Privacy Policy

Who is responsible

Catch Fleet is operated by Meriç Şeker, based in Türkiye, who is the data controller for everything described here. For anything about your data, write to [email protected].

What we collect, and why

• Account details. Your email address, username, and password (stored only as a hash by our authentication provider). Needed to run your account. Legal basis: performing our contract with you.
• Station location. The coordinates you set for your receiver, used to compute catch distances. For most players this is their home. We treat it accordingly: it is never shown publicly and never shared. Legal basis: performing our contract with you.
• Catch history. The aircraft your station hears, with timestamps. This is the game itself. Combined with your station location it can indicate when your receiver was running, which is why the location stays private. Legal basis: performing our contract with you.
• Listener link. Device link codes and helper keys that connect your Listener to your account. Legal basis: performing our contract with you.
• Server logs. Standard technical logs, including IP addresses, kept briefly for security, abuse prevention, and keeping fabricated signals out of the game. Legal basis: our legitimate interest in a fair and secure service. Logs are deleted within 90 days.
• How you found us.If you arrive on a link that carries a campaign tag (for example a post we made on a forum), that tag is saved with your standby request, so we can tell which announcements actually brought operators in. It is a word like "reddit", nothing more, and it is carried in the address bar rather than a cookie. Legal basis: our legitimate interest in knowing which announcements are worth making.
• Traffic analytics. We run a self-hosted, cookie-free analytics tool (Umami) on our own server. It counts page views, referrers, and a few named interaction events in aggregate, such as a copy button being clicked on a Manual setup command. An event carries its name and nothing else: never the copied text, never anything typed. It sets no cookies, stores no IP addresses, and never follows you across other sites. Legal basis: our legitimate interest in understanding how people find the game and where setup loses them.

What we never do

• We do not sell or rent your data. To anyone. Ever.
• We use no advertising networks and no third-party trackers.
• The only cookies we set are the strictly necessary ones that keep you signed in.

What is public

Your username, callsign, Dex, Fleet Log, and patches are visible on your public station page. Distances shown there are computed numbers; your station coordinates themselves are never displayed or exposed.

Who processes data for us

• Supabase Inc. hosts our database and authentication.
• Resend Inc. (United States) sends our transactional email, such as confirmation and invite mail.
• Hetzner Online GmbH (Germany) hosts our servers, including the analytics tool.
• Cloudflare, Inc. (United States) sits in front of the site as its network layer, protecting it from attacks. Requests to the site, including your IP address, pass through it. It also stores our database backups.
• GitHub, Inc. (United States) holds our source code and runs our nightly database backup.

Where a processor handles data outside the EU or Türkiye, the transfer is covered by that processor's data processing agreement and standard contractual clauses.

How long we keep things

Your data stays as long as your account does. When your account is deleted, your personal data is deleted with it, though a backup can still hold it for up to 30 days before that copy is destroyed in turn. Server logs are deleted within 90 days.

Your rights

Under the GDPR, and under Türkiye's data protection law (KVKK, Article 11), you can ask us at any time to:

• see the data we hold about you, and get a copy of it,
• correct it,
• delete it, along with your account,
• restrict or object to how we process it,
• receive it in a portable format.

Write to [email protected] and we will act on it. You also have the right to complain to your local data protection authority: in the EU, the supervisory authority of your country; in Türkiye, the Kişisel Verileri Koruma Kurumu.

You do not have to ask us for the first two. On your Account page, Download my data hands you everything we hold as a JSON file, and Delete account erases your account, your catches, your Fleet Log, your Dex, your station, and your standby request. Deletion is immediate and cannot be undone.

Age

Catch Fleet is for players aged 16 and over. We do not knowingly collect data from anyone younger. If you believe a child is using the service, tell us and we will remove the account.

Changes

If this policy changes, the new version appears here with a new effective date. For significant changes we will tell signed-in players directly.

See also the Terms of Service.