PRIVACY POLICY

paddlesnitch.com is run by Baldur Gudbjornsson, the data controller for this service. For questions or requests about your personal data, email privacy@paddlesnitch.com. The site is hosted on Amazon Web Services in the eu-west-1 region (Ireland).

Only what you give us, or what your GPS files and tracker record:

• Account: your email address, display name and password. Amazon Cognito holds the password; we never see it. If you sign in with Strava, which doesn't share your email, you can add a contact email.
• Public profile: off unless you turn it on, plus the profile handle if you pick one.
• Time-trial results: the track from the GPS file you upload (times, positions and stroke rate; we don't keep the file itself), and your time, 500 m splits, average stroke rate, boat class and crew names.
• Paddles: the analysis of each paddle you add (from a file, Strava, a time trial or a tracker): your route, speed and stroke rate, plus any diary notes and boat class you add. For files uploaded to Paddles we keep the analysis, not the original file.
• Buddies: who your buddies are, buddy requests you've sent and received, and your invite link. Your buddies see your paddles (route, speed, stroke rate and boat class) unless you turn that off on the Buddies page or hide a paddle. They never see your diary notes, your automatic summaries or your email.
• River plans: plans you save on Plan (start and finish points, start time and pace). They're private until you share one. A shared plan can be seen by anyone with its link, with your display name, and your buddies see it listed. Stop sharing and the link stops working.
• Trackers: if you link a paddlesnitch tracker, the recordings it uploads (GPS positions and motion data), and its ID, software version and when it last synced.
• Strava: if you connect Strava, a key that lets us read your activities, and the activities you import.
• Automatic paddle summaries: to write the short summary under a paddle, we send that paddle's numbers, the name of the nearest river gauge, your recent paddles and your diary notes to an AI model on Amazon Bedrock. Please don't put health details in diary notes. We keep a short written profile of your paddling to make later summaries relevant.
• Issue reports: what you write, the page you were on and your browser. If you're signed in, or add an email, we keep your name and email privately so we can reply.
• Beta tester applications: your name, email, how you paddle (kayak, rowing and so on), and how often. We use it only to choose and contact beta testers, and delete it when the beta ends or when you ask.
• Page-view counts: which pages are opened, with a random ID that lasts until you close the tab. It isn't linked to your account.
• Technical records: when a tracker checks for a software update we record its IP address and software version (kept 90 days), and we briefly keep IP addresses to stop repeated requests (1 day).
• Emails to us: if you email privacy@paddlesnitch.com we keep the message so we can deal with it.

Heart rate is never stored, even if your GPS file contains it. Stroke rate is kept, because it's part of the analysis.

We use your data to provide the service you signed up for: timing your races, analysing your paddles and running your groups (performance of a contract, UK GDPR Art. 6(1)(b)). We count page views and keep issue reports to find and fix problems (legitimate interests, Art. 6(1)(f)). We don't use your data for marketing or advertising, and we don't sell it.

We keep your data for as long as your account exists. You can delete your account at any time from your account page. That deletes your account, paddles, diary notes, results, river plans, shared links, buddies and tracker recordings, and disconnects Strava. Courses and trials you created are deleted too, unless a group owns them or someone else has a result in them: those stay for the other paddlers, without your results. It happens at once and can't be undone. Our storage keeps earlier copies for 30 days so we can recover from mistakes, so deleted data is fully gone 30 days later. Server logs are kept for 90 days.

Under UK GDPR you can:

• Access a copy of your data: use "Download my data" on your account page.
• Erase your data: use "Delete my account" on your account page.
• Correct wrong data: email us.
• Take your data elsewhere: the download is a machine-readable JSON file.
• Object to or restrict how we use it: email us.
• Complain to the Information Commissioner's Office (ico.org.uk) if you think we've mishandled your data.

We set these cookies, all needed for the site to work:

• tt_id: your sign-in token. Lasts 24 hours.
• tt_refresh: keeps you signed in between visits. Lasts 30 days.
• strava_state, strava_signin_state and strava_signin_next: only while you connect or sign in with Strava, to check the reply really came from Strava and to bring you back to the right page. Last 10 minutes.
• ps_contact_banner_dismissed: only if you sign in with Strava and hide the "add your email" banner. Lasts 180 days.

Your browser also stores tt_cookie_acked (so this notice isn't shown twice) and tt_sid (the random page-view ID, deleted when you close the tab). We use no advertising cookies and no third-party trackers.

We use these services to run the site:

• Amazon Web Services (eu-west-1, Ireland): hosting, sign-in (Cognito), storage (S3), email (SES, from noreply@paddlesnitch.com) and the AI model that writes paddle summaries (Bedrock). Bedrock doesn't use your data to train models.
• Strava (USA): only if you connect it. We read your activities; we never post.
• Open-Meteo and the Environment Agency: we send them a location and a time to look up the wind and river flow for a paddle. Nothing that identifies you.
• GitHub (USA): issue reports are filed there, and the text you write is public. Your name and email are not sent.
• Esri and unpkg: your browser loads map tiles and map icons from them, so they see your IP address. They don't see your account.
• Google (Gmail, USA): emails you send to privacy@paddlesnitch.com, and beta tester applications, are forwarded to our Gmail inbox so we can answer them.

Strava, GitHub and Google are in the USA. Everything else we store stays in the EU.

If we change how we handle your data we'll update this page and the "last updated" date at the top. For significant changes (new kinds of data, new services) we'll email registered users before the change takes effect.

privacy@paddlesnitch.com