Privacy notice

1. Who is responsible

Your club is the data controller. It decides who is on its roster, what it records about its rowers and who at the club can see what. Questions about your own details start with your club's Admin.

Withe is the data processor. We run the app and store the data on your club's behalf, under the data-processing terms the club has agreed to. Withe is Thomas Francis, trading as BeaufortBytes Labs, a sole trader established in England and Wales, trading from Poppes Lawn, Holditch, Dorset.

2. What Withe holds about you

• Your name and email address — how your club knows you, and how you sign in.
• A phone number, if you add one. Optional.
• The month and year you were born — never the day. Withe uses it for age categories at regattas, and nothing else.
• Your weight, if you add one. Optional, and private to you — see section 4.
• Your heart rate, if you add it: your maximum and resting heart rate. Optional, private to you, and kept only with your consent — see section 6.
• Your rowing experience and the seats you row, along with whether you cox.
• Your availability, week by week, and for race days.
• Your rota and crew history — the outings you were down for, and who you rowed with.
• Training records — sessions logged against you, erg test results, and anything a captain notes on a session.
• Whether you have turned on training targets, and when you accepted the notice that comes with them. Private to you.
• A profile photo, only if you sign in with Google, in which case Withe uses the photo Google already has for you.

If your club hosts or enters a regatta on Withe, your name, club and results also appear in that regatta's entries and results — see section 8.

3. Why it is held

• Name, email, photo — so the club can tell one rower from another, sign you in, and show you on a crew sheet.
• Phone number — so a captain can reach you about an outing.
• Month and year of birth — to work out the age category a crew races in.
• Weight — to help balance a boat.
• Heart rate — to show you a heart-rate range for each training zone.
• Experience, seats, coxing — so crews can be picked sensibly.
• Availability — so the rota is built from who can actually row.
• Rota, crew and training history — so the club can see how the season is going, and so you can see your own.

4. Who can see what

• Everyone at your club can see your name, and the crews and rotas you appear in. That is the point of a rota.
• Captains and Admins can also see your contact details, your availability, your experience level, your seat positions and any pairing exclusions set for you, and your training and erg records.
• Erg challenge tables show your name, result, sex, age band and weight class to everyone at your club, but only if you switch on Count me in club challenges (or enter a result in Erg Challenges, which switches it on). Switch it off on My Training and you drop off the tables. The weight class is the one you choose for each entry; your weight itself is not shown.
• Your weight and your heart rate are visible only to you. Nobody else at the club sees them.
• Other clubs cannot see anything. Each club's data is walled off from every other club — except regatta entries and results, which are public by design (section 8).
• Withe staff cannot see your club's data unless your club's Admin opens a support window: for a set length of time, with a reason, logged, and visible to the club. It closes on its own, and Withe can only read, never change.

5. The lawful basis

Your club relies on its legitimate interests in organising rowing for its members: a club cannot run a rota, pick a crew or enter a regatta without knowing who its rowers are, when they can row and what they can do. Where a detail is optional — a phone number, a weight, a photo — it is there because you chose to add it, and you can remove it yourself at any time from My Profile.

Your heart rate is the exception. It is health data, and it is held only on your explicit consent — see section 6.

6. Heart rate

If you choose to, and you have turned on training targets, you can add your maximum and resting heart rate on My Training. Withe uses them for one thing: to show you a heart-rate range for each training zone, on My Training and Gym Session. Withe only ever uses the numbers you type; it does not estimate them or take them from your erg results.

• It is health data, which UK data protection law treats as special category data. Withe keeps it only with your explicit consent, which the app asks for the first time you enter any, and it records when you gave it.
• It is private to you. Nobody at your club sees it — not captains, not Admins. It is left out of your club's data export, and a Withe support window (section 4) does not include it.
• If you turn training targets off, a heart rate you saved is kept but not used, until you turn them on again or delete it.
• You can withdraw your consent at any time with Delete my heart rate on My Training. That deletes your heart rate straight away, along with the record of your consent. Withdrawing does not affect anything done before it.
• It is also deleted when you leave the club, when your club removes you, and when your club's data is deleted (section 7).
• You never need it to use Withe. Leave it out and everything else works the same.

7. How long it is kept

• While you are a member of the club, and your club keeps you on its roster.
• When a club stops subscribing to Withe, its data goes read-only for 90 days and is then deleted.
• Your club can remove you, or any detail about you, at any time before that.
• Your heart rate goes sooner if you delete it yourself (section 6).

8. Regattas are public

Where a club hosts a regatta on Withe, the names of entrants, their clubs and the results are published on a public page by that host club — the same information a printed results sheet would carry. If you are entered in a race, expect your name, club and result to be visible to anyone with the link.

9. Who else is involved

Withe uses three suppliers, and no one else touches your data:

• Google (Firebase) — hosting, the database, sign-in, push notifications and the emails Withe sends you, such as your sign-in link. Your club's data is stored in Google's europe-west1 region, in Belgium.
• Resend — the emails Withe sends on a club's behalf, such as a regatta invitation to another club's contact address, and the sign-in codes Withe emails to members using the app on an iPhone or iPad. Processed in Resend's EU region.
• Stripe — payments. Stripe deals with your club's treasurer, not with rowers; Withe never sees card or bank details.

There is no advertising, no analytics service and no tracking pixel anywhere in Withe. Your data is never sold, and it is never used to train an AI model.

10. Your rights

Under UK data protection law you can ask to:

• see a copy of what is held about you;
• have anything wrong corrected;
• have your data deleted;
• restrict or object to how it is used;
• have a copy in a portable form;
• withdraw consent for anything you gave it for.

Most of it you can do yourself: My Profile lets you edit or clear your own details whenever you like.

To be removed altogether today, ask your club Admin — they can delete your profile — or write to hello@withe.uk and we will pass it on and make sure it happens. Deleting yourself from inside the app, without asking anyone, is being built and will appear on My Profile.

11. What is stored on your device

Withe keeps a copy of your club's current data in your browser's local storage, so the app opens instantly and still shows the rota when the signal on the slipway gives up. It also remembers a few preferences — which page you were on, whether you dismissed a banner, the email you last asked a sign-in link for.

That is all. There are no third-party analytics or advertising cookies. Clearing your browser's site data for Withe removes the lot; the app simply reloads it next time you sign in.

12. Contact, and complaining

Start with your club's Admin, or write to hello@withe.uk.

If you are not happy with how your data has been handled you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113. We would rather you told us first, so we can put it right.