1. Who We Are

HighSlack is operated by Glenberts LLC. This Privacy Policy explains how we collect, use, and protect your information when you use the HighSlack platform.

2. Information We Collect

Account Information: Email address, name, and password (stored as a one-way hash).

Fishing Operation Data: Delivery records, fish ticket details, permit numbers, processor information, expenses, crew details, fishing periods, weather preferences, and district selections. You enter this data voluntarily.

Crew Member Data: If you use the crew onboarding feature, you may collect crew names, addresses, Social Security Numbers (encrypted at rest), emergency contacts, and electronic signatures. You are the data controller for crew information.

Payment Information: Subscription payments may be processed by Stripe on the web or by Apple through In-App Purchase in the iOS app. We do not store full credit card numbers. We may store billing identifiers such as a Stripe customer ID or App Store transaction identifiers to manage your subscription state.

Usage Data: We collect page views and feature usage to understand how the product is used and to improve it. This data is pruned after 90 days.

Device Tokens: If you use the mobile app, we store push notification device tokens to send alerts about fishing periods, weather, and tax deadlines.

3. How We Use Your Information

• Provide the Service: Store your data, generate reports, run predictions, display weather and tides.
• Improve the Service: Analyze anonymized, aggregated data across all accounts to improve prediction accuracy, identify seasonal patterns, and develop new features. Individual data is never identifiable in aggregated analysis.
• Communicate: Send push notifications for fishing periods, weather alerts, and tax deadlines. Send email for account-related notices (password reset, subscription changes, terms updates).
• Billing: Process subscription payments through Stripe on the web and Apple In-App Purchase in the iOS app.

4. How We Share Your Information

We do not sell your personal data. We share data only in these cases:

• Stripe: Email and customer ID for web payment processing.
• Apple: App Store transaction identifiers and subscription state for iOS In-App Purchases.
• Aggregated insights: We may publish or use anonymized, aggregated data (e.g., "average Egegik catch per day in July 2025") that cannot identify any individual user.
• Legal compliance: If required by law, subpoena, or government request.
• Business transfer: In the event of a merger, acquisition, or asset sale, your data may be transferred. We will notify you before your data is subject to a different privacy policy.

5. Internal Access & Administration

Authorized HighSlack administrators may access user accounts for the following purposes:

• Account support: Viewing account status, subscription details, and data summaries to troubleshoot issues reported by users.
• Account impersonation: Administrators may temporarily log in as a user to diagnose problems or verify reported issues. Impersonation sessions are logged and restricted to authorized personnel.
• Service integrity: Monitoring system health, reviewing aggregate usage patterns, and managing subscriptions.

Administrative access does not include viewing encrypted data (such as Social Security Numbers) beyond what is available through the normal application interface. We limit admin access to the minimum necessary to operate and support the service.

6. Data Security

• Passwords are stored as one-way hashes (never plaintext)
• Social Security Numbers are encrypted at rest using Fernet symmetric encryption
• All connections use HTTPS/TLS encryption in transit
• Session cookies are set with HttpOnly, Secure, and SameSite flags
• Database access is restricted to the application server
• Login attempts are rate-limited to prevent brute force attacks

No system is 100% secure. We take reasonable measures to protect your data but cannot guarantee absolute security.

7. Data Retention

• Account data: Retained as long as your account is active.
• Usage analytics: Pruned after 90 days.
• After account deletion: Your data is retained for 30 days to allow export, then permanently deleted.

8. Your Rights

You can:

• Export your data at any time via CSV exports in the app
• Update your information through the Settings and Account pages
• Delete your account by contacting support@highslack.com
• Opt out of push notifications by disabling them in your device settings

9. Third-Party Services

We use the following third-party services:

• Amazon Web Services (AWS): Hosting and database (US-West-2 region)
• Stripe: Web payment processing (Stripe Privacy Policy)
• Apple: iOS In-App Purchase processing (Apple Privacy Policy)
• NOAA: Tide prediction data (public API, no user data shared)
• Open-Meteo: Weather forecast data (public API, no user data shared)
• ADF&G: Emergency order and forecast data (public documents, no user data shared)
• Let's Encrypt: SSL certificates

10. Children's Privacy

HighSlack is not intended for users under 18. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or in-app notification at least 14 days before they take effect.

12. Contact

Questions about this Privacy Policy? Contact us at support@highslack.com.