Privacy Policy

Last updated: April 30, 2026

1. Introduction

Cull ("we," "us," or "our") is operated by Tomas Giannini, based in Ontario, Canada. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the Cull mobile application (the "App"), the Cull website at cull-website-neon.vercel.app (the "Site"), including the waitlist form, and all related services (collectively, the "Services").

We are committed to protecting your privacy in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian provincial privacy legislation. By using our Services, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy.

2. Information We Collect

2.1 Information You Provide Directly

• Account Information: Legal first and last name, email address, date of birth (to verify you are 18+), and province of residence.
• Username / Handle: A public-facing @handle you choose or that is auto-generated from your name at signup. Your handle is visible on leaderboards and tournament records.
• Payment Information: When you enter paid tournaments or receive prize winnings, we collect payment details through our payment processor, Stripe. We do not store your full credit card number, bank account number, or other sensitive payment credentials on our servers. Stripe handles all payment data in accordance with PCI-DSS standards.
• Identity Verification: We may request government-issued ID to verify your identity for prize distributions exceeding certain thresholds or for regulatory compliance purposes.
• Catch Submissions: Photos and videos you submit during tournaments for AI-based species and catch verification, including bump board photos, hero photos, and release videos.
• Waitlist Sign-Up: If you join our waitlist on the Site, we collect your email address to notify you when the App becomes available.
• Communications: Messages, feedback, or support inquiries you send to us.

2.2 Information Collected Automatically

• GPS Location Data: With your permission, we collect precise GPS location data when you submit a catch during a tournament. Location data is used to verify that catches are made within designated tournament boundaries. We do not track your location in the background or when the App is not actively in use for a tournament.
• Push Notification Tokens: If you grant permission, we collect your device push notification token to send you tournament alerts, leaderboard updates, catch verification results, and prize distribution notices. You may opt out at any time through your device settings.
• Device Information: Device type, operating system, unique device identifiers, and app version.
• Usage Data: Pages viewed, features used, timestamps, and interaction patterns within the App and Site.

3. How We Use Your Information

We use the personal information we collect for the following purposes:

• Providing the Services: Creating and managing your account, processing tournament entries, verifying catches via AI analysis, maintaining leaderboards, processing prize distributions, and communicating with you about your account and tournaments.
• Age and Eligibility Verification: Confirming that you meet the minimum age requirement (18+) and are located in an eligible Canadian province.
• Location Verification: Ensuring catch submissions originate from within valid tournament boundaries using Ontario Hydro Network (OHN) geofencing data.
• AI Image Analysis: Submitting your catch photos and videos to AI analysis systems (including Apple Vision and the Anthropic API) to verify species identification, read bump board measurements, and validate tournament entries.
• Payment Processing: Facilitating entry fee collection and prize distributions through Stripe, including payout review and dispute resolution during the mandatory 48-hour review window.
• Push Notifications: Sending you tournament alerts, catch verification results, leaderboard updates, and prize notices where you have granted permission.
• Safety and Integrity: Detecting fraud, enforcing our Terms of Service, preventing cheating, and maintaining the integrity of tournaments.
• Waitlist Communication: Notifying waitlist subscribers when the App launches or when relevant updates are available.
• Improvement: Analyzing usage patterns to improve App features, performance, and user experience.
• Legal Compliance: Meeting our obligations under applicable laws and regulations, including Canadian tax and financial regulations.

4. Third-Party Service Providers

We share your personal information with the following third-party processors. Each processes data solely on our behalf and in accordance with our instructions:

4.1 Supabase (Database & Authentication)

• Data processed: Account information, tournament records, catch submissions, leaderboard data.
• Server location: United States.
• Purpose: Cloud-hosted database and user authentication infrastructure.
• Privacy details: supabase.com/privacy

4.2 Stripe (Payment Processing)

• Data processed: Payment information, legal name, email address, prize distribution details.
• Purpose: Processing tournament entry fees and prize distributions.
• Privacy details: stripe.com/privacy

4.3 Anthropic (AI Catch Verification)

• Data processed: Catch photographs and videos submitted during tournaments.
• Purpose: AI-powered fish species identification and catch verification.
• Data retention: Images and videos are submitted via API for real-time analysis only. We do not authorize Anthropic to retain submitted media for model training or any purpose beyond providing the analysis response.
• Privacy details: anthropic.com/privacy

4.4 Apple (On-Device Processing)

• Data processed: Bump board photos processed locally on your device via Apple Vision Framework for OCR (optical character recognition) to read measurement values.
• Purpose: On-device text recognition to extract fish length measurements from bump board images.
• Note: This processing occurs entirely on your device. No image data is transmitted to Apple for this purpose.

5. Cross-Border Data Transfers

Your personal information may be stored and processed in the United States through our use of Supabase and other service providers. By using the Services, you acknowledge and consent to the transfer of your personal information outside of Canada. While your data is stored in the US, we ensure that our service providers maintain appropriate safeguards consistent with PIPEDA requirements through contractual obligations.

6. Data Retention

• Account data: Retained for as long as your account is active. Upon account deletion, personal information is removed within 30 days, except where retention is required by law.
• Tournament and catch records: Retained for the duration of your account plus 2 years after account deletion for dispute resolution and regulatory compliance.
• Payment records: Retained for 7 years as required by Canadian tax and financial regulations.
• GPS location data: Associated with individual catch submissions and retained as part of the tournament record for the same period as tournament records.
• Catch photographs and videos: Retained for the duration of the tournament plus 90 days for dispute resolution (including the mandatory 48-hour payout review window), then deleted unless required for ongoing investigations.
• Waitlist email addresses: Retained until the App launches and you have been notified, or until you unsubscribe, whichever comes first.
• Push notification tokens: Retained while your account is active. Automatically invalidated if you revoke notification permissions on your device.

7. Your Rights Under PIPEDA

As a Canadian resident, you have the following rights regarding your personal information:

• Access: You may request access to the personal information we hold about you.
• Correction: You may request that we correct inaccurate or incomplete personal information.
• Withdrawal of Consent: You may withdraw your consent to our collection, use, or disclosure of your personal information at any time, subject to legal or contractual restrictions. Withdrawing consent may limit your ability to use certain features of the Services.
• Deletion: You may request the deletion of your account and personal information, subject to our legal retention obligations.
• Opt Out of Push Notifications: You may opt out of push notifications at any time through your device's notification settings.
• Complaint: You have the right to file a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

To exercise any of these rights, contact us at the email address below. We will respond to your request within 30 days.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit (TLS/SSL) and at rest.
• Access controls limiting access to personal information on a need-to-know basis.
• Regular security assessments of our infrastructure and service providers.
• Secure authentication mechanisms including password hashing.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security.

9. Children's Privacy

The Services are intended for individuals aged 18 and older. We do not knowingly collect personal information from anyone under the age of 18. Age verification is required at account creation. If we learn that we have collected personal information from a person under 18, we will delete that information and close the account promptly.

10. Geographic Restriction

The Cull App is currently available to residents of Canada only. Competitive tournaments with real-money prize pools are available to eligible residents of Ontario only, consistent with applicable skill-based contest laws. We use location verification to enforce these restrictions. If you access the Services from outside these regions, certain features will not be available to you.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy in the App and on the Site, and updating the "Last updated" date above. For significant changes, we may also notify you by email or push notification. Your continued use of the Services after changes are posted constitutes your acceptance of the updated Privacy Policy.

12. Contact Us