WhatFishIsThis

Privacy Policy

How WhatFishIsThis handles your fish photos, your daily scan count and your collection.
Nov 3, 2026

The short version

WhatFishIsThis identifies fish from photos. Your photo is used only to identify the fish, and we do not store your photos. To identify it, the photo is sent to an AI provider (see below). To give everyone 5 free scans a day, we count scans by a keyed hash of your IP address and delete those counts after 2 days. The fish you save to your collection stay only in your browser.

Your photos

  • When you pick or take a photo, your browser shrinks it (to at most 1024 pixels on the longer side) before it is sent.
  • The shrunk photo is sent to our server once per scan, and once more if you ask for a second opinion ("Not right?"). Our server checks that it is an image and passes it to the AI model. We do not store your photos: they are not written to disk, kept in a database or used for anything other than answering that one request.
  • File names and other details of the file on your device are not sent.

The AI providers that see your photo

Identifying a fish means an AI model has to look at the photo, so each photo is sent to one of these providers, which process it under their own policies:

  • OpenRouter routes the first scan to the GLM vision model. OpenRouter's privacy policy says it does not use inputs or outputs to train models and does not keep images beyond what is needed to route the request (except for abuse detection, security, billing or legal reasons). It also says some model providers it routes to may keep or train on inputs under their own terms. See also OpenRouter's terms.
  • kie.ai runs the Gemini model that gives the second opinion. kie.ai's privacy policy and terms of use do not say how long images sent to its API are kept or whether they are used for training, so we cannot promise more than that kie.ai handles them under its own policies.

Only the photo and a fixed question ("which fish is this?") are sent. Your IP address, scan count and collection are not.

Reference photos and intros

Next to each match we show a reference photo of that fish and a short intro, so you can compare them with your photo.

  • The intro and the photo's address are looked up by our server, by the fish's scientific name only, from iNaturalist (photos shared under CC0 or CC BY) and Wikipedia (text under CC BY-SA). Your photo is not sent to iNaturalist or Wikipedia, and our server does not pass on your IP address.
  • The reference photo itself: your browser loads the reference photo directly from iNaturalist's open-data storage on Amazon S3 (inaturalist-open-data.s3.amazonaws.com), like any image on a web page. That service sees your IP address and browser details when the photo loads, and handles them under iNaturalist's privacy policy and Amazon's own policies. We tell your browser not to send it the address of our page.

Your location, for fishing rules

Under a result we link to the official fishing rules of your US state. To pick the state:

  • If your photo has a location in it (GPS data some cameras save), your browser reads it from the photo on your device and works out the state there. The photo we send for identifying has no location in it.
  • If not, you can tap "Use my location": your browser then asks your permission, and the location is used the same way. We never ask without that tap.
  • Or you pick your state from a list.

Coordinates stay on your device: they are not sent to us or to anyone else, and they are not stored. To look up the state, your browser downloads a map of state outlines from our site; it sends nothing about where you are. If you picked a state or used "Use my location", your browser remembers only the two-letter state code (for example "NC") in its local storage, so the next photo shows your state's rules. A state read from a photo is not remembered.

When you click a rules link, Google Analytics receives the state code, whether it was the freshwater or saltwater link, and how the state was found (from the photo, your device, the list, or remembered). It never receives the coordinates.

Your daily scan count

Each visitor gets 5 free scans a day (by UTC day), and up to 20 tries in all. To enforce this without accounts, our server stores:

  • a keyed hash (HMAC-SHA256 with a secret key) of your IP address, never the IP address itself;
  • the date and how many scans and tries were used that day;
  • for each scan, a random one-time code that allows one second opinion within 30 minutes.

Counts older than 2 days are deleted automatically, and the one-time codes are deleted after they expire. The hash cannot be turned back into your IP address without our secret key, and we do not combine it with anything else.

Your collection

When you tap "Save to my collection", the fish's name and a small thumbnail of your photo are stored in your browser's own storage (IndexedDB) on this device. Your collection stays in your browser: it is not uploaded, and we cannot see it. Clearing your browser data, or removing a fish on the collection page, deletes it.

What we do not collect

  • We do not require an account, so we do not collect names, email addresses or passwords.
  • We do not take payments.
  • We do not sell or share personal data.

Server logs

Like any website, the hosting provider that serves this site (Vercel) may automatically record standard request information such as IP address, browser type, the page requested and the time of the request. These logs keep the site running and secure, and are handled under the hosting provider's own privacy policy.

Analytics

We use Google Analytics to understand how the site is used. It records page views, your approximate location (country or city), browser, operating system and the site that referred you. When you use the tool, it also records counts, such as how many candidates a scan returned, how confident the top one was, whether a second opinion was asked for and how many fish are in your collection. The species found, your photos and file names are never sent.

Google Analytics is provided by Google and processes this data under the Google Privacy Policy. You can see how Google uses data from sites that use its services, and you can opt out with the Google Analytics Opt-out Browser Add-on.

Visitors from the European Economic Area, the United Kingdom and Switzerland are not given analytics cookies by default; only cookieless, anonymous measurements are sent.

Cookies

Google Analytics sets first-party cookies (named _ga and _ga_*) to tell new visits from returning ones. They contain a random identifier, not your name or photos. You can block or delete them in your browser settings; the site works the same without them. We do not use cookies for advertising.

Children

This site is not directed at children under 13 and does not knowingly collect information from them.

Changes to this policy

If this policy changes, the updated version will be posted on this page with a new date.

Contact

Questions about this policy or your privacy: hello@whatfishisthis.com.

Catch details in the Florida checker

Species confirmation, catch date, water, time zone, measured length and already-kept count are processed locally. The checker does not save or send those inputs. Analytics records only the state code and whether a check returned insufficient information, a release reason or a conditional result.