Privacy Policy

Effective date: 19 February 2026 Last updated: 12 September 2026

Contents

  1. Who we are
  2. Scope of this policy
  3. Data we collect
  4. How we use your data
  5. Legal basis for processing
  6. Third-party services
  7. AI features
  8. Push notifications
  9. Data retention
  10. Your rights
  11. Security
  12. Cookies & storage
  13. Children
  14. Changes to this policy
  15. Contact us
  16. South African members (POPIA)

1. Who we are

BladeSync is a club management platform developed and operated by Blackbeard Technologies Ltd ("Blackbeard Technologies", "we", "us", "our"), a company registered in England and Wales. BladeSync serves multiple rowing clubs. Club membership may include junior members (under 18) — see Section 13. Each club that uses BladeSync is referred to in this policy as a "Club" or "your Club".

For the purposes of UK data-protection law (UK GDPR and the Data Protection Act 2018), Blackbeard Technologies Ltd is the data controller responsible for the personal data processed through BladeSync. Each Club may also be a data controller in respect of the membership data it manages through the platform.

Contact: privacy@blackbeardtechnologies.com

2. Scope of this policy

This policy applies to personal data processed when you:

BladeSync is a members-only application. Access is granted exclusively to current members and authorised administrators of participating rowing clubs. It is not a public service.

3. Data we collect

3.1 Account & profile data

When an administrator creates a member profile, or when you sign in and your profile is initialised, we store:

3.2 Membership registration data

When you (or, for junior members, your parent or guardian) complete your Club's membership registration form through BladeSync, we collect and store on your Club's behalf:

Registration records are visible in the app only to you (your own registrations) and to Club administrators who hold the registration-management permission.

3.3 Scheduling & activity data

3.4 Strava activity data (optional integration)

If you voluntarily connect your Strava account, we receive and store:

Heart rate and calorie data are classified as health data under UK GDPR and are processed only with your explicit consent (given when you connect Strava).

3.5 Google Calendar data (optional integration)

If you voluntarily connect Google Calendar, we:

3.6 Device & technical data

3.7 Fee & financial records

Card and banking details are never stored by BladeSync. Online payments are processed via Stripe Connect: your club operates its own Stripe account and Blackbeard Technologies acts as the platform facilitator. BladeSync receives only a payment status and reference ID — no card numbers, sort codes, or account numbers are transmitted to or stored by us.

3.8 Club onboarding & verification

These records are held server-side only and are not readable by other users; verification codes are never stored in plain text. Audit records of verification attempts are retained after onboarding completes so that we can detect and defend against fraudulent attempts to take over or impersonate a club (see Section 9).

4. How we use your data

PurposeData used
Authenticating your identity and granting access to the appEmail address, Firebase UID, Google OAuth token
Processing your Club membership application and maintaining your membership recordRegistration data (Section 3.2), including health information and emergency contact details
Keeping members safe during club activities (informing coaches and first-aiders; contacting your emergency contact in an emergency)Medical conditions, allergies, disability details, emergency contact details
Sending transactional emails (e.g. club onboarding verification codes)Email address, verification code
Looking up club location coordinates from an address typed by an administrator (geocoding)The typed address or map coordinates only — no member identifiers
Displaying your Club's document libraryNo member data — documents are read from Google Drive folders the Club shares with BladeSync
Displaying and managing training sessions, crew assignments, and availabilityProfile, skills, scheduling data
Syncing training events to your personal Google CalendarCalendar OAuth token, session data
Syncing Strava activity records and calculating performance metricsStrava OAuth tokens, activity data
Generating AI-assisted crew suggestionsSquad label, rowing capabilities, availability status, past seat/crew patterns and boat details, with each member and sub-group replaced by a temporary code before anything is sent to the AI model; the captain's typed instruction is sent with recognised club members' names replaced by codes and unrecognised text as typed (see Sections 6.5 and 7 — no names, member IDs, email data, health, medical or registration data are sent)
AI-assisted categorisation of imported bank transactions (treasurers)Transaction date, amount and direction, a temporary code in place of the payer, whether the club has matched the payer to a member, and the club fee structure and category names (see Section 6.5 — payer names, payment references and category hint text are not sent)
Sending push notifications about session updatesFCM tokens, session information
Displaying weather forecasts relevant to training sessionsClub location coordinates (no personal location data)
Processing online payments for club feesPayment intent ID and status received from Stripe; profile data used to associate payment with membership record
Managing fee registrations and membership recordsProfile, fee registration data
Administering the club (maintenance logs, boat inventory, race entries)Relevant sub-sets of the above
Verifying requests originate from genuine app installations (abuse prevention)Device attestation signals via Play Integrity (Android), App Attest (iOS), or reCAPTCHA Enterprise (web)
Diagnosing app crashes and improving stability (Android and iOS only)Crash reports, stack traces, device metadata, Firebase UID
Understanding app usage patterns to improve features and user experienceSession data, screen views, engagement metrics, login method, Firebase UID

We do not sell personal data, use it for advertising, or share it with any party except as described in Section 6.

5. Legal basis for processing (UK GDPR)

Processing activityLegal basis
Core app functionality, authentication, session managementLegitimate interests – operating a members' club management platform (Art. 6(1)(f))
Membership registration and record-keepingContract (Art. 6(1)(b)) – necessary to process your membership application and administer your membership
Health information and ethnic group collected at registration (special category data)Explicit consent (Art. 9(2)(a)) – you provide this information yourself on the registration form, each question offers a "prefer not to say" or optional answer, and you may ask for it to be corrected or deleted at any time
Emergency contact and parent/guardian details (third-party data)Legitimate interests (Art. 6(1)(f)) – member safety and safeguarding of junior members
Club onboarding verification and audit recordsLegitimate interests (Art. 6(1)(f)) – preventing fraudulent club onboarding and impersonation
Transactional email (verification codes)Legitimate interests (Art. 6(1)(f)) – necessary to complete the action you requested
Strava integration (including health/heart-rate data)Explicit consent (Art. 6(1)(a) + Art. 9(2)(a)) – you connect Strava voluntarily and may disconnect at any time
Google Calendar integrationConsent (Art. 6(1)(a)) – you connect Google Calendar voluntarily
Push notificationsConsent (Art. 6(1)(a)) – you enable notifications explicitly in your browser or device
Fee and membership administrationContract (Art. 6(1)(b)) – necessary to administer your club membership
Processing online payments via StripeContract (Art. 6(1)(b)) – necessary to fulfil a payment transaction for your membership or club fees
AI crew suggestions and transaction categorisationLegitimate interests – improving session-planning and treasury efficiency; members are pseudonymised (replaced by temporary codes) before any data is sent to the AI model
Device attestation (App Check via Play Integrity, App Attest, reCAPTCHA)Legitimate interests (Art. 6(1)(f)) – protecting the service from abuse and ensuring requests originate from genuine app installations
Crash reporting (Firebase Crashlytics, Android and iOS only)Legitimate interests (Art. 6(1)(f)) – diagnosing and fixing application errors to maintain service quality
Usage analytics (Firebase Analytics / Google Analytics)Legitimate interests (Art. 6(1)(f)) – understanding how the app is used to prioritise improvements and maintain service quality

6. Third-party services

BladeSync is built on and integrates with the following third-party services. Each acts as a data processor or independent controller in respect of the data described.

6.1 Google (Firebase)

We use Google Firebase for database storage (Firestore), user authentication, cloud functions, and push messaging. All data is stored in Google Cloud infrastructure. Google processes data in accordance with its Cloud Data Processing Addendum.

6.2 Google Sign-In

Authentication is handled exclusively via Google OAuth 2.0. We receive your name and email address from Google when you sign in. We do not receive or store your Google password.

6.3 Strava

If you connect Strava, activity data is retrieved from Strava's API and stored in our database. Strava's own Privacy Policy governs the data held in your Strava account. You may revoke BladeSync's access from your Strava account settings at any time.

6.4 Google Calendar API

If you connect Google Calendar, we write training events to a dedicated calendar in your Google account. We request only the minimum Calendar API scope required. You may disconnect the integration from within BladeSync settings, which deletes the BladeSync calendar from your Google account and revokes our access token.

6.5 Google Gemini AI

BladeSync uses Google's Gemini models for three features:

Data sent to the Gemini API is governed by Google's Gemini API Additional Terms of Service. We do not use Gemini's output to make solely automated decisions that significantly affect individuals.

6.6 Stripe (via Stripe Connect)

Online payment processing is handled by Stripe, Inc. using the Stripe Connect platform. Your club connects its own Stripe account through BladeSync; Blackbeard Technologies acts as the platform that facilitates the connection but does not itself receive or hold your payment funds. When you make a payment through BladeSync, you interact directly with Stripe's secure payment forms. BladeSync does not see or store your card details. Stripe processes your payment and returns a payment status and reference ID to BladeSync. Stripe acts as an independent data controller for the payment data it processes. See Stripe's Privacy Policy for details of how Stripe handles your data.

6.7 Yr.no (Norwegian Meteorological Institute)

Weather forecasts displayed in the app are fetched using the club's geographic coordinates. No personal data is transmitted to yr.no.

6.8 Firebase App Check (device attestation)

BladeSync uses Firebase App Check to verify that requests to our backend originate from genuine installations of the app, protecting against abuse and unauthorised access. App Check relies on platform-specific attestation providers:

App Check attestation tokens are short-lived and are not used for tracking, profiling, or advertising. They serve solely to protect the integrity of the service. You cannot opt out of App Check without losing access to the app, as it is a security requirement.

6.9 Firebase Crashlytics (crash reporting)

BladeSync uses Firebase Crashlytics on native Android and iOS builds to collect crash reports when the app encounters an unexpected error. Crashlytics is not active on the web version of BladeSync. When a crash occurs, the following data is automatically collected and sent to Google's Firebase servers:

Crash data is used solely to diagnose and fix application errors. It is not used for advertising, profiling, or any purpose other than improving app stability. Crash reports are retained by Firebase for 90 days. Crashlytics data is processed by Google under the same terms as other Firebase services (see Section 6.1).

6.10 Firebase Analytics / Google Analytics (usage analytics)

BladeSync uses Firebase Analytics (powered by Google Analytics) across all platforms (web, Android, and iOS) to understand how the app is used and to prioritise feature development. The following data is automatically collected:

Analytics data is used solely to understand usage patterns, measure feature adoption, and improve the app. It is not used for advertising, remarketing, or profiling. Google processes analytics data under the same terms as other Firebase services (see Section 6.1). Analytics data is retained by Google for 14 months (the default retention period) and then automatically deleted.

6.11 PurelyMail (transactional email)

Transactional emails (currently, club onboarding verification codes) are sent from a BladeSync mailbox hosted by PurelyMail, an independent email service provider, over an encrypted (TLS) connection. PurelyMail processes the recipient email address and the content of the message (which contains a one-time verification code, no other personal data). See PurelyMail's privacy policy.

6.12 OpenStreetMap Nominatim (geocoding)

When a club administrator sets the club's location, the address text they type (or the coordinates of the point they pick) is sent to the Nominatim geocoding service operated by the OpenStreetMap Foundation to convert it into map coordinates. The request is made from our server, so Nominatim does not receive your IP address, name, or any account identifier — only the club address being looked up. See the OSMF Privacy Policy.

6.13 Google Drive (club document library)

Clubs can publish a document library (e.g. club policies, safety documents) by sharing Google Drive folders with a BladeSync service account. BladeSync reads those folders with the read-only Drive scope (drive.readonly) to list and display the documents. BladeSync never requests access to, and cannot read, any member's personal Google Drive — only the specific folders the Club has explicitly shared with the service account.

Where your data is stored and processed: our Firestore database is stored in Google Cloud's eur3 (European Union) multi-region, and our Cloud Storage bucket and Cloud Functions run in europe-west1 (Belgium). However, the BladeSync application server (which processes every request) runs on Firebase App Hosting in us-central1 (United States), and data sent to Google's Gemini AI API may be processed outside the UK/EEA, including in the United States. This means your personal data is processed in the US at runtime even though it is stored in the EU.
International transfers: Google Firebase, Google AI, Strava, and Stripe may process data outside the UK/EEA (including in the United States as described above). Google relies on Standard Contractual Clauses and its UK International Data Transfer Addendum for cross-border transfers. Strava relies on Standard Contractual Clauses. Stripe relies on Standard Contractual Clauses for cross-border transfers of payment data. For South African members, see Section 16.

7. AI features

BladeSync uses AI (Google Gemini) to assist with crew planning and document parsing. You should be aware that:

8. Push notifications

With your permission, BladeSync sends push notifications to inform you when crew assignments are published or updated for training sessions you are attending. To enable notifications, your browser or device will request permission, and a Firebase Cloud Messaging (FCM) token is stored against your member profile.

You may withdraw consent at any time by:

Unused or invalid FCM tokens are removed automatically.

9. Data retention

We retain personal data for as long as you are an active member of your Club, and for a reasonable period thereafter to fulfil administrative obligations (e.g. fee records, historical session data).

Being honest about how retention works today: most retention is currently enforced on request rather than by automation. Account deletion is now self-service and automated: request it in the app (your profile → Account & Privacy) and it is processed automatically — a 48-hour cancellation window, then deletion completes within 7 days and is confirmed by email. The app also offers a self-service Export my data download (your right of access). Requests made by email (see our Delete Account page) are still carried out manually within the same timeframes. Broader automated retention enforcement is still being built; until it ships, data that nobody has asked us to delete may be retained longer than strictly necessary.

To request deletion of your personal data, contact us at privacy@blackbeardtechnologies.com. Account deletion requests are completed and confirmed within 7 days of identity verification; other data-subject requests are answered within 30 days (see Section 15).

10. Your rights

Under UK GDPR you have the following rights. To exercise any of them, contact us at privacy@blackbeardtechnologies.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

11. Security

We take reasonable technical and organisational measures to protect your personal data, including:

No security measure is 100% effective. If you believe your account has been compromised, contact us immediately at privacy@blackbeardtechnologies.com.

12. Cookies & local storage

BladeSync does not use third-party tracking cookies or advertising cookies.

The Firebase SDK automatically stores authentication tokens and session state in browser localStorage and IndexedDB to maintain your signed-in state between page loads. A service worker is registered for push-notification handling and offline support. Firebase Analytics (Google Analytics) sets first-party cookies (e.g. _ga, _ga_*) on the web to distinguish unique users and sessions. These are technically necessary for the app to function and for analytics to operate, and do not require a cookie consent banner under UK PECR in the context of a members-only application where analytics serves the legitimate interest of service improvement.

13. Children

Clubs using BladeSync may have junior members (under 18). The registration form supports junior registrations: when the applicant is under 18, the form requires the name, relationship, telephone number, and email address of a parent or guardian. We rely on the parent or guardian whose details are provided to consent to the processing described in this policy on the junior member's behalf.

We do not knowingly collect data from individuals under 13 without verified parental consent. If you believe a child's data has been collected without appropriate consent, please contact us at privacy@blackbeardtechnologies.com and we will delete it.

For junior members in South Africa, POPIA requires the consent of a "competent person" (usually a parent or guardian) — see Section 16.

14. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. For material changes we will notify members via the app or email. Continued use of BladeSync after the effective date of a revised policy constitutes acceptance of the changes.

15. Contact us

For any questions, requests, or complaints relating to this Privacy Policy or the processing of your personal data:

We respond to all data-subject requests within 30 days. Account deletion requests are completed and confirmed within 7 days of identity verification. privacy@blackbeardtechnologies.com is the single contact address for all privacy matters, including account deletion.

16. South African members (POPIA)

If you are a member of a South African club using BladeSync, the Protection of Personal Information Act, 2013 (POPIA) applies to the processing of your personal information, in addition to the rights described above. This section explains how BladeSync approaches POPIA. Where POPIA uses different words for the same ideas, "personal information" corresponds to "personal data", "special personal information" to "special category data", and a "responsible party" to a "data controller".

16.1 Responsible party and Information Officer

Blackbeard Technologies Ltd (UK) currently operates BladeSync and is the entity described in Section 1. The corporate structure for serving South African clubs — including which entity acts as the responsible party under POPIA and the appointment and registration of an Information Officer with the Information Regulator — is being finalised with South African legal advice. An Information Officer for South African members has not yet been appointed or registered; once that appointment is made, this section will be updated with the Information Officer's name and contact details.

Until then, all POPIA enquiries and requests from South African members should be sent to privacy@blackbeardtechnologies.com, and we will honour the rights POPIA grants you (access, correction, deletion, and objection under sections 23–25 and 11(3)) on the same timescales as Section 15.

16.2 Special personal information and children

The health information (disability, allergies, medical conditions) and ethnic-group data described in Section 3.2 are special personal information under POPIA section 26. We process them on the basis of your consent (section 27(1)(a)), given when you provide the information on the registration form; every such question is optional or offers a "prefer not to say" answer.

POPIA section 34 prohibits processing personal information of children except on the grounds in section 35, including consent of a competent person (a person legally competent to consent on the child's behalf, usually a parent or guardian). Junior registrations in BladeSync require a parent or guardian's name, relationship, and contact details, and we rely on that competent person's consent as the basis for processing the junior member's information.

16.3 Cross-border transfers (POPIA section 72)

BladeSync is hosted outside South Africa: data is stored in the European Union (Firestore in Google Cloud's eur3 multi-region; file storage and Cloud Functions in europe-west1, Belgium) and processed at runtime in the United States (Firebase App Hosting in us-central1; Google's Gemini AI API), as described in Section 6. Your personal information is therefore transferred out of South Africa when you use BladeSync.

We rely on the grounds in POPIA section 72(1) for these transfers: the recipients are bound by contractual arrangements (including Google's Cloud Data Processing Addendum and Standard Contractual Clauses) that impose protections substantially similar to POPIA's conditions for lawful processing (section 72(1)(a)), and the transfer is necessary to provide the service your Club has contracted for (section 72(1)(c)).

16.4 The Information Regulator

You have the right to lodge a complaint with the Information Regulator (South Africa). Current contact details and complaint forms are published at inforegulator.org.za.