AEGIR is a mobile app for planning coastal dives, freedives, spearfishing, and shore fishing. This notice covers the AEGIR app and the PelagicLabs services it uses. It explains what personal data is handled, where it comes from, why it is used, who receives it, how long it is kept, and your rights under the GDPR and other data-protection law.
AEGIR keeps most of your data on your device. Your logbook, saved sites, alert rules, and preferences stay on the device and are not synced to a cloud account. Data leaves the device when a feature needs it: to fetch conditions for a location, to identify a fish from a photo, to sign in, or to buy or restore a subscription.
This legally operative notice is currently provided in English. You may contact us to request an explanation in another European language.
1. Controller and Scope
The controller for personal data processed through AEGIR is:
- Controller: PelagicLabs
- Country: Belgium
- VAT / enterprise number: BE1032.515.015
- Privacy email: lukasmeerschaut@pelagiclabs.io
PelagicLabs has not appointed a data-protection officer because the present scale and nature of the processing do not require one. Privacy requests are handled through the contact above.
This notice does not cover visits to pelagiclabs.io. Those are covered by the PelagicLabs website privacy policy linked above.
2. Personal Data AEGIR Handles
2.1 Location and sites
AEGIR asks for location access only while you use the app. It reads your position when you choose to use your current position. It does not track location in the background. You can deny access and pick a site or enter coordinates instead.
To build a briefing, AEGIR sends the coordinate of the chosen site or your current position to the PelagicLabs GILLI and NORDR backends. They return weather, marine forecast, tide, water-quality, bathymetry, marine-feature, buoy, and place-name data for that point. Map tiles are fetched from the GILLI backend by map area.
For sunrise and sunset times, the app sends the coordinate, timezone, and date directly to Open-Meteo, or to Sunrise-Sunset.org if Open-Meteo does not answer. These requests carry an app key, not your account ID or name.
2.2 Fish ID photos
When you ask AEGIR to identify a fish, the app resizes the photo you took or picked and re-encodes it as a JPEG. The upload holds no EXIF metadata and no location. It is sent to the GILLI backend, which passes it to a private identification service. The photo is processed in memory and not stored. Limited records remain, such as the model version, the top result, its confidence, and processing time.
Training contribution is off by default. If you turn on "Share confirmed label for training" and then confirm a species, AEGIR sends a second upload with:
- the same re-encoded photo, without EXIF metadata or location
- the species you confirmed
- the model version, its top suggestion and confidence, and whether you chose a different species
When training collection is active on our side, the photo and label are stored and linked to an account identifier so they can be found and deleted on request. We use them only to improve fish identification.
2.3 Accounts and sign-in
An account is optional. AEGIR uses Firebase Authentication with Sign in with Apple or Google Sign-In. Depending on the method, the data can include:
- Firebase user ID and sign-in provider identifiers
- Email address, which Apple may replace with a private relay address
- Name and profile image, if the provider supplies them
- Identity tokens, session state, sign-in times, and security metadata
The session is kept on your device. You can delete the account in the app. For Apple accounts, deletion also revokes AEGIR's Apple sign-in token.
2.4 Data stored on your device
- Logbook entries: site, date, duration, outcome, conditions, tags, discipline, and private notes
- Saved sites and custom locations
- Alert rules and alert settings
- Discipline, region, and other preferences
- Cached briefings, map tiles, and offline regions
This data is not uploaded to a PelagicLabs server.
2.5 Alerts and notifications
Condition alerts are worked out on your device from the same forecast data used for briefings. Alert notifications are local notifications scheduled by your device. AEGIR does not register a push token and does not send alert rules to a server.
2.6 Purchases and subscriptions
AEGIR uses RevenueCat to show offers, complete and restore purchases, and check Pro access. RevenueCat receives an app user ID. When you are signed in, this is your Firebase user ID; otherwise it is an anonymous RevenueCat ID. It also receives product, transaction, receipt, and subscription status, and device and app details needed for purchases. Apple or Google processes the payment. PelagicLabs does not receive your card details.
2.7 Network and operational data
Every internet request exposes your IP address and standard request data to the server that receives it. Our backends can record the request path, time, status, and error details. We use these records to run and secure the service, not to build an advertising profile or a location history.
3. Where Personal Data Comes From
- From you: sites, coordinates, photos, logbook entries, alert rules, preferences, and messages you send us
- From your device: location when you allow it, platform, app version, and network data
- From Apple, Google, and Firebase: sign-in data for the method you choose
- From RevenueCat and the app stores: purchase and subscription status
PelagicLabs does not buy user profiles or add data from social media.
4. Purposes and Legal Bases
| Purpose | GDPR legal basis |
|---|---|
| Fetch conditions, maps, and briefings for the site or position you choose | Article 6(1)(b), providing the service you asked for; Article 6(1)(a) where consent is needed for device location |
| Identify a fish from a photo you submit | Article 6(1)(b), providing the feature you asked for |
| Store confirmed photos and labels to improve fish identification | Article 6(1)(a), your consent through the training toggle |
| Create, secure, and delete an optional account | Article 6(1)(b); Article 6(1)(f) for sign-in security and fraud prevention |
| Sell, restore, and check subscriptions and purchases | Article 6(1)(b); Article 6(1)(c) for tax, accounting, and consumer-law duties |
| Secure the service, limit abuse, and fix faults | Article 6(1)(f), our legitimate interest in a secure and working service |
| Answer support and privacy requests, and handle legal claims | Article 6(1)(c), legal obligation; Article 6(1)(f), handling requests and legal claims |
You can object to processing based on legitimate interests as described in Section 10.
5. What Is Required and What Is Optional
- Location permission: optional. Without it, pick a site or enter coordinates.
- Coordinates in requests: needed for live conditions. Cached data can still show offline.
- Camera and photos: optional. Needed only for Fish ID.
- Training contribution: optional and off by default. Turning it off stops future uploads.
- Account: optional. The briefing, Fish ID, and logbook work without one.
- Notifications: optional. Without permission, alerts cannot notify you.
- Purchase data: needed only to buy, restore, or check Pro access.
You can withdraw consent or revoke a permission at any time. This does not affect processing that was lawful before. The feature that needs it may stop working.
6. Automated Scoring and Identification
AEGIR calculates briefing scores, time windows, alert matches, and Fish ID suggestions automatically. These are advisory planning aids. They do not produce a decision with legal or similarly significant effects on you, within GDPR Article 22. Pro access is shown automatically from the status supplied by the app store and RevenueCat.
7. Recipients and Service Providers
We share only what a feature needs. Some providers act for PelagicLabs. Others, such as app stores and sign-in providers, act as independent controllers for their own services.
| Recipient | Purpose and data |
|---|---|
| PelagicLabs GILLI and NORDR backends and their hosting | Conditions, maps, species data, and Fish ID; coordinates, map tile areas, Fish ID photos, IP address, and request data |
| Firebase (Google) | Sign-in, sessions, and account deletion; storage of training contributions you opt in to |
| Apple and Google sign-in | Sign in with Apple or Google; provider account and sign-in data |
| RevenueCat, the Apple App Store, and Google Play | Offers, purchases, restores, billing, and Pro status; app user ID, transaction, receipt, subscription, and device data |
| Open-Meteo and Sunrise-Sunset.org | Sunrise and sunset times, requested directly by the app; coordinate, timezone, date, and IP address |
| Professional advisers and public authorities | Legal, accounting, security, or regulatory matters where disclosure is necessary and lawful |
Our backends fetch marine, weather, and seabed data from public and commercial data providers. Those requests come from our servers and can include coordinates. They do not include your IP address or account details.
8. International Transfers
Some providers operate outside Belgium, the EEA, or the United Kingdom. Where PelagicLabs is responsible for a restricted transfer, we rely on a European Commission adequacy decision where one exists, or on safeguards such as the European Commission's Standard Contractual Clauses with supplementary measures where required. Providers acting as independent controllers handle their own transfers.
You can ask us which transfer mechanism applies to your data and how to get a copy of the safeguards, with confidential or security details removed.
9. Retention and Deletion
- On-device data: stays until you delete it, clear the app's data, or uninstall AEGIR. Deleting your account does not remove the logbook or preferences from the device. Device backups follow your Apple or Google settings.
- Account: kept while it exists and deleted when you delete it in the app, subject to Firebase backup and security retention.
- Location requests: used to answer the request. Responses can be cached by area. We do not keep a location history.
- Fish ID photos: not stored after identification.
- Training contributions: kept until you ask us to delete them or we no longer need them to improve identification.
- Purchase records: kept by RevenueCat and the app stores for subscriptions, fraud prevention, accounting, and legal duties under their own rules.
- Support and privacy requests: kept as long as needed to answer and document the request and to meet legal duties.
- Security and operational records: kept only as long as needed for security, fault finding, and legal claims.
Deleting your AEGIR account does not cancel a subscription. Manage or cancel it in the Apple or Google account you used to buy it.
10. Your GDPR Rights
Subject to the conditions in the law, you can ask for:
- Access to your personal data and how it is used
- Correction of inaccurate or incomplete data
- Erasure, including of training contributions
- Restriction of processing
- A portable copy of data you provided, where processing is based on consent or contract
- Objection to processing based on legitimate interests. We will stop unless we have compelling grounds or need the data for legal claims
- Withdrawal of consent at any time
- A complaint to a data-protection authority
Send requests to lukasmeerschaut@pelagiclabs.io. Say that the request is about AEGIR and give enough detail to find the account or record. We may ask for proportionate proof of identity. We answer without undue delay and in principle within one month, with extensions only where the law allows.
You can complain to the authority where you live, work, or where you think an infringement took place. PelagicLabs' supervisory authority is the Belgian Data Protection Authority, Drukpersstraat / Rue de la Presse 35, 1000 Brussels, Belgium, contact@apd-gba.be, +32 (0)2 274 48 00.
11. Children
AEGIR is a dive and marine-conditions tool for a general adult audience. It is not directed at children. Where a child cannot consent to optional processing under the law of their country, a parent or guardian must authorise it. A parent or guardian can ask us to review or delete a child's data.
12. Security, Advertising, and Tracking
We use HTTPS, app sandboxing, provider security controls, rate limits, and restricted access. No system is completely secure.
PelagicLabs does not sell or rent AEGIR data. The app has no advertising SDK, no product analytics, and no crash-reporting service. It does not track you across other apps or websites. Firebase, RevenueCat, the app stores, and our backends keep the operational records they need to run their services.
13. Changes and Contact
We update this notice when AEGIR's data practices, providers, or legal duties change. The date at the top shows the current version. Where the law requires it, we will tell you about material changes before they apply.
Privacy questions and requests: lukasmeerschaut@pelagiclabs.io