Privacy policy

The demo

The public demo at boathouseos.app uses made-up sample data and one shared demo account. Anything you type into the demo can be seen by other visitors and is wiped when the demo is reset. Please don't enter real personal information there.

What we collect

• Account and profile: name, email, role (rower, coxswain, parent, coach, admin), teams, and whatever a member or their club chooses to add: phone, address, birthday, photo, high school and graduation year, erg times, weight, boat side, US Rowing number, a fun fact, and a walk-up song.
• Family links: which parents or guardians are connected to which rowers, and spouse links between parents.
• Club activity: lineups, practice check-ins and absences, erg time history, food tent and volunteer signups, poll votes, suggestions, maintenance reports, messages, and photos (including who is tagged in them).
• Text alerts (only if you turn them on): your mobile number, the consent wording you agreed to and when, and whether you've replied STOP.
• Emergency and medical information: emergency contacts, allergies, medications, and medical notes a member or their parent chooses to add, so coaches can act quickly on the water.
• Race-day and travel details: bow numbers, who's riding in which car or bus and who's driving, hotel rooming lists, and who packed what on the trailer.
• Calendar link: a private link for adding the club schedule to your phone's calendar, which you can replace at any time.
• Concept2 Logbook (only if you connect it): read-only access to a rower's Concept2 Logbook and the erg pieces it sends. You can disconnect it at any time.
• Payments: what your club has billed you, what you've paid and how (cash, check, or card), and apparel orders. Card numbers go straight to Stripe; BoathouseOS never sees or stores them.
• Agreeing to the terms: when you agreed to the terms of service and this policy at signup.
• On-water location: only while a coxswain has started on-water tracking during a practice, their phone's GPS position is recorded so the club can see where the boat is. Tracking stops when the session ends, and the phone asks for permission first.
• "Interested" form: the name, club, email, and phone number you choose to leave.
• Club website forms: when someone uses a club's public website to send a message or ask to join, the name, email, phone number and message they enter.
• Program registration: when a family registers for a camp, Learn to Row or other program on a club's website, the participant's name and birth date; a parent or guardian's name, email and phone number; an emergency contact; any allergies, medications or medical notes they choose to give; their answers to the club's questions; whether they agreed to the club's waiver and when; and whether the club has marked it paid. The person registering doesn't need an account.
• Forms and surveys: answers members give to their club's forms, including any files they upload.
• Elections: whether a member voted in a club election, and the votes cast. Ballots are stored without the voter's name or the time, so no one, including the club and BoathouseOS, can see how a person voted.
• College recruiting (only if listed): a rower's or coxswain's choice to be listed for college coaches, which details to show, anything they add (height, GPA, intended major, about me, a video link), a parent's approval, and messages college coaches send about them. For college coaches: their name, school, title and school email.
• Network address: the IP address of signup, "interested" form, club website form and program registration submissions, used only to block spam and abuse.

We don't use advertising or analytics trackers, and we don't sell or rent anyone's information.

Who can see it

Your information is visible to the approved members of your own club, as the app's screens show it (for example, the roster and bio pages). New signups can't see anything until a club admin approves them. Some things are narrower: while a boat is on the water, club members can see where it is right now, but its full track and past outings are visible only to coaches, admins, and the coxswain who recorded them; bills and payments only to the family involved and the club's treasurer and admins; erg time history and attendance only to the member and their coaches; emergency and medical information only to the member, their parents or guardians, coaches, and admins; and "interested" form submissions only to the BoathouseOS team. BoathouseOS's own staff can see and change any club's information, but only to run the service, help a club that asks, fix problems, or keep it secure.

If a club turns on college recruiting and a rower or coxswain chooses to be listed (with a parent's approval if they're under 18), college coaches that BoathouseOS has approved can see their name, club, role, and only the details they picked. College coaches never see phone numbers, emails, addresses, birthdays or medical information. Their messages go by email to the club's coaches and the athlete's parents (and the athlete, if 18 or over). Turning the listing off hides it right away.

A club's public website only shows what the club chooses to publish there, such as regatta dates, results by boat (never rowers' names), and coaches' and board members' names, titles and photos. It never shows members' contact details or anything about minors. Messages and program registrations sent through a club's website are visible only to that club's admins; the club's coaches can also see registrations, including emergency contacts and medical notes. Answers to a club form are visible to the person who answered and to whoever made the form, plus the club's admins and board members. In an election, they can see who has voted but not how; the vote totals are shown to the members the election is for after voting closes.

Rowers under 18

Many rowers are minors. Their information is entered by the rower, a parent or guardian, or the club, for running the club's program only. BoathouseOS isn't meant for children under 13 to sign up for themselves; a club with younger members should have a parent or guardian set up and manage that member's profile. A parent or guardian can ask us to see, correct, or delete their child's information at any time.

Program registrations on a club's website are usually made by a parent or guardian for their child. The club uses that information only to run the program and keep participants safe, and a parent or guardian can ask the club, or us, to correct or delete it.

Services that handle the data

• Supabase stores the database, sign-ins, and uploaded photos (United States).
• Vercel hosts the app and keeps short-lived server logs.
• Resend delivers the app's emails: password resets, alerts (to members who haven't turned on phone alerts), program registration confirmations, messages from club website forms to the club's admins, and announcements from BoathouseOS. It receives the email address and the message's text.
• Twilio sends text alerts to members who turned them on and receives the mobile number and the alert's text. Mobile numbers and text-alert consent are never sold, rented, or shared with anyone for marketing, and aren't shared with other third parties except Twilio to send the texts.
• Stripe processes card payments for your club. When you pay by card, Stripe receives your card details and the payment amount, and your club's Stripe account records the payment. Stripe's own privacy policy covers what it does with them.
• Concept2 sends the erg pieces from a Logbook a member connects. BoathouseOS keeps the read-only access Concept2 grants until it's disconnected, and sends Concept2 nothing about anyone.
• To show race-day weather and water conditions, the National Weather Service, the U.S. Geological Survey (river gauges), and OpenStreetMap receive a regatta's or river gauge's location, never anything about a person. Maps load their tiles from OpenStreetMap, which sees your IP address as any website would.
• Race results are read from CrewTimer's public results; nothing is sent to them.

Cookies and storage on your device

The app uses a sign-in cookie to keep you signed in, a cookie to remember which club's colors to show, and, if you turn on alerts, a cookie that lets signing out stop alerts on that device. Turning on alerts saves an address your phone's push service (Apple, Google, or Mozilla) gives us for sending them; alert text passes through that service. When installed on a phone, it also saves copies of pages so it loads quickly; those are cleared when you sign out.

Keeping and deleting information

When a club removes someone from its roster, their access ends right away, but their history (like past lineups and messages) is kept so the club can restore them later. To have your information, or your child's, permanently deleted, email privacy@boathouseos.app and we'll take care of it. You can also ask for a copy of what's stored about you, or edit most of your profile yourself in the app.

Program registrations and website messages are kept until the club deletes them or asks us to. When a club deletes a form or program, its answers, uploaded files and registrations are deleted too.

Changes

If this policy changes, we'll update the date at the top of this page. For a change that affects how existing information is used, we'll tell clubs before it takes effect.