Privacy Policy
This Policy explains how we collect, use, store, share, and delete information related to PokiFish - Cardcha (the “App”). By using the App or this website, you acknowledge this Policy. If you do not agree, please stop using the services.
1. Controller & contact
The App and this website are operated by Chun Wa Creative Limited (Hong Kong).
- Privacy / support contact: WhatsApp +852 5639 8929
- Website: https://pokifishcard.youroldbest.com/
2. Scope
This Policy applies to:
- the PokiFish - Cardcha iOS App;
- the official website at
pokifishcard.youroldbest.com; - cloud services used directly for App features (account sync, media storage, AI identification, and content moderation).
It does not cover third-party websites you may open from the App (for example external encyclopedia links) or their separate policies.
3. Information we process
3.1 Account & identifiers
- Firebase user ID (UID);
- display name and 7-digit friend code;
- sign-in method: Sign in with Apple, Google Sign-In, or anonymous Traveler mode;
- Apple/Google sign-in flows may request name and email scopes from the identity provider; the App’s profile model primarily stores UID, display name, and gameplay settings.
3.2 Gameplay & user-generated content
- fish-card data (nickname, story, stars, rarity, preferences);
- photos you capture or upload (primary images, attachments, custom body references, swim art);
- PokeOcean layouts, inventory, coin balance, and progress;
- public or semi-public social content in the Public Ocean / friend oceans (released spirits, likes, traps, treasure interactions).
If you enable “Record GPS for live captures,” precise latitude and longitude become private data on that fish card. They are stored on your device and synced to Firebase with your account. Only the card owner can view this location; it is not included in the Public Ocean, friend oceans, card sharing, or gift-card data.
3.3 Permission-related data
- Camera: to capture ocean-creature photos and, on supported devices, optional LiDAR/AR length measurement;
- Photo Library read: to choose attachments or custom-body references;
- Photo Library write: to save physical-card exports;
- Location while using the App (optional): only after you enable “Record GPS for live captures,” the App asks for iOS location access and requests a one-time location when you use the live camera shutter. The App does not continuously track you or use background location. Photos selected from the library never record GPS;
- Local notifications: for example custom-body job completion or failure alerts.
The location option is off by default, and denying location does not prevent manual card creation. When a location is available, the App may use Apple geocoding services to derive a locality name. Google Maps opens only when the card owner actively taps the capture location. The App does not use location or ATT for advertising tracking.
3.4 Optional science-contribution data
“Contribute de-identified catch data” and “Record GPS for live captures” are separate options and are both off by default. If you separately consent to science contributions, eligible first-party live captures upload a research record through Firebase. It includes species ID, rarity, type, capture date and, when available, a locality name, an approximately 1 km grid coordinate, and precise latitude and longitude. Our operational system links the record to a UID and card ID so that we can verify consent, process deletion, and prevent duplicates. Those internal identifiers are not displayed as public player fields.
Imports from the photo library, Public Ocean catches, and friend-ocean trap catches do not create science-contribution records. The data is currently stored in the operator’s Firebase environment for internal aggregation of species-distribution hotspots and is not automatically sent to external research organizations. If data is later provided to marine research or conservation organizations, we will limit it to research/conservation purposes and apply appropriate data minimization and access controls.
3.5 Purchases & subscriptions
- App Store / StoreKit transaction identifiers, product IDs, and subscription status;
- server-side purchase/subscription records used to grant entitlements (for example Pro+, coin packs, physical-card products).
3.6 Physical-card order contact details
If you request physical-card printing support, you may provide recipient name, phone number, and address. These details may be sent through WhatsApp so our support channel can fulfill the order conversation. Please avoid sharing unnecessary personal data.
3.7 Technical & security data
- Firebase App Check / device attestation signals used to reduce abuse;
- basic service logs and error records required to operate cloud features (processed by infrastructure providers).
4. Sources
- information you provide directly (sign-in, card creation, uploads, order support);
- device data after you grant permission (camera, photos, optional location, notifications);
- identity providers (Apple, Google) and App Store commerce systems;
- data generated by our backend to operate features (friend codes, moderation status, sync manifests).
5. Purposes
- create and maintain accounts, sessions, and cross-device sync;
- deliver core gameplay: cards, oceans, store, friends, and Public Ocean;
- show a private capture location and map link when you choose to enable it;
- with your separate consent, aggregate marine-species distribution hotspots for future research and conservation uses;
- run optional AI fish identification and upload moderation (for example aquatic-content checks);
- process in-app purchases, subscription entitlements, and anti-abuse controls;
- respond to support requests, physical-card printing communication, and security incidents;
- comply with law, enforce terms, and protect users and the operator.
6. Sharing & processors
We do not sell your personal information. To operate the App, we may share necessary data with the following processors, who may use it only to provide their services:
- Apple: Sign in with Apple, App Store / StoreKit purchases, Core Location, and optional locality-name lookup;
- Google: Google Sign-In; Google Cloud Vertex AI / Gemini for optional fish identification and image moderation; Google Maps when you actively open a capture location;
- Firebase (Google): Authentication, Cloud Firestore, Cloud Functions, App Check, private card sync, and consented science-contribution records. Science records cannot be read directly by the App client and are limited to authorized administrative access;
- Cloudflare: R2 object storage and related Worker/CDN delivery for private and public media;
- WhatsApp (Meta): when you contact support or submit physical-card order details via WhatsApp.
These providers have their own privacy policies and processing terms. We use them only as needed to deliver App features.
7. Public & social content
- M79 Public Ocean: content you release publicly may be visible to other signed-in users (for example nicknames, stories, card details, moderated images).
- Friend oceans: mutual friends may see friend-ocean content and related interactions you share.
- Moderation: public uploads may first pass AI content checks; rejected media is not shown as approved public content.
GPS coordinates and science-contribution records are not published as player-visible fields in the Public Ocean, friend oceans, card sharing, or gift cards.
Do not post personal information in public fields that you do not want other players to see.
8. International transfers
The App relies on cloud services that may operate in multiple regions (including Firebase / Google Cloud and Cloudflare). Your information may therefore be processed or stored outside Hong Kong. We use provider contracts and access controls to keep processing limited to what is needed for the service.
9. Retention
- account and cloud gameplay data: retained while your account remains active, or until a valid deletion request is completed;
- private fish-card GPS: retained with the relevant card and account data and processed when that card or account is deleted;
- science-contribution records: retained until you delete contributed data, disable science contributions (which triggers deletion), or delete your account;
- Traveler mode: primarily stored on-device; if an anonymous cloud session is created, related server records are handled as needed for operations and security;
- Public Ocean and social content: may persist while content remains public or linked to other players’ records;
- purchase and accounting records: may be retained longer where required by law or for fraud prevention / support;
- support / WhatsApp correspondence: retained as needed to complete your request.
10. Security
We use reasonable technical and organizational measures such as cloud access controls, App Check, authorized access to private media, and HTTPS in transit. No method of transmission or electronic storage is completely secure.
11. Your rights, consent withdrawal & deletion
Subject to applicable law, you may request access, correction, deletion, restriction, or withdrawal of consent (for example by disabling camera/photo permissions or stopping use of cloud/AI features).
You can disable science contributions at any time under Account Settings or Ocean Fund, which stops new records and deletes existing cloud science records. You may also use “Delete contributed de-identified data” separately. Turning off GPS recording only stops location collection for future live captures; it does not automatically remove locations already stored on fish cards. You can delete the relevant card or delete your account to remove its synced data.
How to request deletion
In the App, open Account → Privacy & Account → Delete Account to permanently delete your account and associated cloud gameplay data, public content, and private media. After deletion, the App also removes that account’s local data from the device and signs out.
Deleting an account does not automatically cancel an App Store subscription. If you have an active subscription, cancel it first in Apple subscription settings. Transaction records required by law or needed to complete pending transactions or prevent fraud may be retained without direct account identifiers. If you cannot use the in-app option, contact us on WhatsApp at +852 5639 8929.
12. Children
The App is not directed at children. If you are a parent or guardian and believe a minor provided personal information without appropriate consent, contact us and we will take reasonable steps to address the request.
13. Purchases & subscriptions
Paid features (such as Pro+ subscriptions, coin packs, and physical-card related products) are processed by the Apple App Store / StoreKit. We do not receive your full payment card number. Subscription management, cancellation, and refunds follow Apple’s rules and your Apple ID settings.
14. Features not currently enabled in app code
Based on the current implementation, we do not enable the following as product features:
- continuous or background location;
- third-party ad networks or ATT tracking prompts;
- Firebase Analytics or Crashlytics initialization in the App;
- remote push notifications (APNs / FCM).
If we enable any of these later, we will update this Policy and obtain permission or provide choices where required.
15. Changes
We may update this Policy from time to time. The updated version will be posted on this page with a revised effective date. For material changes, we may also provide a reasonable in-app or website notice.
Questions about this Policy can be sent via WhatsApp +852 5639 8929 to Chun Wa Creative Limited.