Privacy
Last updated 28 August 2026
Draft. This policy is complete and accurately describes what the software does and what we hold ourselves to. It awaits a solicitor’s review before the app-store submissions lean on it.
The short version
Waypoint holds your training: the sessions you do, the outings you record, and — if you connect a watch or phone — health data like heart rate and sleep. Your coach and your club see what they need to coach you, and nothing more. We do not sell any of it, and we do not use it to advertise to you.
Three things are worth knowing up front, because they are unusual. Health data gets extra protection in law and we only ever read it with your explicit permission. Your live position is visible to your club while you are on the water, because that is the point of the safety board. And juniors are on this platform, so parts of it are deliberately locked down by default.
Who is responsible for your data
The data controller is Sam Fowler, trading as Waypoint, registered with the Information Commissioner’s Office under registration ZC099372.
Contact for anything on this page, including requests to see or delete your data: [email protected], or by post: The Orchard, Common Road, East Tuddenham, NR20 3AH.
Your club or your coach is a controller too, for the coaching they do with you. In practice that means a question about the notes your coach writes is best asked of them; a question about the platform is best asked of us. We will not pass you back and forth.
What we collect, and why
Your account. Your name, email address, and the clubs or coaches you belong to. Your date of birth, when your club records it — it decides whether you are treated as an adult or a junior, which changes what the social features let you do.
Your training. Sessions planned and completed, weights and reps logged in the gym, how a session felt, check-in answers, habits and streaks, and any notes you write.
Outings you record. Start and end times, distance, duration, and the GPS trail of the route. Where you have connected a watch or head unit, whatever it recorded — pace, heart rate, stroke rate, boat and paddle telemetry.
Health data, only if you connect Apple Health, Health Connect or Garmin: workouts, heart rate, distance, calories, and sleep — how long, and the stages. This is special category data under UK GDPR and is treated accordingly; see below.
Where you are, while you record. Your position during a recorded paddle, and — if you sign out on the water — your last known position, so your club can see you are still out. Not in the background: Waypoint does not track you when you are not recording or signed out on the water.
Racing. Times, positions and splits from club time trials and courses, and your governing-body membership number if you enter one so results can be ranked.
Emergency contacts. If you nominate someone, we store their email address so an alarm can reach them. See the section on them below — they have rights here too, and they never signed up.
Payments. Handled by Stripe. We never see or store your card details; we keep a record of what you bought and whether it is active.
Messages. The conversations you have with your coach in the app, and squad chat where your club uses it. We do not read them except to fix a fault or where the law requires it.
Technical. Sign-in tokens, device tokens for notifications, and the access tokens for any watch service you connect. Our hosting and database providers also log the ordinary technical details of a request — IP address, browser and device — and keep them briefly for security and to diagnose faults.
Our legal bases
Under UK GDPR we need a lawful basis for each thing we do with your data. Ours are:
- Performing our contract with you — running your account, delivering the training your coach or club sets, taking payment, and sending you the service messages you need.
- Your consent — health and sleep data, sharing sleep with your coach, session replays, sharing coaching notes between clubs, the Sunday Recap email, and push notifications. You can withdraw any of these, and mostly do it yourself in Settings.
- Our legitimate interests — keeping the service secure, diagnosing faults, and understanding which features get used so we can improve them. We have weighed these against your interests, and you can object at any time.
- Protecting someone’s vital interests — the on-the-water register and the alarm. If somebody is in difficulty, getting help to them is the basis for sharing their position.
- Legal obligation — where we have to keep or disclose something by law.
Your club or coach relies on its own bases for the coaching it does, including its safeguarding duties.
Health data, specifically
We ask for health data only when you choose to connect a service, and the permission sheet you see is your device’s own. That consent is the legal basis (UK GDPR Article 9(2)(a) — explicit consent), and you can withdraw it at any time: Settings has a Disconnect button for each connected device, which deletes the stored access token immediately, and you can also revoke access from Apple Health, Health Connect or your Garmin account.
We read; we do not write back. We store summaries — a night’s sleep duration and stages, a workout’s totals — rather than raw sensor streams.
Sleep is separately gated. Your coach cannot see your sleep unless you turn that on in Settings, and turning it off stops it immediately. That switch is real: it is enforced in the database, not just hidden in the interface.
If you are under 18
Waypoint is used by junior paddlers, so parts of it are locked down by default and stay that way until an adult age is recorded. Adults are not shown juniors in member discovery, follow requests always need approving rather than being accepted automatically, and where an age has not been recorded at all we treat the person as a junior rather than guessing. Juniors can find other juniors at their own club, which is deliberate — a club’s own young paddlers train together — and every follow between them still needs approving.
Your club records dates of birth as part of its own safeguarding duties. If you are a parent or guardian and want to see what is held about your child, or have it removed, contact us [email protected] or ask the club directly.
Who can see what
This is the part most training apps gloss over, so here it is properly.
- You see everything of your own, always — including after a club takes you off its roster.
- Your coach sees the paddlers assigned to them: plans, sessions, logged training, recorded outings, check-ins and the notes written about them.
- Club coaches see names, not contact details.Email addresses and dates of birth are readable only by club owners and admins, and that is enforced by the database rather than by what the screen chooses to show: a coach asking for those fields directly is refused. Coaches are told whether a paddler is a junior — they need to know who they are coaching — but not the date. It matters most for juniors, whose contact address is usually a parent’s.
- Club volunteers who time racessee a start list and a timing screen — and nothing else in the app. One exception, because it is a safety feature: if somebody raises an alarm, the alert goes to everyone with a role at that club, volunteers included, and it carries the paddler’s name and position.
- Other members see what you choose to share: your name and club, results you have not marked private, and outings you share with people who follow you.
- Two clubs cannot see each other’s data about you. If you belong to a club and also have an external coach, they are separate. Notes written in one are shared with the other only if you grant it in Settings, and you can revoke it.
- Waypoint staff. We do not read individual accounts routinely — only to fix a fault or where the law requires it. Be aware of one structural exception: if you are a free member with no club or coach, your membership is with Waypoint itself, so we stand in the same position to your data as a club would. If that is not what you want, joining a club or coach moves your training under them.
- Anyone at all, for some race results. Where a club opts in to a public results page, or you or your club shares a result card, your name and time are on a page with no sign-in and search engines can index it. That is what results have always been. You can keep yours off those pages with the private results setting in Settings.
Aggregate trends across clubs and regions are produced for the platform, and they suppress small groups so an individual cannot be identified from them.
Your position, and the safety board
When you sign out on the water, your club sees that you are out, when you are due back, and your last known position. That is the entire purpose: it is a register, and someone needs to be able to find you.
If you raise an alarm, your position is shared with your club and with the emergency contacts you have nominated, as an Ordnance Survey grid reference, coordinates, and — where that service is configured — a what3words address, which means those coordinates are sent to what3words to convert.
The replay screen a coach uses shows a recorded outing only where you have turned that on for that club, per club, in Settings. Being straight about the limit: coaching staff can already read the underlying outing records for their own paddlers, so this switch governs the replay feature rather than making the track technically unreachable. Separating those properly is on our list.
Who we share it with
We do not sell your data and we do not share it for advertising. These are the services that process it on our behalf:
- Supabase — the database and file storage, hosted in the United Kingdom (London).
- Vercel — runs the application.
- Resend — sends sign-in codes and the Sunday Recap.
- Stripe — payments.
- Cloudflare Stream — coaching video, where a club uses it.
- Apple — push notifications to iPhones.
- Open-Meteo— weather and conditions. Receives a location to answer “what is the weather there”.
- what3words — converts coordinates to words during an alarm, where configured.
- OpenStreetMap — map tiles. Your browser requests these directly, which tells them roughly what area you are looking at.
- Garmin, and Apple Health or Health Connect on your own device — only what you connect, and only to read.
- YouTube and Vimeo— where a coach adds a video hosted there, your browser loads it from them directly, which tells them you watched it. We use YouTube’s no-cookie player.
- Vercel Analytics — counts page views and a few product events across the whole app. It is privacy-preserving by design: no cookies, and no profile of you across other websites.
Your database and files are held in the United Kingdom. Several of the services above are US-based and process data outside the UK; in each case the transfer relies either on the UK’s adequacy regulations for that country or on the UK International Data Transfer Agreement, or the EU standard contractual clauses with the UK Addendum. Ask us at [email protected] for a copy of the safeguards for any particular service and we will send it.
How long we keep it
Two of these are set by law rather than by us, and they are the two that run longest: safeguarding records about a child, and financial records. The rest are our own judgement about how long something is actually useful to you.
| What | How long | Why |
|---|---|---|
| Your account and training records | While your account is open, then 3 years | So a season off does not cost you your history. |
| Health and sleep data | While connected, then 12 months | Special category data: kept no longer than it is useful. Disconnecting in Settings starts the clock. |
| GPS trails and telemetry from your outings | With the outing | It is part of the record of the paddle, and it is yours. |
| The on-the-water register, and any alarm | 6 years | An incident and insurance record. It has to outlast a claim. |
| Coaching notes about an adult | 6 years after the coaching ends | Long enough to answer a question about how somebody was coached. |
| Coaching and safeguarding records about a junior | Until their 25th birthday | The standard for child protection records in England, Scotland and Wales. Northern Ireland is 30. |
| Race results and club records | Indefinitely | A public record of a sporting event, as results have always been. |
| Payment and enrolment records | 6 years from the end of the financial year | HMRC. |
| Emergency contacts | Until removed, or the account closes | Only useful while somebody is nominated. |
| Watch connections and device tokens | Until you disconnect | Disconnecting removes the stored access token. |
| Technical logs (IP address, browser, device) | 30 days | Security and fault diagnosis, nothing more. |
| Aggregate club and regional trends | Indefinitely | Already aggregated and small groups suppressed, so no longer about an individual. |
How this is applied today, honestly. These are the periods we hold ourselves to, and we will act on any request to delete something within them. What does not exist yet is the automation: nothing currently deletes your data on a schedule without somebody asking. We are building that, and until it is running the schedule above is honoured on request rather than by a timer. We would rather say so than let you assume a clock is already ticking.
Where two periods apply, the longer one wins — a coaching note about a junior is kept to their 25th birthday even if the account closed years earlier. And when a club takes you off its roster, nothing you created is deleted: your history stays yours, and the club keeps its own record of having coached you, for the periods above.
Your rights
Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to how we use it, ask us to restrict that use, or ask for it in a portable form to take elsewhere — your recorded outings already download as GPX files, which is the format every other training app reads. Where we rely on your consent — health data, sleep sharing, replays, notifications — you can withdraw it at any time, and much of that you can do yourself in Settings.
Ask us at [email protected] and we will respond within one month. If you are not satisfied you can complain to the Information Commissioner’s Office.
One honest limit: some records are not ours alone to erase. A race result is a fact about an event other people also competed in, and a club’s safeguarding record exists because the club has its own duty to keep it. If we cannot delete something, we will tell you why rather than quietly not doing it.
If someone nominated you as their emergency contact
We hold your email address because a paddler asked us to be able to reach you if they get into difficulty, and we asked you to agree before doing anything with it. We use it only to send an alarm, and we never use it for anything else. Tell us at [email protected] and we will remove you — or ask the paddler to remove you in their Settings.
Cookies and analytics
We set a cookie to keep you signed in. We use Vercel Analytics to count page views and a handful of product events — which features get used, how far people get through setting up. It sets no cookies and does not build a profile of you across other websites.
There is no advertising tracking of any kind, and we do not sell or share anything for advertising.
Changes
If we change what we collect or who can see it, we change this page and the date at the top. Where a change is significant, we will tell you in the app rather than relying on you re-reading this.