Privacy & terms
What this site collects
You can now create an account. An account here is one email address, the waters you follow, and, if you keep one, a catch log you write yourself: no password, no name, nothing about you beyond the address you signed in with and whatever you choose to put in that log. Nothing on this site requires one. Every page of regulations works with no account, and works with this site's server switched off entirely. There are two forms, both on the account page. Four things happen, and this is all of them.
Anonymous page counts. This site uses Vercel Web Analytics to count page views, and Vercel processes those counts. Vercel says it sets no cookies, does not follow you across sites and builds no profile of a visitor. Those are Vercel's statements about its own software rather than something this site can verify, and they are set out in How Vercel Web Analytics handles data.
Hosting. Vercel serves these pages, and like any host it processes your IP address and the ordinary details of the request in order to deliver them. Those logs belong to Vercel and are governed by Vercel's policy. This site collects none of them and keeps no copy of them. Vercel's privacy notice.
Email. If you write to the address below, we then have your address and whatever you wrote. It is used to answer you. It is never added to a mailing list and never passed to anyone else.
The sign-in form is on the account page, behind the account icon at the top of every page here. It posts one thing, to /api/signin: the email address you typed. It creates: typing an address here is how an account comes to exist, because there is no other way in. The reply on screen is the same whether or not that address has ever been here; the mail says whether anyone has ever signed in to that account, because only the address it was sent to receives it. An account nobody has ever signed in to is deleted within eight days, and what actually signs you in is a link sent to that address, so an address you cannot receive mail at is of no use to anyone typing it. Beyond that address, the only thing this site records is which waters you follow, whether you press Follow on a water's own page or Remove on the account page; no map and no search collects a thing.
The email list
Three kinds of email can come from this list, and no others. The sign-in link; a digest of what changed on the waters you follow; and one email for a water you follow, when the site publishes a change to it. The last two are each something you switch on, and off again, on the account page. Both quote the site's own published changes and link the page each one came off, cover only the waters you follow, and carry a one-click unsubscribe. This paragraph changes in the release that changes any of it.
Nothing joins the list until you use a link sent to that address. The only way onto the list is your account: signing in is a link sent to the address you typed, and a water you follow while signed in is added at once, because receiving and using that link is what proves the address is yours. What you picked is kept until you change it or leave.
Both are sent only if you ask for them. Following a water puts it on your list and nothing else: it does not send you a digest and it does not send you anything when that water changes. Each of those is its own choice on the account page, off unless you turn it on, and each can be turned off on its own without changing the other or the waters you follow.
Leaving takes one click. Unfollowing a water, from its own page or from the account page, takes it off one at a time, and deleting the account removes the lot. Every digest, and every email about a change, also carries a link that takes you off entirely, which your mail app may show as its own Unsubscribe button; following it deletes every water this address is confirmed for rather than flagging it. When the last thing you asked for goes, the record of your address goes with it. You can also write to the address below and ask to be removed, and you do not have to say why.
Where it is held. The list is stored with Supabase, on servers in the United States, in Supabase's West US region in Oregon. Email from this list is sent through Resend, which processes your address in order to deliver it. Both handle this data on this site's behalf and neither is given the list for anything else. How each of them handles data is governed by its own policy rather than by this page: Supabase's privacy policy and Resend's privacy policy.
What the list does not hold. No password, because there is none anywhere here. No copy of anything this site publishes: it records who asked, never what the site claims. The links in an email, and the value in the sign-in cookie, are stored only as one-way hashes, so neither the list nor the account records can be used to unsubscribe you or to sign in as you.
Your account
An account is an address and four dates. What is stored is the address you typed, when a sign-in link was last sent to it, when that link stops working, when you last signed in, and when the account was made. No password, because there is none: signing in is a link sent to the address, which is the same proof the email list has always run on. No name, no profile, nothing about which pages you read. When an email about a change is sent to it, the account also keeps which change that was, which water, and when, so the same change is never sent twice. Those records go when the account does.
Signing in sets two cookies, and they are the only cookies this site sets. The first is called shinook_session and it holds a random value and nothing else: no address, nothing about you, and nothing this site publishes. It is marked HttpOnly, so no script on the page can read it. The second is called shinook_signed_in and it holds a single fixed value saying that somebody is signed in on this browser: not your address, and nothing about which account. The pages read it only to decide whether to ask this site who you are, so a page you open while signed out asks nothing at all. Both last 90 days unless you sign out first. Signing out clears both and deletes the matching record here, so the session ends rather than being marked as ended. Apart from those cookies, nothing that identifies you is stored in your browser.
An account nobody signs in to is deleted within eight days. Anyone can type any address into the sign-in form, so an account that has been made and never used is treated as what it is, an address somebody typed into a form: it goes, along with the sign-in link that would have opened it. Eight rather than seven for the same reason as above: it becomes deletable after seven days and a sweep runs once a day, so the longest it can stand is a day longer than that.
Your waters are changed from the account page. Adding a water puts it on your list and removing takes it off, each one on its own and at once. Each change posts one thing to /api/account: the water you added or removed. Neither sends you an email: reaching that page took a link sent to your address, which is the same proof signing in asks for.
An account can hold a feed link. It is a web address with a random value in it, made when you press the button on the account page, and a feed reader uses it to follow the changelog. Only a one-way hash of that value is stored, like the links in an email, so nothing here can show you the link again or use it. Reset makes a new one and stops the old one working; Remove stops it and makes none.
A catch log is yours alone. If you keep one, an entry holds what you write in it: when you caught a fish, which of the waters here, which species, whether you kept it, and, if you fill them in, a length, the gear and a note. You can add a photo, and it is stored with the entry. An entry posts to /api/catches and a photo to /api/catch-photo. Nothing this site serves shows an entry or a photo to anyone but the account that wrote it: every request for one is answered only for that account, and an entry is never shown on a page, sent in an email, or counted into anything. If you press Use my location, the position your browser reports is saved on that entry, with how accurate it says the fix was, and the page shows both so you can see what was recorded and take it off. Nothing reads it but you: it is not shown to anyone else, it is not used to work out anything about you, and it goes when the entry or the account does. Leave the button alone and no position is stored at all. Entries and photos are held with Supabase alongside the account. Download CSV gives you your own entries as a file.
Deleting the account is a button on that page. It removes the account record, every water the account holds, your catch log and its photos, the feed link if there is one, the record of emails sent to it, and every signed-in session it has, on every device. Nothing is flagged and nothing is kept back for a grace period, and the record of the address goes with the last thing that named it, so nothing further is sent to it. The address is not blocked afterwards: signing in with it again makes a new account with nothing in it. You can also write to the address below and ask instead, and you do not have to say why.
What stays on your device
This site saves copies of what you open in your browser's cache, so it keeps working at the riverbank where there is no signal. That cache holds the pages you have opened, the text of any fishery notice you have expanded, and the code that draws them. So it is a record on this device of which pages you opened here, in the way your browser history is. It holds nothing that identifies you, and it never leaves your device. Clearing this site's data in your browser clears it. The account page is outside all of that: it saves nothing on your device, not your address and not the link from your email, and nothing it exchanges with this site is ever cached. The one thing signing in does leave on your device is the two cookies described above, and clearing this site's data clears them too, which signs you out here.
The “nearest water” button asks your browser where you are, and only when you tap it. Your position is used on your device to work out which water is closest. It is not sent to this site, not saved anywhere, and gone as soon as you leave the page.
Which page you were reading stays here too. Every link out of this site, to DFO, to the river gauges, to the other official pages and to the policies linked above, is set not to pass on where you came from, so those sites see that someone arrived and not which page here sent them.
Privacy requests
Unless you have emailed us or made an account, this site holds nothing about you to show you or to delete. If you have, write to info@shinook.ca and say what you would like. Ask for the thread to be deleted and it gets deleted. Ask to come off the email list and you come off it, and the link at the bottom of any digest does the same thing without asking anyone. Ask for your account to be deleted and it goes, with everything keyed to it, and the button on the account page does that one without asking anyone either.
Terms of use
This site is informational. It is not legal advice and it is not the regulations themselves. DFO's fishery notices and regulation pages are what governs the water, and a fishery notice outranks anything published here. Check them before you fish.
The site is offered as it stands, with no warranty that it is current, complete or correct. Decisions you make about fishing are yours, and no liability is accepted for them. That covers the email list too: no email from it is a regulation, and none of it is a promise that you will be told anything in time to act on it.
Regulation text quoted here comes from DFO sources and belongs to them. The base map geography is used under the Open Government Licence, BC. Both are credited on the Sources page.
Changes to this page
This page describes the site as it is, and that is the whole of its job. The email-list section was rewritten in the release that retired the anonymous sign-up page, and the account section was written in the release that shipped signing in, which is the rule: if this site starts collecting something new, or starts sending something it does not send today, this page changes in the release that ships it and the date at the top moves with it. A policy that writes down a plan as though it were already true would be the same overstatement this site refuses to make about a river.