Merman privacy notice
Operated by Alex Nercessian. Contact: [email protected].
Effective for beta build 67. This notice covers the configured Merman service and its current web interface.
Information and purposes
Supabase Auth and the operator's configured email delivery provider process your email address, sign-in codes and authentication/security records to verify access. Merman stores encrypted email/session information for up to one hour. Sign-in replaces previous Merman sessions. No password is stored by Merman.
Questions, conversation context and selected locations are sent to the operator's Merman server to answer your requests. Gemma runs on that server, not on your phone. Routine conversations are not saved on the beta server unless you choose Save current conversation or Report answer. They stay in the page's memory while it is open.
Saved trip notes, catch details, exact coordinates and uploaded catch photos are stored privately under your account until you delete them or the account. They are encrypted on disk. The operator controls the server and encryption key; this is not end-to-end encryption. Catch photos are resized and image metadata is removed. Beta photos are not used for model training and there is no public beta catch feed.
Fish-identification images are processed by the operator's local model. Submitted reports contain only the answer excerpt, reason and comment shown in the report form, tied to your account. Reports are available to the operator for review and expire after 30 days while the service runs. Do not put another person's personal information in a report.
Location and service providers
You may select a map point manually; account access does not require background location. Map tiles are loaded from Esri, which receives your IP address and requested map area. NOAA/NWS, Open-Meteo, MET Norway and other linked public data services may receive selected coordinates or area queries from Merman's server to supply conditions. Following an external data link opens that provider's service under its own policy.
The service uses temporary hashed network identifiers for rate limits. Merman's supplied server launcher disables access logs, and the supplied proxy configuration does not enable access logging. Hosting, network, Supabase and email providers may maintain their own operational records; ask the operator about their configured retention. No advertising or analytics SDK is included in this update. Enabling extra providers or SDKs requires updating this notice.
Your controls and deletion
You can use the guest map, sign out on all Merman devices, delete saved trips or catches, report an answer, and delete your account from Profile. The external deletion page is also linked below. A fresh sign-in within 10 minutes is required for deletion. It removes active Merman records and the Supabase account. If the provider is unavailable, access is revoked and a persisted deletion job retries when the server runs. Contact the operator for confirmation or if you cannot sign in.
This build makes no automatic backups of account data. If the operator adds backups, the operator must define and disclose their retention and carry deletion requests through restores before public use. Hosting/provider records outside Merman's control are handled by the operator under the applicable provider arrangements.