Privacy Policy

1. Who We Are

FlyTyingHub.com ("we", "us", "our") is an independently operated fly tying reference site based in the United States. We publish step-by-step fly tying recipes and curated material links to help fly fishers find the gear they need. We are not affiliated with any tackle manufacturer or retailer.

For the purposes of the UK and EU General Data Protection Regulation, we are the data controller for the information described below. You can reach us at privacy@flytyinghub.com.

2. Information We Collect

2a. Account Information

If you create an account, we collect your email address, a username you choose, and a hashed (never plain-text) password. We record the date you created the account and which version of this policy and our Terms you accepted at signup. We use your email address to send account-related messages such as email confirmation, password reset requests, and any notifications you explicitly opt into. We do not sell your email address.

2b. Profile Information

Your profile can optionally include a bio, location, personal website, favourite species, tying styles, social media links, and a profile picture. All of these are optional, and each has a visibility control in your profile settings that lets you choose whether it is public or visible only to you and site administrators. Profile pictures are re-encoded when uploaded, which removes embedded metadata such as camera details and GPS coordinates.

2c. Security and Anti-Abuse Logs

We record the following to protect accounts and prevent automated abuse:

• Login history — the date, IP address, browser user agent, and success or failure of each login attempt on your account. This lets us and you identify unauthorised access attempts. It is visible to site administrators.
• Account change history — the date and IP address whenever your username, email address, or password is changed, and whether you or an administrator made the change.
• Signup rate limiting — the IP address of each account-registration attempt, used to cap the number of signups from one address per hour. Signups are anonymous at that point, so the IP address is the only available signal.
• Submission rate limiting — the account ID and time of each content submission, used to cap submissions per hour. No IP address is recorded here.
• Email log — the date, subject, type, and destination address of account emails we send you, so we can confirm whether a password reset actually went out.

2d. Usage Analytics

We use Google Analytics 4 (GA4) to understand how visitors use the site — which pages are viewed, how long visitors stay, and which features are used. No analytics cookie is set unless you accept one; see Section 3.

To be precise about what happens if you decline: the Google tag still loads and sends Google an anonymous, cookieless signal that a page was viewed, which necessarily includes your IP address as part of the ordinary web request. Nothing is stored on your device, no identifier is assigned to you, and the visit cannot be linked to your other visits. If you accept, GA4 sets the cookies described in Section 3 and can then recognise you as a returning visitor.

In either case GA4 does not retain your IP address — it is used transiently to derive an approximate location and then discarded. The data is aggregated and pseudonymised; we do not use it to identify individual visitors by name. Google's privacy policy applies to data processed by GA4: policies.google.com/privacy.

2e. Affiliate Click Data

When you click a "Buy" link on our site, the click is routed through our own tracker before forwarding you to the retailer's website. We log the product variant, the pattern page you were viewing, the time, and a truncated form of your IP address — the final segment is removed (for example 203.0.113.47 is stored as 203.0.113.0), which identifies a broad network rather than a device or person. We keep this only to spot bursts of automated clicks. We do not record your browser user agent for affiliate clicks.

2f. User-Submitted Content

If you submit a fly tying pattern or a photo through the site, we store the pattern text, materials, tying steps, and any photos you upload, associated with your account. Uploaded photos are re-encoded, which removes embedded metadata including GPS coordinates. Submitted content may be published publicly on the site alongside your username. You retain ownership of your original content; by submitting you grant us a non-exclusive licence to display and distribute it on FlyTyingHub.com.

2g. Administrative Notes

Site administrators can attach internal notes to an account, for example to record the reason for a moderation decision. These notes are part of your personal data and will be disclosed to you if you make an access request.

2h. Information We Do Not Collect

We do not collect payment information. We do not run advertising networks. We do not buy personal data from third parties, and we do not build advertising profiles.

3. Cookies and Similar Technologies

Strictly necessary

• Session cookie (PHPSESSID) — set on every visit, including before you log in, because the site uses it to protect forms against cross-site request forgery. It expires when you close your browser, or after 30 days if you check "Remember me" at login.
• remember_me — set only if you check "Remember me", to keep you signed in for 30 days.
• Consent preference — records your cookie choice so we do not ask again on every page.

These are required for the site to function and are not optional.

Analytics (optional)

_ga and _ga_* are set by Google Analytics 4 and persist for up to 2 years. In the UK and EEA they are set only after you consent. You can change or withdraw your choice at any time using the "Cookie settings" link in the site footer. You can also opt out globally with the Google Analytics Opt-out Browser Add-on. Declining analytics does not limit your use of the site.

Embedded video

Some recipe pages embed fly tying videos hosted on YouTube. We use YouTube's privacy-enhanced embed domain (youtube-nocookie.com), which does not set cookies when the page loads. Because the player is embedded in the page, YouTube does receive your IP address when a recipe page containing a video loads, as part of the ordinary request for the player — but nothing is stored on your device and you are not tracked. If you play a video, YouTube may then set its own cookies, subject to Google's privacy policy.

Anti-bot challenge

Our signup and login forms use Cloudflare Turnstile to block automated abuse. Turnstile receives your IP address and browser characteristics in order to distinguish humans from bots. It does not use tracking cookies and is not used for advertising. It appears only on those two forms.

We do not load fonts, scripts, or stylesheets from third-party content delivery networks on public pages — these are served from our own domain, so browsing the site does not disclose your IP address to any party other than those named here.

4. Why We Process Your Data, and Our Legal Basis

If you are in the UK or EEA, the GDPR requires us to tell you the lawful basis for each purpose:

Where we rely on legitimate interests, we have considered the impact on you and limited what we keep accordingly — which is why affiliate click IPs are truncated and submission rate limiting uses your account ID rather than your IP address.

5. Affiliate Links

FlyTyingHub.com participates in affiliate programmes. When you click a product link and make a purchase, we may earn a small commission from the retailer at no additional cost to you. Affiliate links are labelled on the site. Our editorial decisions — which patterns we publish, which products we list — are independent of affiliate relationships.

6. Who We Share Data With

We do not sell, rent, or trade your personal information. We use the following service providers, each of which processes data on our instructions under a data processing agreement:

We also share data in two other situations: affiliate retailers receive your IP address and browser information as part of the ordinary HTTP request when you click through to their site (we do not send them your account details), and we may disclose information where required by law, court order, or to protect the rights and safety of users or the public.

7. International Transfers

We are based in the United States and our servers are operated by IONOS. If you use the site from the UK or EEA, your personal data is transferred to and processed in the United States.

For those transfers we rely on the EU-US Data Privacy Framework and its UK extension, under which Google LLC, Cloudflare and Resend are certified, together with Standard Contractual Clauses where a provider is not covered by the Framework. You can request details of the safeguards that apply by contacting us.

8. How Long We Keep Data

When you ask us to delete your account, we remove your email address, username, password, profile information, profile picture, saved patterns, fly boxes, follows, badges, and security logs within 30 days. Patterns and photos you submitted that have been published stay on the site but are detached from your account and no longer attributed to you by name, so that recipes other people rely on do not disappear. If you want published content removed as well, say so in your request and we will remove it.

9. Your Rights

Depending on where you live, you have some or all of the following rights over your personal data: to access a copy of it, to correct it, to delete it, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where we rely on it.

Much of this you can do yourself: your profile settings let you edit or clear your bio, location, website, species, tying styles, social links, and profile picture, and control what is publicly visible. Your cookie choice can be changed at any time from the "Cookie settings" link in the footer.

For anything else — a full copy of your data, or deletion of your account — email privacy@flytyinghub.com from the address associated with your account. We may ask you to confirm your identity before acting, to make sure we are not disclosing your data to someone else. We respond within 30 days. There is no charge.

If you are in the UK or EEA you also have the right to complain to your local data protection authority. In the UK this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concern first.

10. Security

We serve every page over HTTPS with HSTS enabled, hash passwords rather than storing them, protect forms against cross-site request forgery, use parameterised database queries, strip metadata from uploaded images, and let you invalidate all active sessions on your account. No method of transmission over the internet is completely secure and we cannot guarantee absolute security, but we take the protection of your data seriously and will notify you and the relevant regulator without undue delay if a breach occurs that is likely to affect your rights.

11. Children's Privacy

FlyTyingHub.com is not directed at children. You must be at least 13 years old to create an account, or at least 16 if you are in the UK or EEA. We do not knowingly collect personal information from children below those ages. If you believe we have inadvertently done so, contact us and we will delete it promptly.

12. Changes to This Policy

We may update this policy from time to time. The "Last updated" date at the top of this page indicates when it was last revised. If we make a material change we will note it on the site, and where the change affects processing you previously consented to, we will ask for your consent again.

13. Contact

Privacy questions, access requests, and deletion requests: privacy@flytyinghub.com

Anything else: info@flytyinghub.com