Privacy Policy

Last updated August 11, 2026

Tailwaters is a mobile fishing app for tailwater rivers. This Privacy Policy explains the information the app and website collect, how it is used and shared, and the choices available to you.

Information We Collect or You Provide

• Private guest account: Tailwaters automatically creates a Supabase anonymous user with a random user ID and session tokens. This is a technical identity used to keep your saved preferences, manual river spots, and optional notification records private to the same guest session across ordinary app restarts and updates. You do not provide an email address, password, or social-login identity to enter the app.
• Earlier sessions: Tailwaters no longer offers consumer registration or login. A valid session created by an earlier app version may remain active on the device so existing saved data is not abruptly lost, but the current app provides no new email/password or social sign-in path.
• Dam/tailwater requests: If you request another dam or tailwater in the app, Tailwaters stores the requested name, the email address you enter, your guest user ID, request status, and notification status in Supabase. The request is sent through an email delivery provider to Tailwaters operations.
• Support messages: If you email us, we receive the contact information and content you choose to send.

Location

During first-install onboarding, Tailwaters explains its location features before requesting foreground location permission only when you choose “Share Location.” Choosing “Maybe Later” does not open the operating-system permission prompt. Android declares coarse and fine location permissions; iOS uses when-in-use location copy. The app uses phone GPS through the operating system and the Geolocator library to calculate your miles below the selected dam, show your position relative to river access points, and support river safety context while the app is open.

When a usable phone, approximate, or manually selected location is available, Tailwaters may send latitude, longitude, location source, accuracy, and observation time to Tailwaters Supabase Edge Functions so the backend can return dam lists, live readings, map views, and river context tailored to that location and choose an appropriate fishing spot when the supplied location is off the river. If precise location is denied, unavailable, or disabled, Tailwaters may call the Tailwaters get-ip-location-v1 Edge Function, which uses ipapi.co to estimate a coarse location from your IP address. IP-based location is marked approximate and uses a default accuracy of about 25 miles.

Your selected dam is cached locally and stored in your Supabase guest profile. Manually selected river spots are stored in Supabase under your guest user ID and restored on later app sessions. Tailwaters may also store recent dam lists, live/hourly readings, weather, rules, tips, route geometry, waypoints, and related view-model data locally on your device so the app can reopen with saved data during poor or unavailable connectivity. If you enable push notifications, Tailwaters may store recent derived tailwater presence for phone GPS or manual river spot locations, including dam, river mile, distance from the river corridor, location source, accuracy, and timestamp. Google Maps SDKs may process map viewport, marker, and related map interaction data when map screens or the manual location picker are displayed.

Background Refresh

On supported iOS and Android devices, Tailwaters may periodically refresh the selected dam's live/hourly view data in the background while network is available, using the dam stored locally on your device. Background refresh does not request background location permission and does not collect background location; it refreshes the selected dam feed so cached data is more recent when you reopen the app.

Push Notifications

During first-install onboarding, Tailwaters explains its alert features before requesting push notification permission only when you choose “Allow Notifications.” Choosing “Maybe Later” does not open the operating-system permission prompt. If you enable notifications, Tailwaters stores your Firebase Cloud Messaging registration token, app installation ID, platform, app version/build when provided, permission status, and active guest user ID in Supabase. Tailwaters uses these records for personal tailwater alerts, currently including forecast wadeable windows, forecast rising-water alerts, and National Weather Service weather alerts for dam/tailwater areas where you have recently been seen within 5 miles of the river corridor. Queued notification records may include dam/tailwater, event type, title/body, event timing, delivery status, Firebase message IDs or errors, and, for weather alerts, the NWS alert ID and source URL. Tapping a weather alert notification may open the source alert page in a platform browser sheet or your browser. You can revoke notification permission in your device settings.

Telemetry and Diagnostics

Tailwaters uses an app-owned telemetry layer with Firebase as the current remote telemetry provider. In release builds, Firebase Analytics, Crashlytics, and Performance Monitoring may collect app events, crash diagnostics, performance information, device model, operating system version, app version, timestamps, and related technical data. Allowlisted performance traces measure Tailwaters API, local cache, response parsing, and screen-state application durations using endpoint, outcome, and cache-or-network source labels; they do not include raw response content, latitude, longitude, email, or freeform text. Failed Tailwaters data requests may include endpoint names and limited non-location request context, such as selected dam IDs or time ranges; location request parameters are recorded only as a location-present flag, not as raw latitude and longitude, and request contact/freeform fields such as emails and requested dam names are redacted. App code disables Firebase Analytics, Crashlytics, and Performance collection outside release builds.

Tailwaters does not currently use advertising SDKs, payment SDKs, in-app purchase processing, contacts access, camera access, microphone access, or background location tracking.

Website

The Tailwaters website, including this page, is hosted on Firebase Hosting. We do not currently add web analytics, advertising pixels, or cookies to the static website. Firebase Hosting and related infrastructure may process standard request information such as IP address, browser user agent, request URL, and timestamps to serve and secure the website.

Third-Party Services

• Supabase: Anonymous authentication, protected sessions, guest account metadata, Tailwaters data APIs, Postgres functions, ingestion/orchestration Edge Functions, and the delete-account Edge Function.
• Google: Google Maps SDKs, Google Play distribution, and Firebase services including Hosting, Analytics, Crashlytics, Performance Monitoring, and Cloud Messaging.
• Apple: App Store distribution and Apple platform services.
• Email delivery: An SMTP email provider delivers dam/tailwater request notifications.
• Meta/Facebook: A server-side deletion callback remains available for legacy Facebook-linked Tailwaters accounts.
• Location and public data providers: ipapi.co for approximate IP location fallback, USACE CWMS data, USGS NWIS data, National Weather Service APIs and alerts, Southwestern Power Administration/energy.gov generation information, and AGFC regulation monitoring.
• External websites: In-app reference links may open public resources such as AGFC, USACE, USGS, National Weather Service, Southwestern Power Administration, Google Drive-hosted documents, and Wikimedia-hosted images in platform browser sheets or your browser.

How We Use Information

• Create a private guest identity, maintain its session, and support account deletion.
• Show Tailwaters content for the selected dam and for your current, approximate, or manually selected river position.
• Refresh selected dam data in the background on supported devices.
• Send personal tailwater push notifications if you enable them.
• Operate maps, legal links, public reference links, and app store links.
• Monitor reliability, diagnose crashes, and improve app performance and usability.
• Respond to support requests, prevent misuse, and comply with legal obligations.

Sharing

We do not sell personal information, use it for cross-context behavioral advertising, or share it with data brokers. We share information with service providers only as needed to operate Tailwaters, when required by law, to protect users or the app, or as part of a business transfer such as a merger or acquisition.

Security

Tailwaters uses administrative and technical safeguards appropriate to the information it handles. Guest sessions are stored using platform-protected storage where available, backend access is restricted through authenticated, purpose-built functions, and access to operational systems is limited. No storage or transmission method is completely secure, so we cannot guarantee absolute security.

Retention and Deletion

We keep guest account information only as long as reasonably needed to provide Tailwaters, meet the purposes described above, comply with legal obligations, resolve disputes, and enforce agreements. If you choose Delete Account & Data in the app, Tailwaters verifies your active session and deletes your Supabase Auth user and associated profile, saved-location, request-contact, push, presence, and queued-notification records. A new unrelated guest account is created if you continue using Tailwaters. If you remove Tailwaters through Facebook and request deletion of a legacy account, Meta sends a signed request to a separate Tailwaters Edge Function, which verifies Meta's signature and deletes the associated Supabase account. See Account and Data Deletion for instructions. Some logs, analytics, crash reports, backups, or provider records may remain for a limited time when reasonably necessary for security, legal, operational, or provider-retention purposes.

Your Choices

• You can deny or revoke location permission in your device settings. The app can still use a default or manually selected river spot.
• You can deny or revoke push notification permission in your device settings.
• You can delete your private guest account and associated Tailwaters data from the in-app menu, or follow the account and data deletion instructions.
• Tailwaters does not present a registration or login screen. Signing out is intentionally unavailable because an unlinked anonymous account cannot be recovered after sign-out.
• You can avoid opening third-party reference links if you do not want those sites to receive browser request information.

Depending on where you live and subject to applicable law, you may also request access to, correction of, deletion of, or a copy of personal information associated with you. Email hello@damtailwaters.com to make a request. We may need to verify the request before acting on it; because guest accounts are intentionally unlinked from an email or name, the guest user ID may be needed to locate the account.

Children

Tailwaters is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Changes

We may update this Privacy Policy from time to time. If we make material changes, we will update the date above and provide any additional notice required by law.

Contact

Questions about this Privacy Policy can be sent to hello@damtailwaters.com.