← Tish the Fish Slovenščina

Privacy Policy

Last updated: 15 October 2026

The short version: your tank, your fish and your screen time stay on your iPhone, and there's no account. We advertise on Facebook and Instagram. Only if you allow it (in the app through Apple's tracking prompt, on the website through the cookie banner) does Meta tell us whether you came to Tish through one of our ads. On the website we count visits without cookies.

1. Who is responsible

Tish the Fish is made by Nik Lorbeg, an independent developer in Slovenia (EU), who is the controller under the EU General Data Protection Regulation (GDPR) for the data described here. Contact: support@tishthefish.com.

2. The app

Your tank stays on your iPhone

Your tank, your fish, your settings, the apps you picked, the minutes counted and your focus sessions are stored only in the app's storage on your device. We have no server and never receive this data. Deleting the app deletes it. Your iPhone may include it in your own iCloud or computer backups, which Apple handles according to your settings.

Screen Time

With your permission, the app uses Apple's Screen Time frameworks (Family Controls, Device Activity and Managed Settings) to count the time you spend in the apps you choose and to block them while your tank is empty or a focus session runs. Apple only gives the app anonymous tokens, so the app can't see which apps or websites you picked, and your Screen Time data never leaves your device. It is never shared with Meta or anyone else. You can withdraw the permission at any time in Settings › Screen Time.

Notifications

Low-water and focus notifications are scheduled on your iPhone. Nothing is sent through a server. You can turn them off in the app or in your iPhone's settings.

Ad measurement with Meta (only if you allow it)

The app includes Meta's software development kit (the Meta SDK) so we can see which of our ads on Facebook and Instagram lead to installs. It only starts if you tap "Allow" on Apple's prompt asking whether Tish the Fish may track you. If you don't allow it, the Meta SDK is never started and the app sends nothing to Meta.

If you allow it, the app tells Meta when it is installed and opened. With that, Meta receives your device's advertising identifier, technical device information (such as model, iOS version, language and time zone) and your IP address. Meta uses this to match app installs to ads you saw or tapped and to show us the results. We only see aggregated reports, never data about you as a person. Your tank, your fish, your screen time and the apps you picked are never sent.

The legal basis is your consent (Art. 6(1)(a) GDPR). For collecting and sending this data, we and Meta Platforms Ireland Ltd. (Merrie Hall, 4 Grand Canal Square, Dublin 2, Ireland) are joint controllers (Art. 26 GDPR), under Meta's Controller Addendum; Meta then processes the data as its own controller under Meta's privacy policy, where you can also exercise your rights with Meta. Meta may transfer data to Meta Platforms, Inc. in the USA, covered by the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses. You can withdraw your consent at any time in your iPhone's Settings › Privacy & Security › Tracking.

Apple

Apple processes data when you download the app from the App Store. If you allow it in your iPhone's settings (Privacy & Security › Analytics & Improvements), Apple shares crash reports and usage statistics with developers in anonymous, aggregated form. Apple is responsible for that processing; see Apple's privacy policy. If you join beta testing through TestFlight, Apple shares your name, email address and any feedback you send with us, and we use it only to run the beta.

3. The website

tishthefish.com and its subdomains are hosted by Vercel Inc. (USA). When you visit, your browser sends technical data such as your IP address, the date and time, the page requested and your browser type. Vercel processes this in server logs to deliver the site and protect it from abuse, and deletes the logs after a short time. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Vercel acts as our processor under a data processing agreement; transfers to the USA are covered by the EU–US Data Privacy Framework and the European Commission's Standard Contractual Clauses.

Visitor statistics (no cookies)

On the home page we count visits with Vercel Web Analytics, so we know how many people visit, which pages they open, where they came from (for example a search engine or a link) and how often App Store buttons are clicked. It sets no cookies and stores nothing on your device. To tell visits apart without identifying you, Vercel derives a short-lived code from your request (including your IP address and browser) that changes every day; your IP address itself is not stored. We only see totals, such as numbers of visitors by country, browser, operating system and device type. The legal basis is our legitimate interest in understanding how the website is used (Art. 6(1)(f) GDPR). Vercel processes this as our processor, as described above.

Meta Pixel (only if you accept)

On tishthefish.com we'd like to use the Meta Pixel to see which of our ads bring people to the site. It only loads if you click "Accept" in the cookie banner; until then nothing is sent to Meta and no Meta cookies are set. If you accept, the Pixel sends Meta your IP address, browser information, the page you're on and where you came from, and that you clicked an App Store button. It sets the cookies _fbp (to recognise your browser, 90 days) and, if you arrived from a Meta ad, _fbc (90 days). If you're logged in to Facebook or Instagram, Meta can connect this to your account.

So that ad measurement still works when a browser blocks the Pixel, the same events (the page visit and App Store clicks) are also sent to Meta from our server through Meta's Conversions API, also only after you accept. With them go your IP address, your browser's user agent and the _fbp and _fbc values, never anything about your tank or screen time. Meta uses a shared event ID to count each event only once. Vercel runs this server code as our processor.

The legal basis is your consent (Art. 6(1)(a) GDPR, and the Slovenian Electronic Communications Act for the cookies). As in the app, we and Meta Platforms Ireland Ltd. are joint controllers for collecting and sending the data, and Meta then processes it under its own privacy policy, with possible transfers to the USA as described above. You can change your choice at any time with "Cookie settings" at the bottom of the home page, or at tishthefish.com/#cookies; declining deletes the Meta cookies. Your choice itself is saved in your browser's local storage, not in a cookie.

The legal pages (privacy, terms, support) use no cookies, no Pixel and no visitor statistics. Fonts are served from our own domain. Links to other sites, such as the App Store, follow those sites' own privacy policies.

4. Our ads on Facebook and Instagram

We advertise Tish the Fish on Meta's platforms. When you see or tap one of our ads there, Meta processes that under its own privacy policy and your Meta ad settings. We choose broad audiences (for example by country, age range and interests) and receive only aggregated statistics, such as how many people saw or tapped an ad.

5. When you email us

If you write to support@tishthefish.com, we use your email address and message only to answer you. The legal basis is Art. 6(1)(b) GDPR when it's about using the app, and otherwise our legitimate interest in answering (Art. 6(1)(f)). Our email provider stores the messages on our behalf. We delete conversations once they're no longer needed, and at the latest two years after the last message, unless the law requires us to keep them longer.

6. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18), to data portability (Art. 20), to object to processing based on legitimate interest (Art. 21), and to withdraw your consent at any time without affecting what happened before (Art. 7(3)). Because the app's data stays on your device, you control it directly: deleting the app erases it. For data Meta holds, you can also contact Meta through its privacy policy. For anything else, email us and we'll reply within one month.

You can also complain to a data protection authority, in particular in the EU country where you live or work. In Slovenia that's the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, ip-rs.si.

7. Children

The app is suitable for all ages. We don't aim our ads at children, and ad measurement only happens with consent. On iPhones set up for children through Family Sharing, Apple doesn't let apps ask to track.

8. Changes

If the way the app or website handles data changes (for example when in-app purchases are added), we'll update this page and the date at the top before the change takes effect.