Privacy policy

Who we are

SquadRunner is a club-scale rowing squad tool: availability, crew planning, training, races, and expenses. This deployment is operated by the organisers of the squad that uses it.

Privacy questions: ask your squad organiser.

Account data

Google sign-in gives us your name and email (and a Google account id). Magic-link email sign-in stores the address you enter.

You may optionally add a mobile number in E.164 form for SMS, and a date of birth for British Rowing masters age on the roster and crew planner.

We do not run ads and we do not publish public athlete profiles.

Club data

Depending on how you use the app, we store roster details (side, scull/sweep, cox/steer, and height or weight if you add them), availability answers, planned and completed outings, race entries, training sessions, and shared expenses.

For each outing we may store a weather forecast shown before the session and a frozen record of observed conditions afterwards (temperature, wind, and rain at the club’s boathouse coordinates, plus river level and flow where an Environment Agency station is configured). These sit on the outing so the squad can look back at what it was like on the water.

Organisers can see the roster fields they need to run the squad, including phone numbers used for messaging.

Notifications

We send transactional reminders by email, browser push, and SMS — availability requests, chase, outing reminders, race deadlines, session asks, and payment nudges. You choose channels and reminder types on Profile. Direct WhatsApp messages are not sent at the moment. SMS needs a valid mobile and stays off until you opt in. Quiet hours, if you set them, pause outbound sends in that window.

One-tap links in those messages are secret tokens. Anyone with the link can submit that response until it expires.

Calendar feeds

Each member can subscribe to a personal ICS feed. The URL contains a secret token: anyone who has it can read the events it includes. Regenerating the token on Profile invalidates the old URL.

Organisers may also point the club at an external ICS feed so shared events appear on the squad calendar.

External training import (Intervals.icu)

If you connect Intervals.icu, we store an OAuth access token and pull completed activities you authorise (ACTIVITY:READ only), including GPS and heart-rate streams for on-water rows so they can appear on the crew outing. We do not use Intervals.icu as the club roster and we do not request coach access.

Imported sessions default to squad visibility. Click a session in your training log to keep it private or share it only with organisers. Disconnecting revokes the token with Intervals.icu and removes the connection; imported sessions stay in your training log until you delete them.

When Strava is configured on a deployment, the same pattern applies: encrypted tokens, import of activities you authorise, and revoke-on-disconnect.

Cantabs boat bookings

Organisers may connect their cantabsrowing.org.uk login so SquadRunner can book club boats when they confirm an outing. We store that email and an encrypted copy of the password, and use them only to create, update, or cancel bookings on the club site in your name, with your SquadRunner name and phone in the booking description.

Disconnecting on Profile deletes the stored password. We do not show the password again after you save it.

RowPace and crew water data

If you generate a RowPace token on Profile, the iPhone app can upload a water outing (GPS track, split, stroke rate, and heart rate). GPS, split, and rate are shown to the squad on that boat’s outing. Heart rate stays labelled as yours.

The token is a secret: anyone who has it can upload as you. Regenerating it on Profile disconnects the phone.

Where it lives

The app is hosted on Vercel. Data sits in a Supabase Postgres database. OAuth tokens and Cantabs organiser passwords are encrypted at rest.

Sharing

Squad-mates and organisers see what your visibility settings and club role allow. We do not sell your data.

Processors we use to run the service: Google (sign-in); Supabase (database and auth); Vercel (hosting); Resend (email); Twilio (WhatsApp and SMS when those channels are enabled); Intervals.icu (activity import if you connect); Strava (activity import if you connect); RowPace (water telemetry if you pair the Watch app); Cantabrigian Rowing Club’s website (boat bookings if an organiser connects); Open-Meteo and aviation weather METARs (outing forecasts and observed conditions); the Environment Agency hydrology and flood-monitoring APIs (river level and flow, when configured); and, if organisers enable it, Sentry for error reports.

Retention and deletion

You can sign out at any time. On Profile you can mark yourself inactive so you drop out of availability requests and reminders.

There is no self-serve account-deletion button yet. To leave the squad or erase your account, ask your organiser. We will remove or anonymise personal data we hold, except where we must keep a record (for example a split on an expense that others still need).

Imported training sessions remain until you delete them, including after you disconnect Intervals.icu.

Your rights

If UK GDPR applies, you can ask for a copy of your data, a correction, or erasure, and you can object to or restrict some processing. Start with your organiser.

You can also complain to the ICO if you are in the UK.