Your data, your call

When you submit something (an event, a lost-or-found pet, a guide application): the details you enter, plus the contact info you choose to share and a private email for follow-up.

When you book or review a guide: your name, email, phone (if given), your message or review text, and any photo you attach.

If you subscribe to the weekly rundown: your email address.

If you're a captain with an account: your login credentials (passwords are stored hashed, never in plain text), your listing and credentials, and the trips, catches, and photos you log.

Automatically: basic technical data (such as server logs) needed to run and secure the site. We use only the cookies needed to run the site: keeping you signed in, remembering the choices you make here, and — if you arrived from a QR code or a partner link — a note of where you came from so we can credit it. Optional analytics and marketing cookies stay off unless you switch them on, and you can change that at any time from "Cookie settings" in the footer.

Where the GDPR applies, we process your data on these bases: to perform a contract (e.g. a booking or account you ask for); with your consent (e.g. marketing emails or optional cookies, which you can withdraw anytime); and for our legitimate interests in running, securing, and improving a community service (e.g. preventing abuse). We process special categories of data only where you choose to share them.

To publish what you ask us to publish, connect anglers with captains, send the digest you signed up for, run captain accounts, prevent abuse, and meet our legal obligations. That's it.

We never sell your data. We share it only with the service providers that make the site work — for example payment processing (Stripe), and, only if a captain connects it, Google Photos for delivering trip photos to that captain's own account; and, only if a business owner connects their Facebook Page, Facebook (Meta Platforms), to publish the event posts that owner asks for (see below). Public listings (events, pet reports, guide profiles, reviews) are intentionally public. We may disclose data if required by law.

Our site and data are hosted in the United States (Google Cloud). For visitors in the EU/EEA, transfers to the US rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses with our providers (Google Cloud and Stripe are DPF-certified).

Restaurant and business owners can connect their own Facebook Page so they can post their events to it from Pine Island Passport. When an owner connects, we store the Page's ID and name and the Page access token Facebook issues to us. The token is encrypted before it is stored, and it is never shown to anyone — the owner included. We also keep the app-scoped Facebook user ID Facebook gives us for the person who connected (it is how we find their data when Facebook relays a deletion request), and a record of each post made through Pine Island Passport: its text, when it was posted or scheduled, and whether Facebook accepted it.

We post only when the owner asks. Every post is the owner pressing a button with text they can edit — a link to one of their events, now or at a time they choose. We use Facebook only to list the Pages the owner manages so they can pick one, to check that posting was allowed, and to publish or withdraw the posts they ask for. We never post anything else, and we never post to personal profiles or to groups.

Removing it. The owner can disconnect at any time from their hub: we withdraw any posts still scheduled, where Facebook lets us, then delete the token and the post history. Removing Pine Island Passport in Facebook (Settings → Business integrations, or Apps and websites) stops our access at once; to have the stored connection deleted as well, disconnect in your hub or ask Facebook to send us a data-deletion request. We carry out a deletion request immediately, and Facebook gives you a link to our deletion status page (/facebook/deletion on this site) with a confirmation code showing it was done. Posts already published on your Page belong to your Page — delete them on Facebook if you want them gone.

You can ask us to delete your personal data, send you a copy of it, correct it, or stop using it for marketing — using the form below. If you're in the EU/EEA you also have the right to restrict or object to processing, to data portability, and to lodge a complaint with your local supervisory authority. Subscribers can also unsubscribe from any email. We'll verify it's really you before acting, respond within the time the law requires (within one month under the GDPR), and we honor these requests regardless of where you live.

When you ask for deletion, we remove your contact details and personal content. Some posts you made for the community (like a published event) may stay up with your personal details stripped out, and we may keep the minimum we're legally required to (for example, basic transaction records).

We keep personal data only as long as we need it for the purpose you gave it, then delete or anonymize it. Records containing personal information are disposed of securely.

We take reasonable measures to protect your data, including encryption of sensitive credentials. No system is perfect — if a breach ever affects your personal information, we will notify you and the appropriate authorities as required by law (including Florida's Florida Information Protection Act and, for EU/EEA residents, the GDPR), without unreasonable delay.

The site isn't directed to children under 13, and we don't knowingly collect their personal information.

Questions? Email us at hello@pineislandpassport.com.