Last updated 17 September 2026
The short version. PierRat never records where you fish. Your phone may use your location to work out which zone of the harbour you are in — a named area like "Red Hook Waterfront" — and the coordinate is thrown away on your phone before anything is sent. There are no analytics, no advertising identifiers and no third-party trackers in this app. You can delete your account, and everything attached to it, from inside the app.
PierRat is an independent iOS app for shore fishing in New York Harbor, operated by its developer. Questions about this policy or about your data go to hello@esquetechnology.com.
This app is built around not revealing fishing spots, including yours.
Deleting the app removes all of it.
The app's social features run on Amazon Web Services in the US East (N. Virginia) region.
| Data | Why |
|---|---|
| Your handle, optional display name and moniker, avatar initials, home zone, join date | To show who wrote a post and to build leaderboards |
| For Sign in with Apple: a one-way hash of the identifier Apple gives us, and your email only if Apple chooses to share it | So the same person gets the same account back on a new device. We never store the raw Apple identifier. |
| For device accounts: an opaque account number and nothing else | An account with no identity attached |
| Your posts: species, length, released or kept, notes, rig, obscured zone and time bucket | The community feed, your tank, your stats |
| Catch photos | Shown with your post. See below. |
| Likes, blocks, reports and the reason you gave | Moderation, which the App Store requires and which we would want anyway |
| Parties you host or join, and a timestamp recording that you confirmed you are 18 or older and accepted the risks | To run the calendar, and because that confirmation is the basis on which meetups are listed |
| A hashed digest of your refresh token and its expiry | To keep you signed in. The token itself is never stored on the server. |
If you attach a photo, your phone re-encodes it before upload, which strips the file's embedded metadata — including the GPS tag most cameras write into it. The stripped image is uploaded; the original never leaves your phone. Photos are served from a content delivery network, which means anyone with the link can view that image, so treat a posted photo as public. Deleting the post deletes the image.
Every uploaded photo is checked automatically for objectionable content before anyone is notified about it. The check runs on Amazon Rekognition. It produces labels, not a decision: anything it flags goes to a person to review, and nothing is removed by the check alone. It is imperfect in both directions, and reporting a post remains the fastest way to reach us. Amazon states that it may store and use images sent to that service to improve its own machine-learning products, and may hold them in a region other than the one above, unless the developer opts out; we will say here which of those applies once that is settled.
Some readings come straight from the source rather than through us. When the app fetches them, those services can see your device's IP address, as any website would. We send them nothing about you.
Content stays until you remove it, or until a moderator removes it for breaking the community rules. Expired sign-in sessions delete themselves automatically.
Deleting your account — Settings, on the Rank tab — erases your profile, posts, photos, likes, blocks, reports, leaderboard entries and parties, releases your handle for reuse, and withdraws you from other people's parties. It is immediate and cannot be undone. Anonymised counts already folded into other people's totals are not recoverable individually.
PierRat is not directed to children under 13, and we do not knowingly collect their information. Creating or joining a meetup requires confirming you are 18 or older.
You can see everything the app holds about you from inside it, change your handle and name at any time, and delete the account outright. If you are in a jurisdiction with additional rights over your personal data — such as the EEA, the UK, or California — write to the address above and we will honour them. We do not sell personal information and never have.
Everything travels over HTTPS. Sign-in tokens live in the iOS keychain. On the server, data is encrypted at rest, the session signing key is held in a managed secret store and never appears in our source code, and the Apple identifier is stored only as a salted hash. No system is perfect, and we will not pretend otherwise.
If this policy changes in a way that affects you, the app will show the change and ask you to accept it before you keep posting. The date at the top always reflects the current version.