Privacy policy

Last changed on 27 October 2026.

Who we are

Rod & Rifle is made by Stehrway, a Canadian company. Stehrway is responsible for the personal data the app collects. Canada's privacy laws apply to it, including the Personal Information Protection and Electronic Documents Act (PIPEDA).

Where your data is kept

Our database and our API run with Supabase, in its Canada (Central) region. Your account, your sign-ins and what the app stores about you are kept there. The pipeline that makes the forecasts runs on Google Cloud in Montreal and holds no personal data.

Some services we use are outside Canada:

  • Cloudflare, worldwide, serves our map and forecast files from servers near you, so they load quickly. It keeps counts per day ID for our daily limits, and its own analytics of requests, with IP addresses. See "Map and forecast files".
  • Resend, in the United States, delivers our sign-in emails. It gets your email address and the email, including the code. See "Email".
  • Sentry, in the United States or the European Union, will store crash reports once we set it up, so we can fix what breaks. See "Crash reports".
  • Vercel hosts this website, on servers around the world. See "This website".

Your account

You can look around the app without an account. You need one to see forecasts.

  • Your email address, to sign in. We email you an 8-digit code that works for 15 minutes. There are no passwords. Sign-in with Apple and Google will follow.
  • Your sign-ins: when you signed in, and the IP address and app or browser of each session. Supabase's sign-in service also keeps a log of sign-ins with your email address and IP address.
  • When your account was made, and where its data is stored. For everyone, that's Canada for now.
  • Whether you want news by email, and, when you said yes, the exact words next to the box (see "Email" below).

Your phone

The app makes a key on your phone and registers it with our API, which keeps the key, whether it's an iPhone or an Android phone, and when it was registered. That lets the API tell your phone's requests apart from others without knowing who you are.

When you're signed in, the API notes which account uses the phone, to limit how many phones can see forecasts on one account at the same time. It deletes that link a day after your phone's last pass runs out (see "Map and forecast files").

Your location

The app uses your location only to show where you are on the map, only while you use it, and only if you allow it. Your location stays on your phone. The app doesn't send it to us.

The map does load files for the area on the screen, which is often where you are (see "Map and forecast files").

Map and forecast files

Our forecasts, seasons and places come from Cloudflare's network, which has servers around the world. To keep our data from being copied in bulk, each request for them needs a pass from our API that lasts 15 minutes. The base map, which is OpenStreetMap's data, needs none.

  • A pass holds no name, email address or account number. It holds random IDs: one for the pass, and a day ID that changes every day. Only our API, in Canada, knows which account or phone a day ID belongs to, and it keeps that link for 2 days.
  • Our API counts how much each account or phone downloads in a day, to apply daily limits and notice bulk copying. It keeps those counts for 30 days. They don't say which places or areas you looked at.
  • Cloudflare keeps some counts outside Canada to apply the daily limits: for each day ID, how many files of each kind it fetched, which species it opened, and whether it reached a limit. They're deleted after 2 days, or later if our API hasn't received them by then. They hold no IP addresses, places, accounts or phones. Because our API can link a day ID to an account for 2 days, they still count as personal data.
  • Cloudflare's own analytics keep a sample of requests for at least a month, with IP addresses and the address of each file. A file's address can show which map area was loaded. This can't be switched off. We keep no logs of these requests ourselves.
  • IP addresses are used for a per-minute limit on the base map, and only kept in memory for that.

Crash reports

Email

  • Sign-in codes are sent by Resend, an email service in the United States, from mail.rodandrifle.app. To deliver an email, Resend gets your email address and the email itself, including the code. Resend's tracking of opens and clicks is switched off.
  • News comes only if you tick the box for it, and the box starts unticked. We keep a record of each yes and no and when you gave it, and with each yes the exact words you saw, as Canada's Anti-Spam Legislation (CASL) asks. Every news email has a link to unsubscribe. News, later, will come from a separate address of ours, not from mail.rodandrifle.app.

This website

This website uses no cookies, analytics, trackers or scripts from other companies. It's hosted by Vercel.

Analytics and ads in the app

Coming later

These parts of the app aren't built yet. This policy will describe them before they are.

  • Days out and reports, with their places. They will be private unless you share them. Exact locations will never be in posts, our map and forecast files, crash reports or analytics.
  • Photos. The app will remove location data from them before upload, and our server will check again.
  • Friends, crews, clubs and posts. A post will show its region, or a lake, river or area name only if you choose it, never a pin.
  • The party map and safe return. Positions will be deleted when the day out ends.
  • Forecasts that learn from reports, without names or account details.

How long we keep it

  • Your account: until you delete it.
  • The link between your phone and your account: a day after your phone's last pass runs out.
  • Day IDs: 2 days. Daily download counts: 30 days.
  • Counts on Cloudflare: 2 days, or until our API has received them.
  • Cloudflare's analytics: at least a month.

Your choices

  • Ask what we hold about you, and ask us to correct it.
  • Stop news by email at any time: untick the box, or use the link in any news email.
  • Delete your account. The app will let you delete your account and its personal data. Past reports would stay only as anonymous counts in the forecasts. This isn't built yet.
  • Complain to the Office of the Privacy Commissioner of Canada if you're not happy with how we handle your data.

Changes

When this policy changes, the date at the top changes too. Before the app comes out, this draft will be replaced by the final policy.