Privacy Policy

1. Introduction

Welcome to TideyCrew, a platform operated by Twin Paddlesports Ltd. ("we," "our," or "us"), a company incorporated in Canada. We are committed to protecting your privacy and ensuring the security of your personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and other applicable privacy laws. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our paddling team management platform.

2. Information We Collect

2.1 Information You Provide

• Account Information: Name, email address, password
• Profile Information: Profile photo, weight, date of birth, paddling preferences, position preferences
• Team Information: Club and team details, team logo or team photo, roles, membership information
• Practice and Attendance Data: Practice responses, attendance records, comments
• Performance Data: Training metrics, time trial results, race results, and performance statistics
• Financial Information: Team payment and expense records (we do not store payment card details)

2.2 Automatically Collected Information

• Usage Data: Pages visited, features used, time spent on the platform
• Device Information: Browser type, operating system, device identifiers
• Log Data: IP address, access times, referring URLs
• Session Recordings: Anonymised recordings of how the interface is used, described in Section 8 below
• Push Notification Tokens: If you turn on notifications, a device token that lets us deliver them

2.3 Information from Third Parties

• OAuth Providers: When you sign in with Google, we receive your name, email, and profile picture
• Connected Training Accounts: If you choose to connect Strava, or import a training file from a device such as a Garmin watch, we receive the activity data you authorise, which may include duration, distance, pace, heart rate, and route

3. How We Use Your Information

We use your information to:

• Provide and maintain our team management services
• Create and manage your account
• Enable team collaboration and communication
• Track attendance and manage practice schedules
• Create and manage lineups
• Manage financial records and team budgets
• Track and display performance metrics
• Send notifications about practices, events, and team updates
• Process subscriptions, trials, and plan changes
• Measure how the platform is used so we can improve it and develop new features
• Promote TideyCrew, including displaying team names and logos as described in Section 4.2
• Ensure security and prevent fraud
• Comply with legal obligations

4. Data Sharing and Disclosure

4.1 Within Your Team

Your information is shared with other members of your club and team according to your role and permissions. Team administrators and coaches have access to member information necessary for team management.

4.2 Team Names and Logos in Our Marketing

Where a club or team uploads a logo, crest, or other team image to its TideyCrew profile, we may display that image, together with the club or team name, publicly to show who uses TideyCrew. This includes our website, app store listings, social media, presentations, printed material, and other promotional material.

This applies to club and team branding only. We do not use member profile photos, individual names, attendance records, performance data, or financial information in our marketing without asking that person first. Where a team has uploaded a photograph of its members rather than a logo, we treat it as a member photo and will not use it publicly without the team's permission.

If you are a club or team administrator and you would prefer that we did not display your logo, email us at shamus.menard@tideycrew.com and we will remove it from our marketing material. Material already printed or already published by third parties may take longer to withdraw.

4.3 Service Providers

We use trusted third-party service providers to help us operate our platform:

• Supabase: Database, authentication, and file storage
• Vercel: Hosting and deployment
• Google: OAuth authentication, and delivery of push notifications to Android devices
• Apple: Delivery of push notifications to Apple devices
• PostHog: Product analytics and session recording
• Resend: Delivery of transactional and reminder email
• Shopify: Subscription checkout, payment processing, and our online shop
• Strava: Optional import of your training activities, only if you connect it
• Fider: Handling of feedback and feature requests you choose to submit

These providers process information on our behalf and are not permitted to use it for their own purposes. We do not sell your personal information.

4.4 Calendar Feed Links

If you subscribe to your team's calendar from an external calendar application, we generate a private link containing a secret token. Anyone who has that link can see the event details it carries without signing in, so treat it like a password and do not publish it. If your link is exposed, contact us at shamus.menard@tideycrew.com and we will issue you a new one.

4.5 Legal Requirements

We may disclose your information if required by law, court order, or other legal process, or to protect the rights, property, or safety of TideyCrew, our users, or others.

4.6 Business Transfers

If TideyCrew is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

5. Data Security

We implement industry-standard security measures to protect your information:

• Encryption of data in transit using HTTPS/TLS
• Encryption of sensitive data at rest
• Row-level security policies in our database
• Automated security vulnerability scanning and dependency updates
• Secure authentication using bcrypt for passwords
• OAuth 2.0 for third-party authentication

However, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security of your information.

6. Data Retention

We retain your information for as long as your account is active or as needed to provide services. We may retain certain information for longer periods as required by law or for legitimate business purposes such as:

• Resolving disputes
• Enforcing our agreements
• Maintaining historical records
• Complying with legal obligations

7. Your Rights and Choices

You have the following rights regarding your information:

• Access: Request a copy of your personal information
• Correction: Update or correct your information through your profile settings
• Deletion: Request deletion of your account and associated data
• Data Portability: Request a machine-readable copy of your data
• Opt-Out: Unsubscribe from marketing communications
• Withdraw Consent: Withdraw consent for data processing where applicable

To exercise these rights, please contact us at the email address provided below.

8. Cookies, Analytics, and Session Recording

We use cookies and similar tracking technologies to:

• Maintain your session when you're logged in
• Remember your preferences
• Analyse usage patterns and improve our services
• Enable security features

You can control cookies through your browser settings, but disabling cookies may affect your ability to use certain features of our platform.

8.1 Product Analytics

We use PostHog to understand which features are used and where people run into trouble. This records events such as pages viewed and actions taken, along with your device and browser type and a general location derived from your IP address. We do not use this data for advertising and we do not sell it.

8.2 Session Recording

PostHog also records how the interface is used during a session, which helps us find layout problems and broken flows. These recordings are masked by default: text content and form inputs are obscured before the recording leaves your device, so rosters, member names, weights, dates of birth, and financial figures are not captured. We also exclude the contents of network requests and responses.

If you would prefer not to be recorded, contact us at shamus.menard@tideycrew.com and we will exclude your account from analytics and session recording.

9. Children's Privacy

TideyCrew is not intended for users under the age of 13. We do not knowingly collect information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

10. International Data Transfers

Twin Paddlesports Ltd. is headquartered in Canada. Your information may be transferred to and processed in countries other than your country of residence, including the United States where some of our service providers operate. These countries may have different data protection laws. We ensure appropriate safeguards are in place to protect your information in accordance with this Privacy Policy and PIPEDA requirements.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on our platform or sending you an email. Your continued use of TideyCrew after such modifications constitutes your acceptance of the updated Privacy Policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Company: Twin Paddlesports Ltd.

Email: shamus.menard@tideycrew.com

Website: https://www.tideycrew.com

For privacy-related inquiries or to exercise your rights under PIPEDA, you may also contact the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

13. Your Rights Under Canadian Privacy Law (PIPEDA)

As a Canadian company, Twin Paddlesports Ltd. is committed to complying with the Personal Information Protection and Electronic Documents Act (PIPEDA). Under PIPEDA, you have the following rights:

• Right to Access: You may request access to your personal information held by us
• Right to Correction: You may request correction of inaccurate or incomplete personal information
• Right to Withdraw Consent: You may withdraw consent for the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions
• Right to Challenge Compliance: You may challenge our compliance with PIPEDA by contacting our Privacy Officer

Twin Paddlesports Ltd. is accountable for the personal information under our control. To exercise any of your privacy rights or make inquiries about our privacy practices, please email us at shamus.menard@tideycrew.com.

We will respond to access requests within 30 days as required by PIPEDA. If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada.

14. Additional Information for EU/UK Users

If you are located in the European Union or United Kingdom, you have additional rights under the GDPR:

• Right to lodge a complaint with a supervisory authority
• Right to object to processing based on legitimate interests
• Right to restriction of processing

Our legal basis for processing your information includes:

• Contract: Processing necessary to provide our services
• Consent: Where you have given explicit consent
• Legitimate Interests: To improve our services and ensure security
• Legal Obligation: To comply with applicable laws

15. California Privacy Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to know if personal information is sold or disclosed
• Right to opt-out of the sale of personal information (we do not sell your information)
• Right to deletion of personal information
• Right to non-discrimination for exercising your rights