Baitcraft is a fishing game you play on your own. The fishing happens on your device and needs no connection, but the game keeps an account for you, so that a lost phone does not cost you your progress. This policy explains what that account holds, what we never ask for, and how to delete the whole of it.
1Who we are
Baitcraft (the "Game") is published by Symbiot Development OÜ, a private limited company registered in Estonia, of Tartu mnt 67/1-13b, Kesklinna linnaosa, 10115 Tallinn, Harju maakond, Estonia ("Symbiot", "we", "us"). We are the controller of the personal data described in this policy.
This policy covers the Baitcraft application for iOS and Android (identifier com.symbiothub.games.baitcraft) and the website at baitcraft.app. If you have a question about it, or about your privacy rights, write to info@symbiot.dev.
2The short version
The first screen offers you three ways in: sign in with Apple, sign in with Google, or play as a guest. Whichever you choose, we create a player record on our server and your progress is saved to it, so that you can change phone without losing it.
We never ask you for your name, your address, your age or your phone number. There is no password for us to hold, no free text field anywhere in the Game, no chat and no photograph. We run no advertising, no analytics and no tracking of any kind, and we sell nothing to anyone.
Everything we hold is deleted, at once and in full, when you use Delete Account in the Game's menu.
3Your account, and the two kinds of it
An account is what your progress is attached to. It is identified by a random number we generate for it, and by a handle the server assigns, in the form player_ followed by digits. The handle is not derived from you, from your device or from anything either app store told us, and it is not chosen by you.
- A guest account
- Created for you if you choose to play as a guest. It is reachable only by a random ticket stored inside the Game's own storage on that one installation. We hold nothing that could connect it to you: no email address, no name, no provider identity. That is also its cost — it cannot move to another phone, and it does not survive reinstalling the Game. Reinstalling does not delete it either: the ticket goes, so the account it named becomes unreachable by you and by us, and it stays on our server. If you want it gone, delete it in the Game before you uninstall.
- A signed-in account
- Created, or reopened, when you sign in with Apple or with Google. It is reachable by that identity, so it survives a reinstall, a new phone and a long absence, and it can be reached from any device you sign in on. It is kept until you delete it.
You can start as a guest and sign in later, and the Game will ask whether to carry that guest progress onto the account. One account plays on one device at a time: when you open the Game somewhere else, the first device is told so and stops. That is done by a short message on a private channel belonging to your account, and it carries nothing but the fact that another device has opened.
4What signing in tells us
Signing in happens inside Apple's or Google's own sheet. You give them your credentials, never us. They hand back a signed token, we check its signature against theirs, and we keep only what that token carries:
- A provider user identifier
- The opaque identifier Apple or Google uses for you with us specifically. It is what lets you back into your account, and it is different for every developer, so it cannot be used to recognise you anywhere else.
- An email address, if the provider has verified it
- Stored only for one purpose: if you signed in with Apple on one phone and with Google on another, and both carry the same verified address, we take you to the same account instead of stranding half of your progress on a second one. We do not send email to it, ever. There is no newsletter and no mailing list, and it is not shown to anybody.
- A display name, on Apple, once
- Apple hands over the name on your Apple Account the very first time you authorise the Game, and never again. It is stored on the identity record and is currently read by nothing and shown to nobody. It goes when the account goes.
If you use Sign in with Apple, you may choose Hide My Email, and Apple will give us a relay address instead of your own. That works with everything above; we never learn the address behind it. You can unlink an identity from your account in the Game, or revoke the Game's access in your Apple or Google account settings.
5What we hold on your account
Your progress reaches us as a record of what happened, rather than as a copy of your save file, and our server works the numbers out from it. This is what that amounts to.
- The account itself
- Its identifier, its assigned handle, the language you last played in, when it was created, and when a session on it last reached us. The last of those is an operational record — it tells us an account is still in use when we are investigating a fault or an abuse report. Nothing in the Game reads it, and it decides nothing about you.
- Your catches
- A row for each fish you land: the species, the water and country it came from, the kind of rod, its weight and length, whether it was a trophy, when you caught it, and what became of it afterwards — kept in the keepnet, released or sold. Each row also carries a small technical note about the rig and conditions, which our server stores and does not read.
- Your progress and your record
- The points you have earned, from which your level is worked out; the game time you have played; counts of what happened between the catches, such as casts made, bites missed and waters travelled to; and where you are currently camped.
- Your gear and your money
- A row for each delivery of gear and each movement of silver or gold, from which our server works out what you own and what you hold, and a copy of how your tackle is currently rigged, so a second phone opens on the rod you left set up.
- What you have taken and what you switched
- Marks for the lessons you have taken and the hints you waved off, and the switches you set, such as whether you asked for the daily reward reminder. Both are short keys the server merges and never interprets.
- Sign-in machinery
- The identities described above, the ticket the installation used to claim a guest account, and one session record per device you are signed in on. A session record holds no readable token: only a one-way hash of it, so that a copy of our database cannot be used to enter your account.
None of this is written by you in words. The Game has no text field, so there is nothing in it that you typed, and nothing about a real place you have been: a water is a location in the game's own catalogue, not a position on the earth.
6What the Game keeps on your device
The Game plays without a connection, so it keeps its own copy of everything above in its private storage on your device, and hands over what happened the next time it reaches us. Alongside that copy it keeps:
- Your device settings
- Language, measurement units, clock format, sound and vibration switches, scene quality, and whether you dismissed the spot rent reminder. Kept on the device so the Game opens the way you left it.
- Your session
- The tokens that keep you signed in, so that a relaunch, or a month away, does not put you back at the door.
- A local save label and a claim ticket
- Two short random strings generated on your device. The first names your save keys so saves stay separate on one device; the second is what a guest account is claimed with. Neither is a device identifier or an advertising identifier, neither is derived from you or from your hardware, and both are discarded when you delete the account.
- A widget snapshot, on iOS
- If you add the camp widget to your home screen, the Game writes the handful of values the widget draws into a container shared between the two, so the widget can render without opening the Game.
7What we do not do
To be explicit about the things games commonly do and Baitcraft does not:
- No analytics, telemetry, crash reporting, session recording or experimentation tools. Nothing in the Game reports what you looked at or how long you stayed on it.
- No advertising, no advertising identifiers, and no attribution or install-referrer tools.
- No tracking. We do not follow you across other apps or websites, we combine nothing with data from anyone else, and we build no profile of you for advertising. The Game never asks for permission to track, because it has nothing to track you with.
- No location. The Game neither requests nor reads your location. The country you choose in the prologue and the water you fish are choices in a catalogue, not places you have been.
- No reading of your contacts, calendar, health data, files or photos.
- No recording. The Game plays sound; it never listens.
- No purchases, subscriptions or payments of any kind, and therefore no payment or billing data.
- No password. We never see, receive or store one.
- No sale of personal information, and no sharing of it for cross-context behavioural advertising. We have never done either.
- No use of your data to train anything, and no disclosure of it to anyone for their own purposes.
8Why we hold it, and on what legal basis
- To give you the Game you asked for
- Creating and running your account, saving your progress and returning it to you on any device you sign in on. This is necessary to perform our agreement with you (Article 6(1)(b) GDPR); that agreement is our Terms & Conditions.
- To keep the Game working and honest
- Checking that a sign-in token is genuine, keeping one account to one device, limiting how many accounts can be registered from one network in an hour, and deleting guest accounts nobody can reach any more. Our legitimate interest in a service that is not overrun by automated abuse and does not accumulate records for nobody (Article 6(1)(f) GDPR).
- To answer you when you write to us
- Our legitimate interest in supporting the people who play our game (Article 6(1)(f) GDPR), or compliance with a legal obligation (Article 6(1)(c) GDPR) where your message is a legal request.
We make no decision about you by automated means that produces a legal or similarly significant effect, and we do not profile you.
9Your address, and what our server sees
Anything on the internet sees the address your device connects from, and ours is no exception. We do not keep it. The only thing we derive from it is the ceiling on how many new accounts may be registered from one network in an hour, and even that is counted against a shortened form of the address that has then been put through a one-way hash. A row of that counter cannot be turned back into an address, it is attached to no account, and it is discarded as soon as the hour it belongs to has passed.
Our hosting provider keeps ordinary short-lived operational logs of the requests it serves on our behalf, in the way any server does, in order to deliver the service and protect it against abuse. We do not use those logs to build a picture of a player and we do not combine them with your account.
10Permissions the Game asks for
The Game asks for as little as it can, and it stays playable if you refuse everything.
- Notifications
- Used for one local reminder about your daily reward, described below. Refuse the prompt, or turn notifications off later in your device settings, and the rest of the Game is unaffected.
- Network access, on Android
- Used to reach your account, and to open links you tap, such as the store listing, our social pages and this policy. The fishing itself needs no connection.
- Audio settings, on Android
- Used to configure playback of the Game's own sounds.
The Game never opens your camera, your microphone, your photo library, your contacts or your location.
11Notifications
If you allow notifications, the Game schedules one kind of reminder: an early-evening nudge that your daily reward is waiting. Your device schedules and delivers it locally, up to a week of evenings ahead, and it fires whether or not the Game is running.
There is no push server. We do not register a push token, we cannot send you a message, and we cannot tell whether a reminder was delivered or opened. Turning notifications off in your device settings stops them for good.
12When you contact us
The Game offers two support actions, one for reporting a problem and one for suggesting an idea, both also on the app icon's shortcut menu. Each opens your own email application with a message addressed to info@symbiot.dev.
So that a report is useful without a round of questions, the draft is prefilled with three technical details: the Game's version, your operating system and its version, and your device model. It carries nothing about your account. You can edit or delete any of it, and nothing is sent until you press send in your own email application.
When you do write, we receive your message, those details and the address you write from. We use them to answer you and to fix what you reported, and for nothing else. We keep support correspondence for as long as the matter is open and for up to 24 months afterwards, so that we can recognise a problem that comes back, and then we delete it. We do not add you to any mailing list.
13Who else is involved
We use as few other companies as a game with an account can. None of them receives your data for their own purposes, and none of them is paid in data.
- Supabase
- Supabase Inc. provides the database and the server functions your account lives in. It is our processor: it holds this data only in order to run that service for us, on our instructions, under a data processing agreement. The project runs in the European Union.
- Apple and Google, as sign-in providers
- If you sign in, the provider you chose learns that you signed in to Baitcraft, and handles that under its own privacy policy rather than ours. We receive only what is described under "What signing in tells us" above.
- Apple and Google, as app stores
- Apple distributes the Game through the App Store and operates iOS; Google distributes it through Google Play and operates Android. Each may collect data about your download and your device independently of us, and we have no access to it.
- Our email provider
- Handles the support mail you send us, and nothing else.
The Game also bundles open-source software components. They ship inside the application, run on your device and send nothing anywhere. We may also disclose data where the law requires it of us, and we will tell you if we are permitted to.
14This website
baitcraft.app is a static website. It sets no cookies, runs no analytics or tracking scripts, embeds nothing from other companies and has no forms. The language you read is taken from the address you are on, not from anything stored about you.
Like any website, it is served by a hosting provider that may keep short-lived technical logs of the requests it serves, such as an IP address, a timestamp and the page requested, in order to deliver pages and protect the site against abuse. We do not use those logs to identify visitors and we do not combine them with anything else.
15Children
Baitcraft is rated 4+ on the App Store and Everyone on Google Play. It contains no violence, no purchases, no chat and nothing written by other players.
The Game is not directed at children under 13, and we do not knowingly create an account for one. If you are a parent or guardian and believe your child has an account with us, write to info@symbiot.dev and we will delete it. You can also delete it yourself from the device, in two taps, as described below.
16Your rights
Under the GDPR and the UK GDPR you have the right of access, and rights to rectification, erasure, restriction of processing, objection, and portability, as well as the right to withdraw consent where we rely on it. Most of them are answered inside the Game, and take effect immediately:
- To see what is held on your account, open the Game. What it shows you is what we hold; nothing about you is kept back from you.
- To correct it, keep playing. The account follows what you do.
- To erase all of it, use Game Menu, then Delete Account. It is immediate and it cannot be undone.
- To unlink an identity without deleting anything, unlink it in the Game or revoke the Game's access in your Apple or Google settings.
For anything the Game cannot do for you — a copy of your account in a portable form, a restriction, an objection, or a question about any of the above — write to info@symbiot.dev and we will answer within one month. We do not charge for this and we will not ask you for more information than we need to find your account. If our answer does not satisfy you, you may complain to the data protection authority for your own country, or to ours, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).
If you are a California resident: over the last twelve months we have collected the categories identified above — an account identifier and, if you signed in, an identifier and possibly a verified email address and a name from your sign-in provider — for the business purposes described above. We have not sold personal information, we have not shared it for cross-context behavioural advertising, we have disclosed it to no one for their own purposes, and we offer no financial incentive in exchange for it. Your rights to know, delete, correct and opt out are met by the steps above, and we will not discriminate against you for exercising them.
17Keeping and deleting your data
Delete Account, in the Game's menu, deletes the account itself. Everything described under "What we hold on your account" goes with it in one operation — the catches, the coins, the gear, the progress, the sign-in identities and every session — on our server and on the device in front of you. There is no recycle bin, no grace period and no undo, and we keep no backup copy of a deleted account beyond the short window in which our provider's routine database backups age out.
Nothing else deletes an account. There is no inactivity period after which we remove one for you, and none is scheduled. An account you walk away from is kept until you ask us to delete it, and a guest account you walk away from is kept even though the ticket that reached it is gone — which is why deleting it in the Game, before you uninstall, is the only way to be sure it goes. If you have already uninstalled, write to us — though a guest account carries no email address and no name, so there may be nothing we can match you to.
Uninstalling the Game removes everything it kept on your device. It does not delete a signed-in account, which is the point of one — sign back in and your progress is there.
We keep an account for as long as you keep using it, because that is what it is for. Email you have sent us is kept as described under "When you contact us". Step-by-step instructions, and what to do if you can no longer open the Game, are on the deletion page:
18Security
On your device, the Game's data lives in the application's private storage, which your operating system keeps isolated from other applications. In transit, everything travels over an encrypted connection. On our side, the database is encrypted at rest, no table is readable through a public interface, every request has to carry a signed session naming the account it is for, and the database refuses by default anything a request has not proved it may do.
We never hold a password, so there is none to leak. The tokens that keep you signed in are stored as one-way hashes, and each is replaced whenever it is used, so a token that is presented twice is treated as stolen and the whole chain behind it is cancelled.
Device-level security remains yours to manage. Anyone who can unlock your device can reach the Game while you are signed in, and if your device backs itself up to iCloud or to Google, its copy of your save may travel into that backup under those services' own terms.
19International transfers
Your account is stored in the European Union. We are established in Estonia, within the European Union, and we do not transfer your account data out of the European Economic Area in order to run the Game.
Where a provider we use is established outside the EEA and its staff may need access in order to support the service, that access is covered by the European Commission's standard contractual clauses or another transfer mechanism permitted under Chapter V of the GDPR. If you write to us from outside the European Economic Area, your message travels out of your country with it; that is inherent in sending email, and it is limited to what you chose to send.
20Changes to this policy
If this policy changes, we update the date at the top of this page and publish the new version here. A material change, such as a new kind of data or a new recipient, will also be called out in the Game's release notes. Continuing to play after a change means the current version applies to you.
21Contact
Symbiot Development OÜ, Tartu mnt 67/1-13b, Kesklinna linnaosa, 10115 Tallinn, Harju maakond, Estonia. Email info@symbiot.dev.
We are established in the European Union, so no representative under Article 27 GDPR is appointed. We have not appointed a data protection officer; privacy questions reach us at the address above.
22Language
This policy is published in English. Any translation is offered for convenience only, and the English version governs.