Privacy Policy

General information, not legal advice. Last updated November 14, 2026.

In short

• The app works without an account, and everything stays on your device until you sign in.
• If you sign in, we store your email, synced waters, settings and catches, general location (a ZIP, never GPS), trips, alert rules and push subscriptions. Nothing else.
• An exact catch location is private unless you choose to share it. Push and email alerts are off unless you turn them on.
• If you turn it on, you can share anonymous fishing results (no account, no location) to help improve the bite outlook. It is off by default.
• We never sell your data, show ads or track you for ads, and keep no continuous location history.
• You can export or delete everything we have for you at any time, in Settings → Account.

The sections below give the details.

About this policy

This policy covers TexCast Fishing (texcastfishing.com), a free web app for Texas anglers. It shows live river flows, lake levels, tides, weather, TPWD trout stocking schedules and boat ramps, and helps you plan fishing trips. It is built and run by one person; questions go to hello@texcastfishing.com.

The app works without an account. Signing in is optional and only syncs your saved waters, trips, catches and alerts across your devices. This page says exactly what we store when you do, why, who else handles it, and how to delete it.

What we store, if you create an account

Everything in TexCast Fishing works on your device without an account. If you choose to sign in, we store only what each feature needs:

• Email address — to sign you in and, if you enable them, send alerts.
• Synced waters, settings and catches — My Waters, appearance/tackle/craft preferences, and your catch log, so they carry over across devices.
• General location — the ZIP you type in Settings and an optional town name, so Home, distances and trip planning work on your other devices. It is never your device's GPS position and never a street address. Clear it in Settings to stop using it; deleting your account deletes it.
• Trips — the trips you plan: dates, the waters, parks and ramps on each day, where you're staying, your checklist and your notes, so they carry over across devices.
• Alert rules — the trout-stocking and conditions alerts you've turned on.
• Push subscriptions — the endpoint your browser gives us so we can deliver a push alert you asked for. Not usable by us for anything else.

Trips and share links

Trips work on your device without an account. If you sign in, they sync to your account so they're on all your devices.

• Private by default. Where you're staying, your notes and your checklist are only visible to you. They are never included in a shared link.
• Share links are opt-in. A trip is only shared if you create a link for it. The link shows a read-only view with just the trip name, dates and each day's waters, parks and ramps (with any times or activities you added).
• You can revoke a link at any time. "Stop sharing" on the trip turns the link off right away; deleting the trip turns it off too.
• Deleted with your account. Deleting your account deletes all your trips and their share links. "Export my data" includes your trips.

Google user data (Sign in with Google)

Signing in with Google is optional; you can use an emailed sign-in code instead. If you choose Google, we ask for only the openid, email and profile scopes (the basic sign-in permission, your email address and your basic profile).

• What we receive from Google: your email address, whether Google has verified it, a Google account ID, and the link to your Google profile picture. Google also offers your name with the profile scope; we do not store it.
• Why: to sign you in and to match you to the same TexCast account if you also sign in with an emailed code. Your email is also where alerts go, but only if you turn email alerts on. The picture link is used only to show your picture in your account circle in the app; if it is missing or fails to load, we show your initial instead.
• How it is stored: in our database on Cloudflare, protected by HTTPS, and kept until you delete your account (Settings → Account → Delete my account).
• Who sees it: only us and the processors that run the service (see below). We do not sell it, share it with advertisers, use it for ads, or use it to train AI or machine-learning models, and no one reads it except to fix an account problem you ask about.
• Sharing and transfer: we do not transfer or disclose Google user data to third parties for any purpose other than providing TexCast Fishing, and the only parties that handle it are the processors named below.
• Protection: it is encrypted in transit (HTTPS), your sign-in session lives in an HttpOnly cookie, and the database sits with Cloudflare; see Security below.
• AI and machine learning: Google user data is not used to develop, improve or train any AI or machine-learning model.
• What we never do with it: use it for targeted, personalized, retargeted or interest-based advertising; sell or transfer it to data brokers or information resellers; use it to decide credit-worthiness or lending; use it to train any AI or machine-learning model; or build a database from it for any other purpose.
• What we do not touch: we do not read your Gmail, Drive, Contacts, Calendar or any other Google service, and we never copy your picture, only its link.

To stop TexCast from using your Google sign-in, delete your account in Settings, and you can also remove TexCast Fishing at myaccount.google.com/permissions.

TexCast Fishing's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Only what is listed here

We store only what this policy lists: what you save in your account if you create one, the anonymous fishing results if you turn them on, and the short-lived records under Retention. Nothing else is collected or kept about you. Anonymous fishing results are not tied to your account.

We use none of it for ads or ad tracking, and we never sell your data, to anyone, for any reason.

Opt-in only

An exact catch location (map pin) is only stored if you turn sync on for that catch and choose to share its location — it's private by default, even with an account. Push and email alerts are also off unless you turn them on.

Anonymous fishing results

Settings has a switch, Share anonymous fishing results. It is off unless you turn it on, and it works without an account.

When it is on, each time you log a new catch or a trip with no catch, TexCast sends one small record to our server:

• whether you caught fish, how long you fished (a range) and the species;
• the water (a public lake, river or coastal water), the month, and the time of day as a number of hours before or after sunrise;
• the conditions, rounded: water temperature, whether the air pressure was falling, steady or rising, cloud cover, wind and moon phase.

That is all that is sent. Nothing else goes with it, and the record is not tied to you, your account or your catch log. The record itself carries no IP address; like any request to our server, your IP address appears in Cloudflare's request log for up to 7 days (see Retention).

Why: to learn which conditions fish bite in, so the bite outlook can be based on Texas results and not guesses. We only use results in groups large enough that no single trip can be picked out.

Deleting: because a record is not linked to you, we cannot find it again, so we cannot export or delete it for you. Turning the switch off stops anything more being sent. Records are kept for as long as the bite outlook uses them. Your own catch log, in your account and on your device, is separate and can still be exported and deleted in Settings → Account.

We never sell these results or use them for ads.

Who processes this data

Cloudflare hosts the app and stores account data (a database and a small cache). Resend delivers sign-in code and alert emails. Cloudflare Turnstile runs a short check that you are a person before an email code is sent; it sees your browser and network details for that check, and TexCast does not store them. Google is a sign-in provider if you choose "Sign in with Google". None of them uses your data for anything beyond providing TexCast Fishing. Cloudflare also stores the anonymous fishing results described above. Cloudflare Web Analytics counts visits to our pages, in totals only, such as how many people open a page and which sites send them. It sets no cookies and is not used for advertising or to follow any one person.

Weather, map and gauge services

To show conditions, TexCast asks public services for data. Your browser asks the National Weather Service, Open-Meteo (forecasts), NOAA (tides, buoys and river forecasts) and Esri (map pictures, only when you open a map) directly, and USGS (river and lake gauges) through our server. These services see your IP address and the place being asked about. For the weather on Home, that place is your general location, rounded to about a mile; for a water page, it is that water. TexCast sends them no account, name or email, and does not use them for advertising.

Where a visit came from, and videos

Link tags. Links we share on YouTube, Bluesky and Facebook can end in tags such as utm_source=youtube. When a visit starts from a tagged link, the page sends those tags to our server once per browser session so we can count how many visits each place sent us. The count keeps only the two tags and the day. It carries no account, device id, cookie, page or IP address (your IP address appears in Cloudflare's request logs like any request, and in the short-lived anti-abuse counters under Retention). It cannot be tied to you, so it cannot be exported or deleted for you. Visits from untagged links are not counted this way.

Videos. Some water pages show a TexCast video. The page loads a saved picture from our own site; YouTube is contacted only if you tap play, and then the video plays from YouTube's privacy-enhanced address (youtube-nocookie.com). YouTube's own privacy policy applies to that playback.

App errors and problem reports

When the app breaks, it can send us the error message, the page it happened on (with ids removed), the app version and the time. It does not send your name, an account, your location or a device id, and the report itself carries no IP address (the short-lived anti-abuse counters under Retention do see it). Turn this off any time in Settings, Your data, Send crash reports.

If you use Report a problem, we receive what you type, the page and the app version, and an email address only if you choose to give one so we can reply. We use it to fix the problem and to reply, and for nothing else.

Cookies

We set one cookie: a sign-in session cookie, and only if you sign in. There are no advertising or tracking cookies. Cloudflare Web Analytics is cookieless.

Push notifications

Push alerts are off until you turn them on. If you do, your browser gives us a push endpoint that we use only to deliver the alerts you asked for. Turn them off in Settings or in your browser at any time. Email copies of alerts are also off until you switch them on in Settings → Notifications; they go to your sign-in email and you can turn them off there at any time.

Retention

• Sign-in codes and sessions are deleted automatically once they expire.
• Rate-limit counters (anti-abuse bookkeeping) are deleted after 1 day.
• Alert delivery logs are kept for 90 days, then deleted.
• App error reports and problem reports are kept for 60 days, then deleted.
• Anonymous fishing results are not linked to anyone and are not deleted on a schedule (see above); the rate-limit counters above cover abuse control for them.
• Requests to our API (the page asked for, the time, your IP address and browser details) are logged by Cloudflare for fixing problems and stopping abuse, for up to 7 days.

This runs as a daily automated purge — no one has to ask.

Delete or export your data

From Settings → Account, "Export my data" downloads every row we have for you as a single file; "Delete my account" permanently removes every row tied to your account. Both are available at any time, with no waiting period. Deleting your account removes it from our servers; what is saved on your own device stays there until you erase it in Settings → Your data.

Children

TexCast Fishing is not directed to children under 13, and we do not knowingly collect information from them.

Security

Data is sent over HTTPS and stored with Cloudflare. Sign-in codes expire quickly and your session lives in an HttpOnly cookie. No system is perfectly secure, which is one reason we collect so little.

Changes

If this policy changes, we will update this page and the effective date below. If we ever change how we use Google user data, we will tell signed-in users in the app and update this page before the change takes effect.

Effective date

This policy is effective November 14, 2026.

Questions

Contact hello@texcastfishing.com.