Maintained by Pablo Ruiz Quintero. Last reviewed . Everything below was checked against the source code of this site on that date, not copied from a generator.
Most privacy pages are written to cover the site, not to inform the reader, which is why they list things the site does not do and omit the one script that it does. This one is the other way round. It names the single third-party script that runs here, the exact columns the catch form writes, the country the database sits in, and the parts of the internet your browser never contacts while reading a report.
The short version
There are no accounts on this site, so there is nothing to log in to and no profile to build. There is no newsletter, no comment system and no social widget. Nothing here is sold or shared with a data broker. Three things collect anything at all: Google Analytics and Google AdSense, which shows the ads, on every page, and the catch report form, only if you choose to fill it in. All three are described below in the detail that actually matters. Ads never decide what a report says, and no one can pay for a place in one.
Analytics
The site runs Google Analytics 4 (property G-QXYYHJYT8Y), one of the two third-party scripts on the site; the other is the advertising script described in the next section. It sets its own cookies in your browser — the ones named _ga and _ga_<id> — and reports to Google which pages were opened, roughly where in the world from, on what kind of device, and which site sent you. That is used for one thing: deciding which waters and which questions deserve work next.
Two things worth being plain about. First, this is a real third party: what it collects goes to Google under Google’s terms, not ours. Second, at the time of writing the site does not show a consent banner, so those cookies are set before you are asked. That is a gap, it is being worked on, and saying so here is better than pretending otherwise. Until then, if you would rather not be counted, a browser that blocks third-party cookies, any content blocker, or Google’s own opt-out extension will all stop it, and nothing on the site will break: every page here is rendered on the server and works with scripts disabled entirely.
Advertising
Since 29 September 2026 the site shows ads served by Google AdSense (publisher ca-pub-7929736767830822). The ad script is loaded from pagead2.googlesyndication.com, and Google and its advertising partners may set or read cookies, or use similar identifiers, to show ads based on your visits to this and other sites, to limit how often you see the same ad and to measure and protect against fraud. Google’s own explanation is at How Google uses information from sites or apps that use its services.
You can turn off personalised ads from Google in Google’s Ad Settings, and from many other ad networks at aboutads.info. The same blockers that stop analytics stop the ads, and every page still works without them. Advertisers do not see the catch form or anything you send through it, and no ad or advertiser has any say in what a report, a licence page or a season date says.
If you visit from the European Economic Area, the United Kingdom or Switzerland, Google’s consent message (a consent management platform certified by Google) asks you first. Until you choose, Google Consent Mode keeps advertising and analytics storage switched off: ads, if any, are not personalised and no advertising or analytics cookies are set. You can change your choice at any time from the privacy and cookie settings link that the message leaves on the page.
The catch form
Every water page has a form for sending in a report of your own. If you use it, these are the columns it writes, and there are no others:
- water_slug — which water you were reporting on.
- angler_name — whatever you typed in the name field. It can be blank, and it can be a nickname.
- species and notes — what you caught and what you wrote about it.
- email — optional, and only so we can come back to you about your report.
- id, created_at and status — a random identifier, the timestamp, and whether the report is pending, approved or rejected.
No IP address is stored with the report, and no account is created. Since 19 October 2026 the data sits in a private Vercel Blob store in Dublin, Ireland, so submissions are stored inside the EU; before that it was a Postgres database run by Supabase, also in Ireland. Nothing is published automatically: every report waits in a moderation queue until a person approves it. If it is approved, the name, species, notes and date appear on that water’s page. Your email address is never published and is never used for a mailing list, because there is no mailing list.
Who your browser talks to
This is the part most privacy pages skip, and it is the most useful one. Reading a report on this site, your browser makes requests to this site, to Google Analytics and to Google’s ad servers, which may in turn load the ads and measurement of the advertisers Google chooses. Pages with a map also fetch map tiles from Esri (server.arcgisonline.com), which sees the tile requests but sets no cookie of ours. Nothing else.
In particular, the typefaces are compiled into the site at build time and served from our own domain, so no request goes to Google Fonts. There is no CDN in front of the assets. There are no embedded videos, social buttons or comment widgets. And although every report is built from USGS gauges, NOAA tide stations and Open-Meteo, your browser never contacts any of them: those are read on the server when the page is generated, so reading about a river does not announce you to a federal API.
Server logs
The site is hosted on Vercel, which keeps the ordinary request logs any web server keeps — IP address, time, URL, user agent — for a short period, and uses them to serve and protect the site. We do not build anything on top of those logs and do not connect them to anything else.
Having your data removed
If you sent a catch report and want it gone, or want to see what it says, write to hola@prqdigital.com from the address you used, or describe the report well enough to identify it. It will be deleted, not hidden. No explanation is required and nothing is negotiated: it is your report.
The site is run from Spain by one person, so the GDPR applies to it and the rights it gives you — access, correction, deletion, objection — are exercised through that same address. There is no form to fill in and no ticket number.
Changes to this page
When what the site does changes, this page changes first and carries the date: it did so on 29 September 2026, when advertising was added. If a consent banner appears, if analytics is replaced with something that does not use cookies, or if the form ever stores a field that is not in the list above, it will be described here on the day it happens. The verification log records the site’s own mistakes with dates, including the ones nobody would have noticed; this page is held to the same standard.