Privacy policy

The short version

• You can browse waters, guides, shops, gear and stories without an account.
• We run no third-party analytics or advertising trackers, and our own measurement uses no cookie.
• Ads are matched to the page you are reading, never to you.
• We do not sell your personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.
• Where we need an IP address to stop abuse, we store a keyed hash of it, not the address.
• Location, camera and editing details are removed from photos before we store them.
• You can download your account data, and delete your account with a 7-day change of heart.

Who we are

Legendary Fly Gear is operated by Legendary Fly Gear LLC, a New Jersey limited liability company. We run this website and decide how the personal information described here is used (in UK and EU terms, the controller).

We do not publish a postal address yet. To ask about this policy or your data, use the contact form. A person reads every message and replies by email.

Your account

An account lets you post to the community, save trips and listings, rate restrooms, message businesses and manage email. Sign-in is handled by Supabase Auth with your email address and a password. Your password goes to Supabase, which keeps it in hashed form; we never store or see it. Password-reset emails come from the same sign-in service.

When you sign up we store:

• your email address and the display name you choose;
• an angler profile: a handle, display name, short bio, home region, preferred species and fishing styles, and whether the profile is public or private;
• your safety settings: who may comment on your posts or mention you, and whether your home region is hidden (when it is, it is kept only in your private preferences, not on the public profile).

Optional, private choices you can make on the account preferences page:

• “Show me more of” choices, such as women-led guides and trips, beginner-friendly or family-friendly trips, or veteran and military programs. They change what we show you first. They are never inferred, never required, never used for ads and never shown to anyone else.
• Self-identifying as a veteran, service member or military family. Nobody is asked to prove it. It stays private unless you switch on the profile badge, which is labeled “Self-identified”. It is never used for ads.

Your email address is never shown on your profile or posts.

Community posts, groups and profiles

When you use the community we store what you create and do there: posts and trip stories, comments, likes, follows, friend requests, blocks, mentions, group memberships and the notifications sent to you. Before you publish, you choose who sees each post: Public, Followers, Friends or Only me.

• Public trip stories and short reports also get their own page on Fish Tales, which anyone can read and search engines can index. Other audiences stay in the feed and are never indexed.
• Group owners and moderators can see who is in their group and can remove members or hide posts in it.
• If you report something, the member you report is not told who reported them. Reports and moderation decisions are kept so the team can act on them.

The community guidelines explain audiences, blocking, reporting and appeals in full.

Photos you upload

Photos you add to posts, restroom ratings, business listings and ads are checked on our server before they are stored: we read the real file type from the file itself and remove location, camera and editing metadata (Exif, including GPS, XMP and IPTC). Only JPEG, PNG and WebP are accepted.

• Community photos live in private storage. A photo on a public trip story is served from a public address only while the story stays public.
• Restroom photos stay private to you and our team until a person on the team approves them.
• Business logos and photos are reviewed by our team before they appear on a listing; we keep who uploaded each one and the rights statement they confirmed.

Fly and insect photo identification

The photo identification tool sends your picture to Google’s Gemini service only if the tool is switched on, you are signed in, and you tick the box confirming that you agree and that you are 16 or older; our server refuses the request without that confirmation. Before the photo leaves our server we remove its embedded metadata, including location (GPS) and camera details, and if a photo cannot be cleaned we do not send it at all. Google receives the cleaned photo and any features you ticked in the tool, not your name, email address or account details. We do not store the photo. Google’s own terms apply to what it receives, and its free-tier terms may allow it to use submitted content to improve its products. To limit use of the tool we count requests per account and per keyed hash of your IP address each day.

Restroom ratings and reports

Rating a restroom, answering a question about one, adding one, attaching photos or asking us to review something is open to signed-in community members who have confirmed their email address through us and accepted the community guidelines. The confirmation link we email you works once, within 7 days. We record when you confirmed and which version of the guidelines you accepted.

• We store your rating and answers, the day of your visit, any note and photos, and that they came from you.
• Published ratings show the visit day and what you said, never your name or the time.
• If you add a restroom, the position you give or share becomes that restroom’s public location after review. We keep a record that you added it.
• Requests to remove a rating, note, photo or restroom are seen only by you and the team; the person whose content you reported is not told it was you.

Trip plans and your location

The trip planner works without an account. Signed out, your trips (up to 50, plus a draft) are kept only in this browser’s local storage and never reach us. Gear checklist ticks are kept the same way.

Signed in, a trip you save is also stored in your account (up to 50), with its days, budget notes and sharing setting. A trip is private unless you mark it shared; then anyone with its link can read it, without seeing who you are.

“Near me” and location

Some tools offer “Near me”. Your browser asks your permission first. The position is used to answer that one search (for example, nearby places or river gauges) and is not stored or logged by us. To find gauges near a point, our server may ask the U.S. Geological Survey for gauges in an area around it; nothing that identifies you is sent. When you type a place name instead, our server looks it up with the Photon geocoding service, sending only the words you typed.

Email updates and alerts

We only send email updates you ask for, and only after you confirm. When you sign up anywhere on the site we email a confirmation link first (it works for 7 days); nothing else is sent until you click it.

With the sign-up we store your email address, the topics you chose (and any details they need, such as a water and flow level, or a state), where on the site you signed up, the exact consent sentence you saw and when, and a keyed hash of your IP address used to limit repeated sign-ups. If you were signed in, the subscription is linked to your account.

Topics you can choose: Water flow alerts, Hatch and season alerts, Destination updates, New Fish Tales, Gear guides and checklists, Learning articles, Community digest, Women's trips, clinics and groups, Veteran and service member programs, Business updates and New-page notes for waters you asked for.

Flow alerts and hatch and season alerts can be set up now; the alert emails themselves start soon. We keep your choices so they work from the first send.

• Every update and alert email has an unsubscribe link that works in one click, and a link to change your topics instead.
• If an email bounces or is marked as spam, our email provider tells us and we stop sending to that address.
• Account emails you cannot switch off while you have an account: sign-in and password emails, confirmations, and notices about your messages, claims or listing.

Asking us to add a water

When a search finds no page for a river or lake, we count the cleaned-up name with its state or country, so we know which waters to add. That record is about the water, not you: it holds no IP address, email or account. To keep the counts honest we use short-lived counters keyed by a keyed hash of your IP address.

If you also ask to be told when the page is added, that is an ordinary email sign-up with the confirmation step above, and we send one note when the page goes live.

Messages through the contact form

When you write to us through the contact form we store your name, email address, subject and message, the page you wrote from and any listing it is about, a keyed hash of your IP address for rate limits (cleared after 30 days), and your account if you were signed in. A simple spam check runs on every message; messages it flags are kept for a person to look at but are not emailed on. We reply by email.

Messages with businesses

Signed-in members who have confirmed their email address can send an enquiry, a booking request or a message to a claimed business, and the business can reply. Messages are text only.

• We store each conversation: who it is between, the listing, the messages and when they were sent and read, and for requests your trip dates, party size, experience and any quote. Your phone number is stored only if you give it.
• The business (its owner and the staff it adds) sees your name, your messages and trip details, and your phone number only if you give it. Your email address is shared with the business only when it confirms a booking with you, so you can arrange payment; then you also get the business’s contact details.
• Our team does not read conversations in general. A person sees a message only when it is held for checking (until a business has replied to you, your first conversation and any message of yours with a link, email address or phone number) or when someone reports it.
• Blocks and reports are kept so they keep working and so the team can act on them. The person you block is told only that the conversation is not available.
• Email notices about new messages say who wrote and about which listing, never the message itself.
• Businesses can keep a customer list of the anglers who booked with them, with notes, and owners can export it. They must use it only for those bookings.

You can export your conversations from Messages.

Businesses, claims and verification

Listings

Guide and shop listings are built from public sources: open map data (Overture Maps and OpenStreetMap), public license boards, public registers such as SBA VetCert, and the business’s own website. That can include a business’s phone number, website and location and, for sole traders, a name. Where a business publishes an email address we may keep it to invite them to claim the listing; it is never shown on the site.

We may email a listed business about its listing, at most three notes, in sends started by a person on our team. Each carries a one-click unsubscribe, and an address that unsubscribes, bounces or complains is not written to again. Our email provider may tell us whether these messages were delivered, opened or clicked. To correct or remove a listing, or your name in one, use the correction form.

Claims and business accounts

To claim a listing you give your name, your role and an email address, optionally a phone number, and you agree to the Terms of Service (we record the version and when). You prove you run the business in one of four ways:

• An email on your business’s own website domain. We send a 6-digit code to an address on the same domain as the listing’s website (never a free mailbox such as Gmail or Outlook). The right code approves the claim at once, unless someone else already has a claim open on that listing; then a person on our team decides.
• The email address the listing publishes. A code to that address. It is approved at once by the same rule only when that address and your own email are both on the listing’s own domain; otherwise a person on our team checks it.
• A document. Signed-in members only; the claim uses your account’s email address. A person on our team checks it and approves or declines, with a note you can see.
• A phone call back. A person on our team calls the phone number on the listing.

A code works for 24 hours. A code or call-back claim that is not completed expires after 48 hours, one waiting for our email to be switched on after 14 days, and a document claim after 30 days. We keep a log of each step of a claim. Anything you tick about the business on the claim form is shown only after the claim is approved, labeled “Self-reported by the business”; veteran ownership always needs a person on our team to approve it. Business accounts store the team members, listing details, logos and photos you add.

Ownership and verification documents

For a claim we accept a business license or registration, a utility bill or lease in the business name at the listing address, a state guide or outfitter license, or an IRS EIN letter. For the Verified badge we accept a state guide or outfitter license, a certificate of insurance, a U.S. Coast Guard captain’s license, an NPS commercial use authorization or USFS special-use permit, or a business license; instead of a license copy you can give us the license number and state and we look it up on the board’s own site.

• We never ask for a DD-214 or any other military record. Veteran ownership comes from the SBA VetCert register, the business’s own website, or what you tell us on the claim.
• Black out bank account numbers, Social Security numbers and tax ID digits before you upload. We only need the business name and address, or the license holder and dates.
• Files must be PDF, JPEG, PNG or WebP, up to 10 MB. We remove location and camera metadata from images; PDFs are stored as you sent them and never opened by our software.
• Files are kept in private storage. Only Legendary Fly Gear operators can open them, through a link that lasts 5 minutes, and every time one does is logged. They are never shown on the site, and you can withdraw a file while it is waiting.
• We delete the file as soon as the claim or verification is decided (approved, declined, withdrawn or expired). We keep only what type of document it was, its file name, the outcome, who decided and when. A file nobody has checked within 30 days is deleted anyway, and an upload that never reached a claim or verification is deleted after a day.
• If the badge needs a certificate of insurance, you can ask your insurer to issue it naming Legendary Fly Gear LLC as the certificate holder. That is free and standard; it does not make us a party to your policy.

If a claim is declined, expires or is withdrawn, after 180 days we remove your name, email, phone, account link and the notes about it, including the file names of its documents; only the document type and outcome stay.

Verification and the Verified badge

For a Verified check we record the business’s license details (type, number, issuing state and board) and its liability insurance carrier and expiry date, who asked and who checked, and the outcome, with a history of changes. The public sees only the licensing board, its lookup link and the date we checked; license and policy numbers, carriers and our notes are never public.

Advertisers and payments

Businesses that advertise give us a business name, website, contact details and billing email. Prepaid credit is bought through Stripe Checkout, and approved accounts may be invoiced by Stripe. Card details go to Stripe, not to us; we keep the Stripe customer reference and a ledger of credits, charges and refunds. Paid plans for guides and shops are not on sale yet.

How we measure use of the site

We measure how the site is used with our own simple counter, not Google Analytics or any other third-party tool. It records page views, time actively spent on a page, how far you scrolled, searches and how many results they found, and clicks on listings, tools and outbound links (including which outside website a link went to). For your first page in a visit it records only the kind of site you came from (such as a search engine), never the full address.

• A visit is tied together by a random id kept in this tab’s session storage. It is not a cookie and disappears when you close the tab.
• To tell first visits from return visits, your browser also keeps a random value in its local storage (lfg-visitor). That value never leaves your browser: each page view only says “new” or “returning”. It is not a cookie, is not linked to your account, and you can clear it with your browser’s site data at any time.
• We look at how visits move through the site (which page a visit starts and ends on, the order of the pages in between, and whether it reached something like contacting a business) to improve the site. These reports never show a name, address, IP address or search words.
• If you are signed in, events are also linked to your account, so we can count active members. The link is removed if you delete your account.
• Search terms are stored with email addresses, phone numbers and map coordinates removed. Page addresses are stored without their query strings.
• Your IP address is not stored with events. A keyed hash of it is used in counters that limit abuse, which are deleted after 2 days.
• Known crawlers and automated tools are not recorded, and our own team’s console is never tracked.

Ads

Sponsored placements are chosen by the page they sit on: its water, destination, state, trip type, gear kit, month, nearby airports, and whether you are on a phone or a computer. They never use your account, preferences, self-identification, history or location.

• Views and clicks are counted so advertisers can be billed, using a hash of the visit id above (cleared after 30 days), or for clicks a keyed hash of your IP address. Those click checks are deleted after about a day.
• How often you have seen an ad is counted in this tab’s session storage only.
• Advertisers see totals by placement and page, never who saw or clicked.

See the ads policy for what can be advertised.

Affiliate and outbound links

Some retailer links on gear checklists are affiliate links that pass through our /go redirect. We record the retailer, the checklist item and the page you came from, never your name, email, IP address or account. Once you reach the retailer, it and its affiliate network (Amazon Associates, AvantLink and Impact) may set their own cookies under their own privacy policies. See the affiliate disclosure.

Content loaded from other services

A few things on the site load straight from other services, so your browser contacts them and they receive your IP address and browser details, as with any website:

• Maps: street maps from OpenFreeMap and US satellite imagery from USGS The National Map. Satellite imagery outside the US (Esri) and Google’s map view appear only if we switch them on.
• Videos: the preview image comes from YouTube’s image server when the page loads. The YouTube player itself (the privacy-enhanced youtube-nocookie.com version) loads only after you press play, except for a sponsored video, which starts muted once it is half on screen unless your device asks for reduced motion or data saving.

Public agency data such as river flows is fetched by our server, so those agencies do not see your visit.

Cookies and browser storage

We use no advertising or analytics cookies, so there is no cookie banner. These are the only cookies the site sets, and each is needed for something you asked for:

The site also keeps a few things in your browser’s own storage. They stay on your device and are not sent to us unless described above:

Do Not Track and Global Privacy Control

Some browsers send a “Do Not Track” or Global Privacy Control signal. We do not sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or profile people to make decisions about them, and we do not let other companies track you across websites through our site. So there is nothing for those signals to switch off, and the site works the same either way. If that ever changes, we will update this policy first and honor Global Privacy Control as a request to opt out.

Security and abuse prevention

To keep the site safe and the counts honest we limit how often forms, sign-ups, reports, posts, messages and clicks can be used. Where those limits need to know it is the same visitor, we use a keyed hash of the IP address, which cannot be turned back into the address without our secret key. Forms carry a spam check. Database tables are locked down so members can read and change only what is theirs.

When a browser reports that a page broke our content security rules, we log only the rule, the blocked website and the page path: no query strings and nothing about you. Server errors are logged without request headers, cookies or query strings.

Our hosting provider keeps standard request logs (which include IP addresses) for a short period to run and protect the service. No system is perfectly secure; if a breach affects your personal information, we will tell you and the authorities as the law requires.

Who processes data for us

We use service providers to run the site. Each handles personal information only to do its job for us, under a contract that requires it to protect that information. We do not sell personal information to anyone.

Businesses you contact get what is described in messages with businesses. We may also disclose information when the law requires it, to protect people’s safety or our rights, or to a business that takes over the site, which would have to keep this policy’s promises. Map tiles, video previews and some product photos load directly from other services, as described in content loaded from other services.

How long we keep things

These periods are built into the site:

Our retention schedule for other information: measurement events, up to 24 months; contact form messages, up to 2 years; email sign-ups that were never confirmed, up to 30 days; business records such as advertiser invoices, ledgers and verification records, up to 7 years where tax, accounting or legal reasons require; conversations with businesses, for as long as both accounts exist (see below for what happens when you delete yours); moderation records, as long as needed to keep the community safe. When you delete your account we delete or anonymize your information within 30 days, apart from these legal records.

Downloading your data

Signed in, open Privacy & your data to download a JSON file with your account details, angler profile, posts, photo records, comments, likes, follows, friend requests, blocks, notifications, saved items, saved trips, email subscriptions, preferences, group memberships, restroom contributions, enquiries, messages and bookings with businesses, contact form messages and reports you filed. It contains only your own records. You can make one export every 24 hours. Photos are listed by their storage location rather than included in the file.

Deleting your account

You can delete your account at any time from Privacy & your data.

• At once: your posts, comments and likes are hidden from everyone else.
• For 7 days: you can cancel and everything comes back exactly as it was.
• After 7 days: a nightly job removes your account, profile, posts, photos and their files, comments, likes, follows, notifications, saved trips, preferences, email sign-ups, contact form messages, and restroom ratings and photos.

Some records stay, with the link to your account removed:

• listing claims you made and moderation records keep only an id;
• measurement events stay, without the link to your account;
• restrooms you added stay, without your account;
• in conversations with businesses, your messages are replaced with a note that you deleted your account and your name becomes “Deleted angler”; your phone and email are removed from the business’s records, but the business keeps an anonymous record of the enquiry or booking. A copy a business already exported is its responsibility; ask it directly.

If you want anything else removed, tell us through the contact form.

Your rights

Wherever you live, you can see and download your data, correct your profile, delete your account and stop any email.

US states, including New Jersey

Privacy laws in New Jersey and other states (such as California, Virginia, Colorado, Connecticut, Texas and Oregon) give their residents rights over personal data. We offer these to everyone in the US, whether or not a law requires it:

• to confirm whether we process your personal data and to see it;
• to correct it and to delete it;
• to get a copy in a portable format;
• to opt out of the sale of personal data, targeted advertising and profiling that leads to decisions with legal or similarly significant effects. We do none of these, so there is nothing to opt out of today;
• to withdraw consent you gave, at any time;
• not to be treated differently for using these rights;
• to appeal if we turn down a request (see how to use your rights and appeal).

We do not ask for sensitive data as those laws define it, such as health, religion, racial or ethnic origin, sex life or sexual orientation, status as transgender or nonbinary, citizenship or immigration status, biometric or genetic data, financial account details, or precise geolocation. Photos we store have their location removed, and “Near me” positions are not stored. Your optional preferences and veteran self-identification are not sensitive data under these laws, but we treat them as if they were: you opt in, they stay private, and they are never used for ads.

The categories of personal data we process are those described on this page: identifiers and contact details (such as email address, name and phone), account and profile details, what you post and the messages you send, how you use the site, the places you choose, and, for businesses and advertisers, business, verification and billing details. We use them for the purposes described in each section. We disclose them only to the service providers and businesses described above.

California

Under the CCPA as amended by the CPRA you have the right to know what personal information we collect and how we use it, to get a copy, to have it deleted or corrected, and not to be treated differently for using these rights. We do not sell personal information, and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of. We do not use sensitive personal information to infer characteristics about you.

UK and European Union

Under the UK GDPR and the EU GDPR you have the right to access your personal data, have it corrected, have it erased, restrict or object to how we use it (including use based on our legitimate interests), receive it in a portable format, and withdraw consent at any time without affecting what happened before. You can complain to the UK Information Commissioner’s Office or your local data protection authority, though we would like the chance to put things right first.

The reasons we rely on: providing the service you asked for (your account, community, trips, messages and enquiries); your consent (email updates, photo identification, optional preferences and self-identification); our legitimate interests (measuring use, security and abuse prevention, building the directory from public sources, contacting listed businesses and checking business claims); and legal obligations (advertiser billing records).

You do not have to give us any personal data to browse. An email address and password are needed for an account, and the details on a form are needed for what that form does; without them we cannot provide it. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing. Automatic spam checks can hold a message or contribution, and several reports can hide one, but a person on our team makes the decision.

How to use your rights and appeal

Most rights are one click away on Privacy & your data and your profile settings. For anything else, including data not linked to an account (such as an email sign-up or a business listing), use the contact form. Requests are free.

• We may need to confirm the request comes from you, for example by replying to the email address involved. We only use what you give us for that check to handle the request.
• An authorized agent can make a request for you with your written permission; we may ask you to confirm it.
• We answer within 30 days. If a request is complex we may take longer where the law allows (up to 45 more days under US state laws, or two more months in the UK and EU), and we will tell you why.

Appeals

If we turn down your request, in whole or in part, we will explain why. You can appeal within 60 days through the contact form (subject “Privacy appeal”). A different person on our team will review it and tell you the result, with reasons, within 45 days. If we still turn it down, you can complain to your state attorney general (in New Jersey, the Division of Consumer Affairs), or in the UK or EU to your data protection authority.

Children

Legendary Fly Gear is for people aged 16 and over. You must be at least 16 to create an account, and the site is not directed to children under 13. Sign-up does not ask your age, and we do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, tell us through the contact form and we will delete it.

Where your data is stored

We are based in the United States, and the services above store and process data in the United States and may do so in other countries. If you are in the UK or EU, your data is transferred outside it; where it is, we rely on safeguards such as the standard contractual clauses our providers offer, or a provider’s certification under the EU-U.S. Data Privacy Framework and its UK extension.

Changes to this policy

When the site changes what it collects or how it uses it, we will update this page and the date at the top. If a change is significant, we will say so on the site and email account holders it affects before it takes effect. We will not use personal data already collected for a new purpose that is not compatible with the one we told you about without asking for your consent.

Contact us

Questions, requests or complaints about privacy: use the contact form and we will reply by email. Legendary Fly Gear LLC does not publish a postal address yet; when it does, it will appear here. See also the terms of use.