Privacy notice

1. Who is responsible

Your club is the data controller. It decides who is on its roster, what it records about its rowers and who at the club can see what. Questions about your own details start with your club's Admin.

Withe is the data processor. We run the app and store the data on your club's behalf, under the data-processing terms the club has agreed to. Withe is Thomas Francis, trading as BeaufortBytes Labs, a sole trader established in England and Wales, trading from Poppes Lawn, Holditch, Dorset.

Withe is also a controller, for its own records: your sign-in account, which clubs your email address belongs to, the record of which terms you accepted and when, and any bug report or idea you send us. Questions about those come straight to us.

Withe is for adults. You must be 18 or over to have a Withe account, and clubs must not add anyone younger.

2. What Withe holds about you

• Your name and email address — how your club knows you, and how you sign in.
• A phone number, if you add one. Optional.
• An emergency contact — the name and phone number of someone to call if something goes wrong on the water, if you add one. Optional.
• The month and year you were born — never the day. Withe uses it for age categories at regattas, and nothing else.
• Your weight, if you add one. Optional, and private to you — see section 4.
• Your heart rate, if you add it: your maximum and resting heart rate, and the heart rate on an erg workout you log. Optional, private to you, and kept only with your consent — see section 6.
• Your rowing experience and the seats you row, along with whether you cox.
• Your availability, week by week, and for race days.
• Your rota and crew history — the outings you were down for, and who you rowed with.
• Training records — sessions logged against you, erg test results, and anything a captain notes on a session.
• GPS and stroke traces, if someone in your boat records an outing with live tracking: the route rowed, the speed and the stroke rate, linked to that session and the crew in it.
• Anything you send us in a bug report or idea: what you write, your name, email address and role, technical details about your device and the page you were on, and a screenshot if you add one.
• Whether you have turned on training targets, and when you accepted the notice that comes with them. Private to you.
• A profile photo, only if you sign in with Google, in which case Withe uses the photo Google already has for you.

If your club enters a regatta or another event, your name appears on the crews your club publishes to its own members. Public event pages show clubs, crews, boats and results, never individual rowers' names. See section 8.

3. Why it is held

• Name, email, photo — so the club can tell one rower from another, sign you in, and show you on a crew sheet.
• Phone number — so your captain and your crewmates can reach you about an outing.
• Emergency contact — so a captain or Admin can call someone for you if something goes wrong.
• Month and year of birth — to work out the age category a crew races in.
• Weight — for your own reference. Nobody else sees it, and Withe does not use it for anything else.
• Heart rate — to show you a heart-rate range for each training zone, and your own heart rate on the workouts you log.
• Experience, seats, coxing — so crews can be picked sensibly.
• Availability — so the rota is built from who can actually row.
• Rota, crew and training history — so the club can see how the season is going, and so you can see your own.
• GPS and stroke traces — so the crew and coaches can look back at an outing.
• Bug reports — to find and fix the fault you told us about.

4. Who can see what

• Everyone at your club can see your name, sex, age category, experience, the seats you row and whether you cox; your photo; your availability; the crews and rotas you appear in; the training sessions logged against you, including any captain's notes on them; your erg results; the GPS traces of outings you were in; and your phone number, if you have added one, so crewmates can ring each other. The app shows some of these only to captains and Admins, but all of them reach every member's copy of the app.
• Captains and Admins can also see your email address, your month and year of birth, and your emergency contact. Nobody else at the club sees your emergency contact, coxes included.
• Pairing preferences (anyone a captain has noted you should not be seated with) are shown in the app only to captains and Admins. They are stored with the club's roster, though, which every member's copy of the app receives. They are for seating only, and must never be used to record a concern about someone.
• Erg challenge tables show your name, result, sex, age band and weight class to everyone at your club, but only if you switch on Count me in club challenges (or enter a result in Erg Challenges, which switches it on). Switch it off on My Training and you drop off the tables. The weight class is the one you choose for each entry; your weight itself is not shown.
• Your weight and your heart rate are visible only to you. Nobody else at the club sees them.
• Other clubs cannot see anything. Each club's data is walled off from every other club, except the public event pages described in section 8.
• Withe, through the app, cannot see your club's data unless your club's Admin opens a support window: for a set length of time, with a reason, logged, and visible to the club. It closes on its own, Withe can only read, never change, and it never includes your contact details, weight or heart rate.
• Withe's owner also has technical access to the database itself, as anyone who runs an online service must. We use it only to keep Withe running and secure, to fix a fault, when your club asks for help, or when the law requires it. We never browse club data, and we keep a record of every time we look.

5. The lawful basis

Your club relies on its legitimate interests in organising rowing for its members: a club cannot run a rota, pick a crew or enter a regatta without knowing who its rowers are, when they can row and what they can do. Where a detail is optional — a phone number, a weight, a photo — it is there because you chose to add it, and you can remove it yourself at any time from My Profile.

Your heart rate is the exception. It is health data, and it is held only on your explicit consent — see section 6.

6. Heart rate

If you choose to, and you have turned on training targets, you can add your maximum and resting heart rate on My Training. Withe uses them for one thing: to show you a heart-rate range for each training zone, on My Training and Gym Session. Withe only ever uses the numbers you type; it does not estimate them or take them from your erg results.

When you log an erg workout on Gym Session you can also choose to add your heart rate for that workout — typed in, or from your Concept2 Logbook if you switch on Add my heart rate. It is saved only when you add it, and only you see it, on your own Session Results. The points below apply to it too.

• It is health data, which UK data protection law treats as special category data. Withe keeps it only with your explicit consent, which the app asks for the first time you enter any, and it records when you gave it.
• It is private to you. Nobody at your club sees it — not captains, not Admins. It is left out of your club's data export, and a Withe support window (section 4) does not include it.
• If you turn training targets off, a heart rate you saved is kept but not used, until you turn them on again or delete it.
• You can withdraw your consent at any time with Delete my heart rate on My Training. That deletes your heart rate straight away — your maximum and resting heart rate and the heart rate on your logged workouts — along with the record of your consent. Deleting a workout deletes its heart rate too. Withdrawing does not affect anything done before it.
• It is also deleted when you leave the club, when your club removes you, and when your club's data is deleted (section 7).
• You never need it to use Withe. Leave it out and everything else works the same.

7. How long it is kept

• While you are a member of the club, and your club keeps you on its roster.
• When a club stops subscribing to Withe, its data goes read-only for 90 days and is then deleted.
• Your club can remove you, or any detail about you, at any time before that.
• If you leave the club, or your club removes you, your profile, contact details, weight, heart rate, availability and erg results are deleted. Your name stays in past rotas, which the club keeps as the record of who rowed when. Leaving your last club deletes your Withe account as well.
• Your heart rate goes sooner if you delete it yourself (section 6).
• Backups. Withe backs up the database every night and keeps each backup for 30 days, so anything deleted from Withe is gone from the backups within 30 days.
• Bug reports and their screenshots are deleted 30 days after you send them, or sooner if you ask. So the fault can be fixed, what you wrote is also copied to Withe's private task list on GitHub with your club and role, but not your name or email address, and stays there until the fault is fixed.

8. Hosted regattas are public

Where a club hosts a regatta on Withe, a public page shows the races, the clubs and crews entered, their boats and the results, to anyone with the link — much as a printed results sheet would. It does not name individual rowers.

A captain can add a rower from another club to one of their event crews as a guest. The club then holds the guest's name only, and only its own members see it.

9. Who else is involved

Withe uses four suppliers to store and process your data:

• Google (Firebase) — hosting, the database, sign-in, push notifications and the emails Withe sends you, such as your sign-in link. Google also checks that requests come from the genuine Withe app (App Check, using reCAPTCHA). Your club's data is stored in Google's europe-west1 region, in Belgium.
• Resend — the emails Withe sends on a club's behalf, such as a regatta invitation to another club's contact address, and the sign-in codes Withe emails to members using the app on an iPhone or iPad. Processed in Resend's EU region.
• Stripe — payments. Stripe deals with your club's treasurer, not with rowers; Withe never sees card or bank details.
• GitHub — Withe's private task list, where a bug report you send is copied without your name or email address (section 7).

For the weather and tides on Home, Withe's own servers ask the Met Office, the Admiralty (UK Hydrographic Office) and the Channel Coastal Observatory for conditions near your club's launch point. They receive only that position, never anything about you.

When you open the map of a recorded outing, your device also fetches the map itself from OpenStreetMap and the map software from Cloudflare. Like any website, they receive your device's internet address, and OpenStreetMap the area of map shown. Neither receives your name or any club data.

There is no advertising, no analytics service and no tracking pixel anywhere in Withe. Your data is never sold, and it is never used to train an AI model.

10. Your rights

Under UK data protection law you can ask to:

• see a copy of what is held about you;
• have anything wrong corrected;
• have your data deleted;
• restrict or object to how it is used;
• have a copy in a portable form;
• withdraw consent for anything you gave it for.

Most of it you can do yourself: My Profile lets you edit or clear your own details whenever you like.

Download my data on My Profile gives you a copy of most of it straight away, and says what it leaves out. For a full copy, ask your club or write to [email protected]. Your club answers for what it holds about you; Withe gives it what it needs, and answers you directly for Withe's own records and for anything your club cannot see.

To be removed altogether, use Leave this club on My Profile. If it is your only club, that deletes your Withe account too. You can also ask your club Admin, or write to [email protected] and we will make sure it happens.

11. What is stored on your device

Withe keeps a copy of your club's current data in your browser's local storage, so the app opens instantly and still shows the rota when the signal on the slipway gives up. It also remembers a few preferences — which page you were on, whether you dismissed a banner, the email you last asked a sign-in link for.

That is all. There are no third-party analytics or advertising cookies. Signing out removes your club's data from that device, and so does clearing your browser's site data for Withe; the app simply reloads it next time you sign in.

12. Contact, and complaining

Start with your club's Admin, or write to [email protected].

If you are not happy with how your data has been handled you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. We would rather you told us first, so we can put it right.