased, and any device you are signed in on signs out. Export your spots first if you want to keep them; once it's gone we can't get it back.

It is a real delete, not a flag on a row we keep. Nothing is queued, nothing waits on a person reading an inbox, and there is no grace period during which we still have it. If the button is not working for you, email us from the address on the account and we'll do it by hand.

Cookies and storage

Three things get stored in your browser, and none of them is a tracker.

The sign-in session. When you sign in, Supabase stores a session token so you stay signed in between visits. Sign out and it's cleared. If you never make an account, this never exists.

Local storage. Your saved spots, your preferences, and a small cache so the map opens where you left it. This is your browser's own storage on your own device — clearing your browser data clears it. Signed out, this is the only copy; signed in, it's a mirror of what's in the database.

An anonymous id. Sixteen random bytes, generated in your browser the first time you arrive and kept in that browser's own storage. It is random rather than derived: it is not made from your address, your device, your email or anything else about you, and by itself it identifies nobody. Its only job is to let us tell "one person read a page and then opened the map" apart from "two people did two unrelated things", which is a question about the site rather than about you. It never leaves this domain, is never sold or shared, is not used for advertising, and clearing your browser data replaces it with a new one.

Retention

Your spots and settings stay until you delete them or delete your account. We don't expire them, and a spot you saved four seasons ago should still be there. Deleting a waypoint marks it deleted immediately so an offline phone can't resurrect it, and the row is cleared out afterwards. Deleting your account removes your email address along with everything else.

Kids under 13

BirdTrout isn't for children under 13 and we don't knowingly collect anything from them. This isn't a judgement about who should be on a river — it's that collecting a child's email address and the coordinates of where they go carries obligations under COPPA that a product this small is not set up to meet. Take your kids fishing; use your own account. If you believe a child under 13 has made an account, email us and we'll delete it.

Payments

BirdTrout is free today and there is no payment processing running. If paid tiers arrive, card details will be handled entirely by Stripe — we would never see or store a card number — and we'll update this page before that goes live, not after.

Changes to this policy

We can change this page. If a change actually affects you — new data collected, a new company involved, a different use for something we already hold — we'll email the address on your account before it takes effect. Wording fixes and clarifications we'll just make, and the "last updated" date at the top will move.

Contact

Questions, requests, or something on this page that doesn't match what you're seeing: andrew@dotonesix.com. A person reads it.