Shellmark

Shellmark Privacy Policy

Effective date: November 1, 2026

Shellmark is published by Brainstorm Innovative Technologies, LLC ("Brainstorm," "we," "us"). This policy explains what Shellmark does and does not do with your information. It is written to match what the app's code actually does, not a generic template -- where a claim below is specific about a mechanism, that mechanism exists in the shipped app.

If you have questions, contact us:

The short version

Shellmark has no user accounts, no sign-in, and no server of its own that receives your harvest log, your photos, or your saved spots. Your harvest log stays on your device. Your GPS position is used to tell you whether you are in an open harvest zone, and to fetch current weather/tide/marine conditions from public government and weather-data APIs -- it is not sent to Brainstorm. Shellmark does not run any first-party analytics or telemetry. The app shows non-personalized ads through Google AdMob, and offers optional in-app purchases handled entirely by the Apple App Store or Google Play.

Location data

When you grant Shellmark permission, we read your device's GPS position only while the app is in use (in the foreground). Shellmark never requests, and the app's configuration explicitly blocks, background location access on both platforms.

Your position is used for two things:

  1. Zone and season status. Your coordinates are compared, on your device, against Shellmark's built-in harvest-zone boundaries to determine whether you are inside an open zone, near a boundary, or in a no-take area. This computation happens entirely on your device. We do not operate a server that receives your position for this purpose, and no Shellmark server logs, stores, or sees your coordinates.
  2. Current conditions. To show you live wind, weather, wave, and tide information for where you are, Shellmark sends your coordinates, as part of the request, to the public weather and government data services listed below. These are one-time, stateless lookups made directly from your device to that provider each time you refresh conditions -- not stored by Shellmark, and not routed through any Brainstorm server.
    • National Weather Service (api.weather.gov, a NOAA service of the US government) receives your precise latitude/longitude to return current weather, wind and sea conditions. The National Weather Service requires no account or API key from us. Shellmark attaches no name, account, or Shellmark-generated identifier to the request. As with any internet request, your device's IP address is visible to the National Weather Service. What the National Weather Service does with a request is governed by its own policies, not by us. See the National Weather Service privacy policy for details.
    • NOAA CO-OPS (api.tidesandcurrents.noaa.gov) does not receive your raw coordinates. Shellmark determines the nearest public NOAA tide station on your device and requests only that station's tide data by its public station ID.
    • National Weather Service marine forecast (api.weather.gov): for the marine forecast text and active alerts, this separate request carries only a public marine zone code (for example, the zone covering your general area), not your coordinates.

None of these requests carry your name, an account identifier, or any Shellmark-generated identifier -- they carry only the coordinates or codes needed to answer "what are conditions here." These providers are outside our control once a request reaches them; see their own privacy terms for how they handle inbound requests.

Declining location permission does not block the app: Shellmark shows a "VERIFY" status and the season/limit reference screens without your position, consistent with the app's rule that missing information degrades toward "verify," never toward a false "open."

Regulations data

Shellmark fetches its Florida shellfish regulations and emergency-closure data from a Cloudflare Worker we operate. This channel is read-only: it serves static, baked-in JSON over GET requests and does not read or log any request body, query parameter, or header identifying you or your device. As with any internet request, your device's IP address is visible to Cloudflare and may be retained in transient server logs. If that fetch fails, the app falls back to the regulations data bundled inside the app itself. Always verify current FWC rules before you harvest.

Your harvest log

The harvest log (species, quantity, notes, an optional photo, and an optional saved spot) is stored only on your device, using local device storage. This module has no network code at all -- an automated test in Shellmark's own test suite fails the build if any network or analytics call is ever added to the harvest-log storage module. The module also never writes a log entry's contents (species, notes, photo, or spot) to the device console. Deleting an entry, or uninstalling the app, removes it -- there is no copy anywhere else.

Spot coordinates you save in the harvest log stay on your device by default. Export strips them by default and includes them only on an explicit per-export opt-in. See "Export" below for details.

Photos

If you attach a photo to a harvest log entry, Shellmark stores a reference to that photo on your device only. Photos are never uploaded, transmitted, or sent to Brainstorm or to any third party.

Export

Export creates a file on your device and opens the system share sheet, where you choose where it goes (email, cloud storage, another app). Shellmark itself never uploads your log -- your device hands the file directly to whatever destination you pick. The export strips spot coordinates by default, carrying only dates, species, and counts, with an "Include my spot locations" switch shown at export time that is off by default.

Advertising (Google AdMob)

The free version of Shellmark shows ads served by Google AdMob (react-native-google-mobile-ads). Ad requests are always non-personalized in our code, with no setting to change it.

Even in non-personalized mode, the Google Mobile Ads SDK itself -- code written and operated by Google, not by us -- collects some device data as part of serving and measuring ads: device and advertising identifiers, IP-derived coarse location, ad-interaction and diagnostic data. This collection happens inside Google's SDK, independent of anything Shellmark's own code does. We do not control what Google's SDK collects, and we are disclosing it here because it is honest to say so, not because our own code performs this collection. See Google's disclosure for sites and apps that use its services (policies.google.com/technologies/partner-sites) and its advertising ID disclosures (support.google.com/admob/answer/9012903) for what Google collects and how it is used.

In-app purchases

Shellmark offers an optional yearly Pro subscription and an optional 30-day season pass. Purchases are handled entirely by the Apple App Store or Google Play -- Shellmark's own code never collects or sees your payment card number, billing address, or other payment details. Our code only stores, on your device, which product you bought and when your entitlement expires, so the app can unlock Pro features. This entitlement record is periodically re-checked; if it cannot be verified it is treated as not Pro (fail-closed) rather than trusted indefinitely.

Analytics and telemetry

Shellmark ships with no first-party analytics or telemetry SDK of any kind -- none is listed in the app's dependencies, and none is imported anywhere in the app's source. We do not know how many times you opened the app, what you tapped, or how long you used it, because nothing in Shellmark collects that.

Data we do not collect

Shellmark has no account system, no sign-in, no name, no email address collection, and no way to link anything in the app back to your identity. There is no user-generated content shared with other users or with us -- your harvest log is private to your device.

Children

Shellmark is not directed at children and is not designed to collect information from anyone. Because the app collects no personal information of its own and requires no account, there is nothing for a child (or anyone else) to hand over to us in the first place. The one exception is the Google AdMob SDK described under Advertising above: it collects device and advertising identifiers whenever ads are shown, regardless of who is using the device. Shellmark always requests non-personalized ads and provides no setting to change that.

Data retention

On-device data (your harvest log and your entitlement cache) is retained until you delete it in the app or uninstall Shellmark. We retain nothing on our own servers because none of this data is sent to a server we operate.

Security

Location, weather, and regulations requests all travel over HTTPS. Because Shellmark stores your harvest log and entitlement record only on your device, their security depends on your device's own protections (passcode, disk encryption, app sandboxing).

Your rights

Depending on where you live, you may have rights over your personal information, such as the right to know what is collected, to request its deletion, or to object to certain processing. Because Shellmark stores your harvest log and saved spots only on your device and operates no account system, the practical way to exercise these rights over that data is to delete entries in-app or uninstall the app. For anything you believe Brainstorm does hold about you, contact us at support@brainstorminnovative.com and we will respond.

About this website

This page, and the terms and support pages, set no cookies, run no analytics or tracking scripts, and load no third-party resources. The homepage loads its display fonts from Google Fonts; these legal pages do not. This website is a static set of pages published by Brainstorm Innovative Technologies, LLC.

Changes to this policy

If we change what Shellmark collects or how it is used, we will update this document and change the effective date above. Material changes (for example, the export feature described above shipping) will be called out specifically rather than folded in silently.