Privacy Policy

Who we are

Bamba! is a fishing companion app made by AAR Studios in South Africa. Under the Protection of Personal Information Act (POPIA) we are the "responsible party" for the information described here. For anything at all about your data - questions, corrections, deletion, or a complaint - write to privacy@bambafish.com and a human will answer.

What we collect, and whether you have to give it

To have an account: your email address, a display name and a username. These are required - without them there is no account to attach anything to. Everything else is yours to choose: the catches, spots, notes, gear and photos you create; your date of birth (which stays on your phone and is never sent to us); and your location, which is optional and only used while the app is open. If you decline location, the map, the weather and the Guide still work - you just have to tell them where you are instead of them knowing.

What we do NOT collect

We do not sell your data. We do not show adverts. We do not track you across other apps or websites. We do not read private messages, because the app deliberately has none. We do not upload your date of birth. Your precise location is used on your device to draw maps and fetch weather; the only places we store are the spots you choose to save.

Why we collect it

Your account details identify you and let your catches follow you to a new phone. Your fishing content is the app - it is what you came here to keep. Crash reports tell us what is broken. Anonymous usage counts ("a catch was logged") tell us which features are worth building on. We use your information for these purposes and no others, and we will ask you again if that ever changes.

Who else sees it

Anything you share to the Community feed is visible to other signed-in anglers - that is the point of sharing, and it is off by default and per item. Nothing else is shown to other users. Behind the scenes we use a small number of service providers who process data on our behalf: Supabase (database, accounts and photo storage), OpenAI (checks community posts for harmful content), Sentry (crash reports) and PostHog (anonymous usage). They are bound to use it only to provide those services.

Your information leaves South Africa

You should know this plainly: our database and your photos are hosted in Ireland, in the European Union, not in South Africa. POPIA allows this where the destination has comparable protection, and the EU's GDPR is generally regarded as equal to or stronger than POPIA. Our other providers are also based outside South Africa. If you would rather your information stayed in the country, the honest answer today is that it does not, and you should decide about the app on that basis.

How long we keep it

Your account and its content stay until you delete them. Deleting your account removes your profile, catches, spots, trips and posts. Crash reports are kept for 90 days and anonymous usage counts are aggregated and not tied to you. Backups roll over within 30 days, so a deletion may persist in a backup for a short while after it disappears from the app.

Your rights

POPIA gives you the right to ask what we hold about you, to have it corrected, to have it deleted, to object to how we use it, and to complain to the Information Regulator. You can delete your account yourself in Settings, at any time, without asking us. For anything else, email privacy@bambafish.com. We do not charge for any of this and we will not make it difficult.

Anglers under 18

You need to be at least 13 to have an account, because the app has a community feed. If you are under 18, a parent or guardian should know you are using Bamba! and should be comfortable with it - there is a page for them at the address in the footer, and it takes two minutes to read. Accounts belonging to under-18s get safer defaults: faces in photos you share are blurred automatically, and you have to tap a face yourself to reveal it. We ask your date of birth once, we keep it on your phone, and we never send it to anyone.

Keeping it safe

Everything travels encrypted. Our database enforces row-level security so one angler cannot read another's private content, and photos are served through short-lived signed links rather than public URLs. Community posts pass through four separate checks before they appear. No system is perfect, and if your information is ever accessed by someone who should not have it, we will tell you and the Information Regulator as soon as we reasonably can, as POPIA requires.

Changes

If we change how we handle your information in a way that matters, we will say so in the app rather than quietly updating this page. The date at the top always tells you when it last changed.