Privacy

Who runs this site

wheretoflyfish.com is run by Nevel Trade Inc.. Questions, or requests to see or delete anything about you: info@neveltrade.com.

When you browse

• The site is served by Cloudflare. Like any web host, Cloudflare sees your IP address and browser details to deliver pages and block attacks.
• We count visits with Cloudflare Web Analytics, which uses no cookies and doesn't build a profile of you. We see totals, such as page views and countries, not individuals.
• Your selected city and comparison choices can be remembered in your browser. Opening the AI search panel sets the anonymous allowance cookie described below. Cloudflare may also set a short-lived security cookie if it needs to check whether a visitor is a bot.
• In the day-trip planner, “Use my location” asks for browser permission, then separately asks whether to send your coordinates through our server to openrouteservice for road routes and the name of the nearest town (for example “Near Cliffside Park, NJ 07010”), which the planner shows as your starting point. We do not send them to AI or put them in search URLs. Coordinates and loaded routes stay in this tab's memory until it closes or reloads. Our application does not store raw coordinates or log request bodies. A secret-protected lookup code, route durations and that town name can be cached on our server for 24 hours; old cache entries are removed on subsequent routing requests. Daily connection codes and request counts enforce caps and are retained for up to 93 days. Cloudflare carries the request; openrouteservice receives coordinates and our server's connection details. See openrouteservice's privacy policy. On the home page, “Use my location” finds the closest city within your browser, and sends a point rounded to about 1 km through our server to openrouteservice only to name your town (for example “Near Cliffside Park, NJ 07010”). That point isn't stored or logged; a daily connection code and count enforce a cap, as above. Other location helpers that suggest cities compare coordinates within your browser.
• Maps load their background tiles from OpenFreeMap, so OpenFreeMap sees your IP address when a map is shown.
• River flows and forecasts come from our own server. When you click a spot on a state trout map, the point you clicked, rounded to about 5 km, is used to look up the forecast. It isn't your location and isn't linked to you.
• When you use the filters on a list page (water type, month, region, price, skill level, sort, and the words you search for), the page sends the filters you settle on and how many destinations matched. We use this to decide which rivers and pages to add. It's stored without your IP address, any cookie or anything else that identifies you. Searches that look like an email address or a phone number are thrown away.

When you use AI search suggestions

Only when you select “Suggest filters,” your request and our public search catalogue are sent to Claude (Anthropic) to suggest supported filters. Please leave out names, contact details and exact addresses. Suggestions are shown for your review before they change your search.

A random visitor cookie, used only for the AI search allowance, lasts up to 30 days. Our server keeps a keyed code derived from that cookie and a separate keyed code from your connection's IP address that changes daily. These enforce usage limits. We do not store the raw request text in our search database or application logs. We keep token counts and spending records for up to about three months. Validated filter suggestions can be reused for seven days; their lookup keys are also protected with a secret key.

Ordinary search works without sending a request to an AI provider. AI allowance records are separate from the anonymous filter statistics above.

When you send a correction or suggestion

The form sends us:

• what you wrote, the listing and field it's about, and any source link you add;
• your email address, only if you give one, so we can reply;
• your browser's name and version;
• a scrambled code made from your IP address and the date, used only to stop more than ten submissions an hour. It's made with a secret key, so it can't be turned back into your address, and it changes every day.

Submissions are stored in our database on a server in Newark, New Jersey (Akamai Cloud). We keep them so we can trace where a change to a listing came from. We use your email address only to reply about your submission. Ask us and we'll delete your email address or the whole submission.

When you request lodge quotes

The "Get lodge quotes" form on lodge destinations sends us your name, email address, the destination, and what you tell us about dates, group size, budget and the trip, plus the same scrambled IP code as above (to stop more than five requests an hour). With your agreement, which the form asks for, we pass the request to one fly fishing travel agency that books that destination, so they can email you. The agency may pay us a referral fee if you book; that doesn't change what you pay. We don't pass it to anyone else. Ask us and we'll delete it.

Who else sees your information

Only the services that run the site: Cloudflare (hosting, security and visit counts), Akamai Cloud (our server and database) OpenFreeMap (map tiles) and Resend (sign-in codes, and the river alerts and weekly picks you turn on), and, for a quote request you agreed to share, one travel agency. We don't sell or rent personal information, and we don't share it with advertisers. We'd disclose it only if the law required it.

Accounts

Accounts are optional. Every existing public feature works without signing in. Guest saved rivers and trips stay in this browser until you remove them or clear browser data. When you sign in, these saves are merged into your private account. An account stores your verified email, saved destinations and trips (dates, group size, fishing style and notes), your preferred units, and anything optional you add: a name for us to use, a home city, a fishing profile (experience, what and how you fish, how far you'll drive, guide budget) and which emails you want (all off by default). Admins can also switch trial features on for an account, such as a different map. Resend receives your email address and sign-in email to deliver a code valid for 10 minutes. We store only a protected code digest, keyed email code and keyed connection code for abuse prevention, retained for up to a day and cleaned on subsequent sign-in requests. The sign-in cookie is essential, HttpOnly and Secure, and expires after 30 days. We store its digest rather than its raw value. Your account data is private; authorized site administrators can manage accounts. There are no public profiles or trip sharing. In My water → Account settings you can export your data, sign out or permanently delete your account, saves and sessions. Deletion removes live data immediately; encrypted-access database backups may retain it until their normal retention expires (daily backups up to 30 days; monthly recovery copies may be retained longer). Contact us about backup removal requests. Admin security actions record the administrator, action, opaque account identifier and time; they do not include trip notes. Guest saves that have not been synced stay on the device. Keep notes free of sensitive information.

River alerts. If you turn them on (My water → Notifications, or "Email me when it's fishable" on a river page), we email you when a saved river's flows come back into range, its season starts, or a fishing closure is posted or lifted. Resend receives your email address and the alert to deliver it. We keep a record of which alerts we sent you and when, so you don't get the same one twice; it's deleted with your account. Every alert email has an unsubscribe link that switches alerts off in one click, without signing in.

Weekly picks. If you turn on Weekly picks (My water → Notifications), we email you on Thursday evenings with places likely to fish well that weekend and what changed on your saved rivers. To choose the places we use your home city and maximum drive, if you've given them, or the states of your saved rivers. Resend receives your email address and the email. We record that we sent it (or that there was nothing to send) for each weekend, so you don't get it twice; that record is deleted with your account. The same one-click unsubscribe link turns it off.

Fishing journal and photos. When the fishing journal opens, the days you log, your private pins and your photos belong to your account and only you can see them. A logged day can include where you fished (the exact spot), what you caught, your flies and notes, and the river and weather conditions we fill in for that day. Nothing in the journal is public, shown on a map to anyone else, or used to show other anglers where you fish. If you later choose to share a day as a trip report, you pick what goes in it, and the exact spot stays out unless you add it.

Photos are stored in Cloudflare R2. When you upload one, we read where and when it was taken (if your phone recorded it) so we can suggest the spot and the day, then save a new copy with all of that removed: no GPS location, no time, no camera details. Only you can open your photos, through links that expire within minutes. Deleting a photo, the day it belongs to or your account removes the photo files too; a photo you upload but never add to a day is deleted after a week. Your data export includes your journal, pins and photos.

Offline copies

So the site opens with no signal, your browser keeps copies of pages you've opened (the last 60), of your saved rivers' pages with their latest conditions, and of any map areas you save. They stay on your device and aren't sent anywhere. Signing out removes the saved-river copies that came from your account. Clearing this site's data in your browser removes all of them.

Children

The site isn't aimed at children under 13, and we don't knowingly collect their information.

Changes

If this policy changes, the date at the top changes with it. Significant changes will be noted on the site.