Last updated: 2026-11-06
This Privacy Policy explains what Boathouse ("Boathouse") collects, how we use it, and your rights over your data.
Account information — email address, display name, password (hashed), and an optional profile picture. If you set a profile picture it is stored on our servers, linked to your account, until you replace it or delete your account.
Training category — sex, weight class, and date of birth. We use these to apply category-appropriate priors when fitting your power curve, to check the minimum age for your country, and to place you in an age group on Boathouse Social leaderboards. Other athletes see only your age group on a leaderboard, never your date of birth. You can update these at any time.
Workout data — every workout you log: date, distance, time, split, stroke rate, heart rate (if you connect a strap or enter it manually), power, force curve data, segments, and notes. Workouts you import from Strava or BLE-connected hardware also go here.
Derived metrics — values Boathouse computes from your workouts: power-duration curve, capacity estimates, training-load history, traits, predictions, and scores. These are stored to make the app responsive and to track trends over time.
Device and usage information — push notification tokens (if enabled), basic crash reports, and analytics on which features you use, to improve the Service.
Team membership — if you join a team, your team membership and role are stored.
Social activity — if you use Boathouse Social, we store your profile bio, visibility settings, publications and captions, chosen workout metrics, likes, comments, follows and follow requests, mutes, blocks, reports, and moderation decisions. This information is linked to your account. Profile-photo approval records are tied to the exact image reviewed. We do not send Social content to a third-party moderation provider.
We do not sell your personal data. We do not show advertising in the app.
You can see all your data, always.
Your coach and teammates see your training data when you join a team — workouts, load, capacity, traits, predictions, leaderboard position. You control whether your heart rate is shared with the coach (default: shared; toggle in Manage My Account).
Other signed-in athletes can discover your Social profile after you opt in. Its header includes your name, handle, approved photo, bio, and permitted team affiliations. Public profiles share selected workouts and enabled profile statistics with other athletes; private profiles restrict these to approved followers. Record and volume boards follow the same visibility rules. Birth dates and emails are not shown on Social; age-group boards show only an age bracket. Heart-rate sharing on each publication is optional and starts off. Likes and comments identify their author. Blocks hide both athletes from each other; report identities and moderation queues are restricted to staff.
Boathouse staff can access reported content and submitted profile photos to moderate the service and handle appeals.
Service providers that we contract with to operate the Service:
Account data and workouts are stored on servers operated by Fly.io in the United States. Encrypted in transit. Backups are retained for up to 30 days.
Boathouse is not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has created an account, contact us and we'll delete it.
You can:
EU/UK residents have the additional rights to object to processing, request data portability, and lodge a complaint with a supervisory authority. Portability is served by Download my data above, without a support request.
We keep your account and workout data for as long as your account exists. Social records follow account deletion, including posts, comments, likes, follows, blocks, reports you filed, and profile-photo review state. You can also remove your own posts or comments individually; deleting a post leaves its source workout intact. When you delete your account, all of it is erased immediately — there is no soft-deleted copy and no recovery window.
We do not retain your training data after deletion, in any form. An earlier version of this policy reserved the right to keep "aggregated, de-identified statistics" indefinitely; that reservation has been removed, because training data keyed to an athlete identifier is not de-identified in any meaningful sense.
When you delete your account we also revoke Boathouse's access to your Strava account at Strava, so we do not remain an authorised application there after you have gone. Activities we previously pushed to Strava are yours and stay on your Strava account; delete them there if you want them gone.
One thing does survive deletion and it is not under our control: server backups taken before your deletion roll off on their own schedule (up to 30 days).
We use industry-standard practices: encryption in transit, hashed passwords, restricted server access. No system is perfect; if we discover a breach affecting your data, we will notify you in accordance with applicable law.
If we change this policy in a way that affects how we handle your data, we will notify you in the app and require fresh acceptance on next login.
Questions, requests, or concerns? Reach out at mwkourakos@gmail.com.