Puddles Privacy Policy

This policy explains what personal data Puddles collects from you, how and why we use it, who we share it with, and the rights you have over it. We've written it to be an honest, specific description of what Puddles actually does — not generic boilerplate.

If anything changes in a way that affects what data we collect or how it's used, we'll update this page, change the version number above, and let club members know.

---

01Who we are

Puddles is a training and squad-management tool for UK university rowing clubs, operated by Oliver Ginns, trading as Puddles ("Puddles", "we", "us"), of Lords Oak, Landford, Salisbury, SP5 2DW, United Kingdom.

Puddles is registered with the UK Information Commissioner's Office (ICO) as a data controller, registration number ZC232839.

If you have any questions about this policy or how your data is handled, contact:

puddlesrowing@gmail.com

02Our role: controller and processor

Depending on what we're doing with your data, Puddles acts in one of two roles under UK GDPR:

• As a processor, for the data your club instructs us to process on their behalf — roster details, session sign-ups, training logs, coaching feedback, and similar club-management data. Your club is the data controller for this data: they decide what's collected and why, and they're your first point of contact for questions about how the club itself uses your data. We process it strictly under their instructions, set out in a Data Processing Agreement between Puddles and your club.
• As a controller, for the data we decide how to use ourselves — your account and authentication details, technical error monitoring, and (only with your consent) product analytics. This policy is written from that perspective for these purposes, and also describes our processor role for completeness.

In practice this distinction rarely changes what happens to your data day to day — the protections below apply either way — but it does determine who's legally responsible for what, which is why we've set it out clearly.

03What data we collect

Puddles is invite-only — you can only create an account via a join link sent by your club. When you register and use the app, we collect:

Account and identity data

• Name, email address
• Password (stored securely and hashed by our authentication provider — we never see or store it in plain text)

Club roster data (visible to your club depending on their permission settings)

• Squad, boat-side preference, OURC/BUCS status, sub-squad designations
• Swim test, capsize drill, and cox level records
• Outings count and training-related history

Sensitive roster data (restricted to committee members with the relevant permission)

• Phone number, age

Training and performance data

• Training log entries (activity type, distance, duration)
• Test results (erg scores, timed pieces) and any photo evidence you submit to verify them
• Session sign-ups, availability, crew and cox assignments
• Coaching feedback given about your rowing/coxing (visible to you and coaches with the relevant permission)

Communications

• Emails we send you (session confirmations, notifications, digests) via our email provider

Technical and usage data

• Basic error/crash reports (see "Error monitoring" below)
• If you've opted in: anonymised usage analytics (see "Analytics" below)

04How we use your data

We use your data to:

• Run your club's training, session-planning, and roster-management functions
• Send you emails you'd reasonably expect (session confirmations, digests, notifications)
• Let your club's committee members manage the roster and review training/test submissions
• Diagnose and fix bugs
• With your consent, understand how the app is used so we can improve it

05Our legal basis for processing

• Performance of a contract: most of what Puddles does (roster management, session sign-ups, training logs) is processing necessary to provide the service your club has asked us to provide.
• Legitimate interests: keeping the service secure and working reliably (see "Error monitoring" below), and for basic account administration.
• Consent: optional analytics (see "Analytics" below). You can withdraw this at any time with no effect on your ability to use Puddles.

06Who we share your data with

We use a small number of service providers ("processors") to run Puddles. None of them are permitted to use your data for their own purposes, and each is bound by its own data processing terms with us.

Provider	Purpose	Data involved
Supabase	Database hosting and authentication	All account and club data. Hosted in the EU (Ireland).
Resend	Sending transactional emails	Email address, email content
Google Drive	Storing photos (training photos, test-result verification photos)	Photos you upload
Netlify	Website hosting	Standard web request data
Cloudflare	DNS and network security	Standard web request data
Sentry	Error and crash monitoring	Anonymised technical error data (see below — no name/email included)
PostHog	Product usage analytics (only if you've opted in)	Anonymised usage events

We do not sell your data, and we do not share it with advertisers.

07Error monitoring

Puddles uses Sentry to automatically catch and report technical errors (things breaking or not working as expected) so we can fix bugs quickly — including ones we wouldn't otherwise find out about. This is enabled for all accounts, as part of keeping the service reliable and secure.

Error reports are limited to technical information (what broke, what page, what action was being taken) and are linked only to an anonymous internal ID, not your name, email, or phone number. We do not use Sentry to track how you use the app.

08Analytics

Puddles optionally uses PostHog to understand how the app is being used — for example, which features are helpful and where people get stuck — so we can improve it. This means anonymised usage events, such as which pages you visit or which features you use (for example, submitting a training log or signing up to a session). Screen recordings are not collected.

This is opt-in only. You'll be asked when you create your account, and you can turn it on or off at any time from your profile settings. If you don't opt in, no usage analytics are collected about your account.

09Cookies and similar technologies

Puddles keeps cookies and similar local storage to a minimum, and we don't use a cookie banner. Here's why, broken down by category:

• Strictly necessary: keeping you signed in relies on storing a session token in your browser. This is essential to provide the service you've asked for by logging in, and doesn't require consent under UK cookie law (PECR).
• Functional: a small number of local preferences (such as which view you last used on a page) are stored in your browser to make the app work the way you left it. These don't identify you and aren't used for tracking.
• Analytics: PostHog only activates, and only stores anything in your browser, after you've given informed, opt-in consent via the checkbox described in "Analytics" above — not before. Because that consent is already specific, informed, and freely given (and revocable at any time from your profile), a separate cookie banner would be redundant rather than additive.

We don't use cookies for advertising or share cookie data with advertisers.

10International data transfers

Your core account and club data is hosted in the EU (Ireland) via Supabase — the UK has an adequacy decision with the EU, so this doesn't count as a restricted international transfer. Some of our other providers (such as Sentry, PostHog, Resend, or Google Drive) may process data outside the UK/EEA, including in the United States. Where this happens, we rely on the provider's own compliance mechanisms (such as standard contractual clauses) for the transfer.

11How long we keep your data

We keep your data for as long as you're an active member of a club using Puddles. If you leave your club or ask us to delete your account, we'll remove or anonymise your personal data within a reasonable period, except where we need to keep limited records (e.g. for club historical records your club specifically asks to retain, or where we're required to by law).

12Data breaches

We have procedures in place to detect and respond to any suspected personal data breach. Where a breach is likely to result in a risk to your rights and freedoms, we'll notify the ICO within 72 hours of becoming aware of it, as required by UK GDPR, and will notify affected clubs and members directly where the risk to you is high.

13Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Ask us to correct inaccurate data
• Ask us to delete your data
• Object to or restrict certain processing
• Withdraw consent for analytics at any time
• Request a copy of your data in a portable format
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk if you think we've mishandled your data

To exercise any of these rights, email puddlesrowing@gmail.com. If your request relates to data your club controls (see "Our role: controller and processor" above), we may direct you to your club's committee, or action it on their behalf.

14Children

Puddles is intended for university students, who are ordinarily adults. We don't knowingly collect data from anyone under 18. If you believe a child's data has been submitted to Puddles, please contact us and we'll remove it.

15Related documents

This policy should be read alongside our Terms of Service, which cover the rules for using Puddles. Clubs subscribing to Puddles also enter into a Data Processing Agreement with us, which sets out our obligations as a processor of club-instructed data in more detail — available on request.

16Changes to this policy

We may update this policy from time to time, for example to reflect changes in the law, in our service providers, or in how Puddles works. We'll update the version number and "last updated" date above, and material changes will be flagged to club members.