Privacy Policy

Information we collect

Account information. When you create an account, we collect your name, email address, and role (angler, landowner, club manager, or independent guide). You may also provide a display name, bio, location, fishing experience level, and favorite species.

Profile photos and media. You may upload a profile photo, club logo, or property photos. Uploaded images are automatically resized and converted to WebP format for performance. Images are stored in our cloud infrastructure.

Independent guide verification data. Independent guides who apply for verification provide professional credentials including state guide licenses, liability insurance certificates, first aid certifications, and USCG licenses where applicable. As part of the mandatory background check, personal information — including legal name, date of birth, Social Security number, and address — is collected directly by our background check provider (Checkr) through their secure hosted flow. AnglerPass does not directly collect or store Social Security numbers. We receive only the verification result (clear, consider, or suspended) and a candidate identifier.

Financial information. Payment processing and payouts are handled entirely by Stripe. When you pay a verification fee, booking fee, club dues, or any other charge, your payment details are collected directly by Stripe. Landowners, clubs, and independent guides who receive payouts connect a bank account through Stripe Connect. AnglerPass does not store credit card numbers or bank account details on our servers.

Saved payment methods. If you save a card, bank account, or Link wallet, Stripe stores it and links it to your account so it can pay for your trips and dues. You can remove it at any time under Payment Methods in your account settings. Cancelling a club membership does not remove it; deleting your account does (see What account deletion does). A club that collects dues through its own Stripe account keeps its own copy of the payment method you gave it; ask that club to remove it.

Booking and trip data. We collect information about bookings you make or receive, including dates, locations, participants, rod fees, and independent guide rates. After a trip, anglers may submit reviews that are stored and displayed on the platform.

Property and listing data. Landowners provide property details including name, description, location, water types, photos, availability calendars, and pricing. Clubs provide club profiles, membership rules, dues structures, and property access configurations.

Phone number. If you opt in to SMS notifications, we collect your mobile phone number. Your phone number is used solely for sending platform-related text messages. We do not share your mobile number, your SMS opt-in, or your consent status with third parties or affiliates for any purpose. The sole exception is our SMS delivery provider (Twilio), which transmits messages on our behalf and may not use the data for anything else. Opt-in and consent data is never sold, rented, licensed, or shared for marketing.

Communications and preferences. We store your notification preferences (which email and SMS notifications you opt into or out of) and any messages sent through the platform.

Waitlist, contact, and inquiry forms. If you join a waitlist, send us a message, or ask about a product or partnership through a form on our site before you have an account, we keep what you submit: your name, email address, what you’re interested in, your message, and the page the form was on. We use it to reply to you and to send occasional AnglerPass updates, each with an unsubscribe link. If you later create an account with the same email address, we link the two. We delete a form submission 90 days after your last interaction with AnglerPass, or sooner if you ask us to delete it.

Email opens and clicks. Some of our marketing emails and reminders, and some emails a club sends you through AnglerPass, contain a tiny image that tells us when the email is opened, or links that pass through our servers so we can record a click before taking you to the page. Account emails such as sign-in links, booking confirmations, and receipts are not tracked this way. Our email provider (Resend) reports to us when an email is delivered or bounces. We record whether and when an email was opened or clicked. When you open or click some marketing emails, we also record your IP address and browser type, and for a click, the link you chose. We use this to check that emails arrive and are read, and to stop emailing addresses that bounce. It is not shared with advertising platforms. You can prevent open tracking by turning off automatic image loading in your email app.

How we use your data

We use your information to operate the AnglerPass platform, including: authenticating your identity, displaying your profile to other users, processing bookings and payments, verifying independent guide credentials, sending transactional emails and SMS messages (booking confirmations, trip reminders, credential expiry warnings, payout notifications), and enforcing platform policies. We do not sell your personal information. When you consent to advertising on public marketing pages, we share limited visit and browser data with Google and Meta for ad measurement and audience building, as described below. We do not share it for unrelated third-party marketing.

Automated processing

AnglerPass uses automated systems to monitor independent guide credential expiration dates. When a credential approaches expiry, we send reminder notifications at 60, 30, and 7 days. If a credential expires, the independent guide’s profile is automatically suspended until renewed credentials are uploaded. Independent guides whose credentials are renewed are automatically reinstated. These automated actions are logged and can be reviewed by our team.

Background checks & FCRA compliance

Independent guide background checks are conducted by Checkr, Inc. in compliance with the Fair Credit Reporting Act (FCRA). Checkr’s hosted flow handles all required disclosures, consent collection, and adverse action procedures. Independent guides have the right to dispute background check results directly with Checkr. AnglerPass receives only summary results, not the underlying report details. For more information, see Checkr’s Privacy Policy.

Analytics & cookies

We use a small set of privacy-respecting tools to keep the site fast, secure, and reliable, plus a narrow set of conversion- tracking pixels on our public marketing pages to measure ad performance. We do not use session replay, do not build cross-site behavioural advertising profiles, do not sell behavioural data, and do not run any of these tools inside the authenticated dashboard, admin, or API surfaces.

What we use across the site:

• Vercel Analytics — aggregate page-view counts, country, device class. No cookies, no cross-site tracking.
• Vercel Speed Insights — Core Web Vitals (page load speed metrics) so we can keep the site fast.
• Sentry — receives JavaScript errors and server exceptions so we can fix bugs quickly. It does not record your screen or session. Logged-in users are tagged by internal user ID + role only (no email or name) so on-call engineers can correlate incidents.
• Cloudflare Turnstile — CAPTCHA protection on public forms (signup, contact, migration inquiry). No cookies; sets a one-time challenge token.

What we use on public marketing pages only: These tools load on our unauthenticated marketing site (homepage, audience pages, pricing, about, etc) so we can measure which ads are driving real interest and improve the ones that work. They are scoped tightly — they do not load on the authenticated dashboard, admin, API, or any signed-in surface, and they only receive page URLs and the standard browser fingerprint each platform requires.

• Google Analytics 4 — marketing-page analytics (which pages visitors read, how they got there). Public marketing and sign-in pages only.
• Google Ads conversion tag — lets us measure which Google Ads campaigns lead to account signups, club applications, and bookings. Loads only with your advertising consent.
• Meta Pixel and Meta Conversions API — conversion tracking for Meta (Facebook, Instagram) ads. The Pixel runs in your browser; the Conversions API sends the matching event from our servers so a single conversion is measured once even if your browser blocks the Pixel. Both receive the page you were on, a random browser identifier, your IP address and browser user-agent, and the campaign parameters from the ad you clicked. Neither receives your name, email address, or phone number. Used to measure ad performance and to build audiences from people who have visited our marketing site. Loads only with your advertising consent, and never on authenticated pages.

Your choice, and how to change it: nothing in the analytics or advertising lists above loads until you accept it. Analytics and advertising are separate choices — accepting analytics does not turn on advertising cookies. If your browser sends a Global Privacy Control or Do Not Track signal we treat advertising as declined regardless of what you selected. You can change or withdraw your choice at any time here:

What we still don’t do: we don’t use session replay or screen-recording tools (no FullStory, Hotjar, LogRocket, Microsoft Clarity, or equivalents), we don’t use in-app chat or behavioural marketing platforms (no Intercom, Drift, Customer.io, Segment-style identity graphs), we don’t use TikTok Pixel, X (Twitter) Pixel, or the LinkedIn Insight Tag, and we don’t sell, rent, or share customer data with data brokers under any arrangement. The third-party surface stays deliberately narrow.

Cookies we set: session cookies for authentication (set by Clerk), a small number of functional cookies required for the site to work (CSRF protection, consent record, etc), a first-party campaign-attribution cookie (“ap_attr”, 90 days) that records which ad or link brought you to the site so we can tell which campaigns work, and the standard cookies dropped by the analytics and ad-measurement tools listed above when you visit our marketing pages. The attribution cookie stores only the campaign parameters from the link you followed and a random identifier — never your name, email, or any other personal detail — and withdrawing consent above clears it. None are used for cross-site tracking beyond what those measurement platforms require to attribute a conversion. Browser-level controls (Global Privacy Control, Do Not Track, third-party-cookie blocking, or the opt-out pages each platform provides) all work; we do not attempt to evade them.

SMS communications

AnglerPass offers optional SMS (text message) notifications for booking confirmations, trip reminders, gate code delivery, review prompts, and account alerts. SMS is strictly opt-in — we will never send text messages unless you have expressly consented.

Consent. By providing your phone number and checking the SMS consent box, you agree to receive text messages from AnglerPass at the number provided. Consent is not a condition of using the platform or making a purchase.

Message frequency. Message frequency varies based on your booking activity. You may receive messages for booking confirmations, pre-trip reminders, morning-of access details, post-trip review prompts, and account notifications.

Opting out. You may opt out at any time by replying STOP to any message, or by toggling off SMS notifications in your account settings. After opting out, you will receive one final confirmation message and no further texts.

Message and data rates. Standard message and data rates from your wireless carrier may apply. AnglerPass does not charge for SMS messages.

Supported carriers. SMS is supported on all major U.S. carriers including AT&T, T-Mobile, Verizon, and US Cellular. Carriers are not liable for delayed or undelivered messages.

Consent records. We retain a record of your SMS consent, including the date and time of opt-in, the disclosure text you agreed to, and your IP address at the time of consent, as required by the Telephone Consumer Protection Act (TCPA). These records are retained even after you opt out.

For questions about SMS, contact support@anglerpass.com.

Third-party services (subprocessors)

AnglerPass relies on the following third-party services to operate the platform. Each maintains its own privacy policy and security posture; most hold SOC 2 Type II attestation or equivalent.

• Clerk — authentication (email sign-in codes and passkeys), session management, multi-factor auth. Stores email, name, passkey credentials, and session tokens.
• Supabase — primary database (Postgres) and file storage. Hosted on AWS.
• Vercel — application hosting, edge deployment, function execution, analytics, and Speed Insights.
• Stripe — payment processing and payouts via Stripe Connect. Handles all card data; AnglerPass never stores card or bank account numbers.
• Resend — transactional and lifecycle email delivery.
• Twilio — SMS delivery (only for users who have opted in to text notifications).
• Checkr — background-check provider for independent-guide verification. Collects guide PII (legal name, date of birth, SSN, address) directly via Checkr’s hosted flow.
• Mapbox — map tiles, geocoding, and interactive maps on property discovery surfaces.
• Sentry — application error monitoring. Receives JavaScript errors and server exceptions; tags logged-in users by internal user ID + role only.
• Cloudflare Turnstile — CAPTCHA-style bot protection on public forms. Does not set cross-site cookies.
• Mercury — operating bank for the AnglerPass platform. Read-only API access for treasury reconciliation; no end-user data sent.
• Upstash — distributed rate limiting (hashed IP + endpoint counters). No personal data.
• Anthropic (Claude) — powers the AnglerPass Compass AI features. Calls are made server-side only. Prompts contain your conversation text and a system prompt describing available properties; your name, email address, and account identifiers are never sent to Anthropic.
• Google Analytics — optional marketing analytics. Only loaded on public marketing and sign-in pages.

On our public marketing pages we use a narrow set of conversion- tracking pixels — Meta Pixel and the Google Ads conversion tag — to measure ad performance and, in Meta’s case, build standard ad-audience cohorts. These tools never load inside the authenticated dashboard, admin, or API surfaces. We still deliberately do not use session-replay tools (FullStory, Hotjar, LogRocket, Microsoft Clarity), in-app chat / behavioural marketing platforms (Intercom, Drift, Customer.io), or TikTok, X (Twitter), or LinkedIn advertising pixels. The third-party surface stays deliberately narrow.

Data retention

Account data is retained for as long as your account is active. Booking records, reviews, and financial transaction logs are retained for 7 years for legal and tax compliance. Background check results are retained for the duration of an independent guide’s active status plus 1 year. Signed liability waivers are retained for 7 years after the last trip they cover; a waiver that covers a minor is retained until 7 years after that minor turns 18, if that is later. Uploaded credentials and photos are deleted when you remove them or delete your account, subject to any legal retention requirements.

Security & breach notification

If we learn of a security breach that exposes your personal information, we will tell you without unreasonable delay, and no later than 30 days after we determine that a breach occurred, as Colorado law (C.R.S. 6-1-716) requires. We will also notify the Colorado Attorney General within 30 days if the breach affects 500 or more Colorado residents. Notice may be delayed as allowed by law enforcement needs or measures necessary to investigate the breach and restore system integrity.

Your data rights

You may request access to, correction of, or deletion of your personal information by contacting privacy@anglerpass.com. We respond to every request within 30 days, and we complete an email deletion request within 30 days of receiving it.

What account deletion does. When you delete your account in your settings, it is deactivated immediately: you are signed out everywhere and can no longer sign in. For 30 days it can be restored, in case you change your mind. After that period, we begin permanent deletion. For ordinary accounts, deletion is completed within 45 days of your request. If your account holds records we are required to keep (listed below), our team completes deletion by hand within 60 days total and notifies you by day 45. This deletes your sign-in account with our authentication provider (Clerk), your profile, uploaded photos, personal preferences, and in-app notifications, and removes your saved cards, bank accounts, and Link wallet from Stripe. The one exception is a payment you still owe, such as a trip not yet paid for, a cancellation fee, or a subscription that can still bill: we keep the payment method for no more than 120 days after your account-deletion request, remove it sooner if the balance is settled, and pursue any remaining balance separately after that. If your Stripe customer is shared with another active account, we protect that account’s billing and keep the shared customer intact until the accounts are separated; we do not detach payment methods that could belong to the other account. Booking records, reviews, signed waivers, and financial transaction logs are retained in a redacted form (personal identifiers replaced with anonymous references) because federal tax law, state liability law, and Stripe’s record-keeping requirements all require retention of those records. If you want a full export of your data before deletion, request it via the same email above and we’ll deliver a JSON export within 30 days.

California residents (CCPA / CPRA). If you are a California resident, you have additional rights under the CCPA, including the right to know what categories of personal information we collect, the right to deletion, and the right to opt out of the sale or sharing of personal information. AnglerPass does not sell personal information. When you consent to advertising on public marketing pages, we share limited visit and browser data with Google and Meta for ad measurement and audience building, as described above. You can change or withdraw your advertising choice at any time using the controls above.

EU / UK residents. AnglerPass currently operates in the United States and does not target services to users in the European Union or United Kingdom. If you are an EU or UK resident and have submitted personal information to us (e.g., via a contact or signup form), you may request access, rectification, deletion, or restriction of processing using the same contact above. We will treat such requests under GDPR principles even though formal GDPR scope is limited.

Changes to this policy

If we make material changes to this policy, we’ll notify registered users by email and update the date at the top. On public marketing pages, we currently use consent-based Google Ads and Meta tools to measure ad performance and build limited advertising audiences, as described above. We do not sell user data.