Fulmaire

Part 1 — Privacy notice (for users)

*Last updated: 22 October 2026. Controller: Razorbill Technology Limited, Kildee, Dunmanway, Co. Cork, P47 NH01, support@fulmaire.com.*

The short version

Fulmaire records where you have paddled. That means we hold precise location

data about you, which is sensitive, and we treat it that way.

We do not sell it, and we never give advertisers where you paddle. The free

version shows ads from Google; premium has none. We hide the water

around the slipways you use regularly so the map does not tell anyone where you

launch from. You can download everything we hold, or delete all of it, at any

time, from inside the app.

This notice covers the Fulmaire app and website. The shop at

shop.fulmaire.com, where the award shirts and prints are sold, runs on

Shopify and has its own privacy policy at

shop.fulmaire.com/policies/privacy-policy; buying there is covered by that

policy, not this one.

What we collect

From the files you upload. GPS positions and timestamps for the whole

paddle, and where the file carries them, your device model and serial number

and your speed. We keep the original file.

From recording on your phone. If you press "Record a paddle on this

phone", Fulmaire asks your phone for its location until you press Stop. In a

web browser that is only while Fulmaire is open on screen; in the Android app

it carries on with the screen off, and Android shows a notification for as long

as it does. The positions are saved on your phone as they arrive and reach us

only when you stop, as an ordinary uploaded file, treated exactly like one. A

recording that has not been sent yet stays on your phone until it is, or until

you discard it. The Android app keeps your most recent finished recording on

the phone so you can send it again.

From you. A handle, and an email address if you have given one.

Anything you send us through Feedback, with the page you were on and the app

version unless you untick that. It is deleted with your account.

The weekly email. Off unless you switch it on under You. Then, at most

once a week, we email the address you sign in with: your own paddles,

distance, time on the water and new awards from the week before, and your

club's week as numbers only (paddles, members out, distance), never naming

anyone or saying where. A week with nothing new sends nothing. We keep which

weeks we sent one, so none is ever sent twice. It goes through Google

Workspace, like every email we send, and stops the moment you switch it off

or use the link at the foot of any of them.

Phone notifications. None unless you allow them on a phone under You.

Then we keep the address your browser gives us at its push service, with the

keys to encrypt to it, and which kinds you switched off. Each notification

says how many and which club, never a person's name or a place, and goes

through your browser's push service (Google's, for Chrome and the Android

app) encrypted, so that service cannot read it. We keep what is waiting to go

until it is sent, and when each kind last went, so you get at most one of a

kind an hour. Tapping "Stop on this phone", or deleting your account, removes

that phone's address.

Derived by us. Which stretches of water you covered, which counties and

named waters you were in, distance and duration, which awards you have earned,

and which cells you currently hold.

Automatically. Basic server logs. And which parts of the app you use, by

day: for example, that on 15 October you opened Awards and uploaded a paddle.

One mark per part per day, not every tap, not the time, not where you were.

Fulmaire counts this itself, in its own database, and sends it to nobody,

Google included. We look

at it only as totals (how many people used Awards this month), to learn what

is worth improving and what is not.

Why, and on what basis

| What | Why | Lawful basis |

| Processing your tracks into claims and awards | It is the service | Contract |

| Showing your claims to other paddlers | It is a shared map; a private one would be a different product | Legitimate interests |

| Keeping your original files | So your history can be recalculated when the maps or the algorithms improve | Legitimate interests |

| Account security, abuse prevention | Keeping the register trustworthy | Legitimate interests |

| Emails about your account | Running the service | Contract |

| The weekly email, only if you switch it on | Telling you about your own week on the water | Your consent: switch it off under You, or with the link in any of the emails |

| Phone notifications, only if you allow them | Telling you about your clubs, trips and paddles as they happen | Your consent: stop them under You, or in your phone's settings |

| Counting which parts of the app are used, by day | Knowing what to improve, and whether people come back | Legitimate interests |

| Showing ads on the free version | It pays for the free version | Your consent, for advertising cookies and ads chosen for you; legitimate interests, for ads that are not |

Where we rely on legitimate interests you can object at any time, and we will

stop unless we have compelling grounds not to. Ask and we will send you our

assessment.

Advertising

The free version shows one ad at the foot of Paddles and of Awards, served by

Google Ireland Limited. Before any ad loads, Google's consent message asks

whether you agree to cookies for advertising. If you agree, Google may use

cookies and your device's identifiers to choose ads for you and to measure

them. If you do not, Google shows ads not chosen from your activity, and may

still use cookies to prevent fraud and limit how often you see the same ad,

where the law allows. Like any website you open, Google also sees your IP

address (which can suggest your rough area), your browser and the address of

the page.

We never give Google your paddles, positions, sightings, handle or email. You

can change your answer at any time under Settings, "Cookie and ad choices".

Premium has no ads. How Google uses this information:

policies.google.com/technologies/partner-sites

Who can see what

Competing for water is off when you join. While it is off, none of your

water appears on the World map, you hold no cells, and you are on no

leaderboard or league; your own map and awards are unaffected. You can switch

"Compete for water" on or off at any time on My map.

If you compete, other paddlers see the name you appear under on the map,

the cells you hold, the awards you have earned, and your position on

leaderboards. That name

is a generated alias such as "Paddler 4821" unless you choose an alias of your

own or choose to show your handle. You can change it at any time on My map.

If you make your profile public, other signed-in paddlers can open it from

the map: the cells you hold, your awards and your totals, under the same name.

Your profile is private until you switch it on. Your paddles, their dates, your

routes and your heat map are never shown to anyone else, public profile or not.

If you turn on "Show who I paddled with", and another paddler who has also

turned it on recorded a paddle on the same water at the same time, each of you

sees the other's map name on that paddle, six hours after you both finished. It

is off until you switch it on, it only ever names someone who has switched it

on too, and it shows nothing about anyone's other paddles. You can switch it

off on My map; names stop showing from then on.

If you turn on river times, your best time down each river stretch is shown

to other paddlers who have paddled that stretch, by your map name. Only your

best time is shown, never when it was or your route. It's off unless you turn

it on.

Notes you write on your paddles (a title and a few lines) are yours alone.

They are never shown to anyone else, and they are included when you download

your data and deleted with the paddle or your account.

Sightings you record (wildlife, a coastal or river feature, an invasive

plant, litter or pollution, a hazard) each keep a point and a time: placed

along one of your paddles, put on the map by hand, or taken from your phone's

location at the moment you press "Mark a sighting here". The phone's location

is read only when you press it, never in the background; without signal the

mark waits on your phone until it can be sent. Other paddlers never see your

sightings. Unless you switch off "Share my sightings" on My map, we share

what each sighting was, where it was (wildlife and other passing things to

about 100 metres, a coastal or river feature exactly), when (to the hour, or

for a feature only the day), how many, a feature's size and tidal access, and

what you wrote about it, with any email address, link, handle or phone number

taken out, with wildlife,

environmental and heritage recording groups, and may publish them in our

own publications. A shared record never carries your name, your account

or anything about the paddle, and we do not share one recorded near the places

you habitually launch from, or until six hours after the paddle. Please do not

name people in what you write about a sighting. Your sightings are included

when you download your data and deleted with the paddle or your account, or

one at a time; what was already shared, carrying nothing that identifies you,

cannot be recalled.

Notes on a hex are sightings placed on water you have paddled, so

everything above applies to them; a note with no feature from the list is

never shared. Photos on a note are kept at 1,280 pixels with everything the

camera wrote (its position, time and model) removed, are shown only to you,

and are never shared. Reporting a hex as not water sends us the hex and what

you wrote; nobody else is told who reported it.

If you join a club, its other members see the water you have paddled on

the club's map, along with your map name, your recent awards, and your share of

the club's paddle and distance totals. Each cell shows how many members have

paddled it, never who or when. Your privacy zones still apply, nothing appears

until six hours after a paddle, and paddles from a source whose terms keep them

private to you are left out. Only members can open a club's page. We keep which

clubs you are in and when you joined; you can leave on the club's page, and

leaving or deleting your account removes you from every club at once. The

club's admin can also remove you from it, which works the same way as leaving.

A club's name is not private to its members. The club leagues, which every

signed-in paddler can see, show each club's name, its distance or count for

the period and how many of its paddlers counted, but never who they are.

The World map, which only signed-in paddlers can see, also names the club that

holds each cell. Your privacy zones and the six-hour delay apply to it just as

they do to your map name.

The club list, which every signed-in paddler can see, shows each listed club's

name and how many members it has, never who they are. A club's admin can

take it off the list. If you ask to join a club from the list, or by a

join link whose admin has chosen to let each person in, its

admin sees your map name, the avatar beside it, and anything you write

about yourself when you ask (we suggest your name, so they know it is you),

until they let you in or say no. What you wrote is deleted with the request,

either way, and you can withdraw the request at any time.

A club's join link, or a trip's link, pasted into a chat app such as WhatsApp

or Facebook shows a preview to everyone in that chat, signed in or not. The

preview shows the club's name and how many members it has, and for a trip only

that it is a trip with that club: never who is in it, nor a trip's title,

place or day.

If you join a club trip (an outing a member organises), the trip's club sees

that you are going, as a number, and the others going see your map name and

the club you are paddling for. Paddlers from other clubs can join by the

trip's link if its organiser allows it, and an organiser who asks to approve

people sees the map name and club of anyone asking. What you write in the

trip's chat is seen only by those going. Any of them can report a message to

us; we read the report and either leave the message or take it down, and if

we take down something you wrote you see that it was removed and why. The

person you reported is not told it was you. The chat closes a day after the trip

ends and its messages, and any reports of them, are deleted 48 hours after that. Paddles you log during

the trip count towards what it covered: those going see a map of the water covered,

with no names on it, and how much each club paddled; the trip's club sees the

totals. The same privacy zones, six-hour delay and private sources apply.

Leaving a club takes you off the trips it organised, and deleting your account

takes you off every trip and deletes your messages.

Other paddlers do not see your email, your device details, your original

files, your exact routes, or the water inside your privacy zones.

Two protections are on by default and you do not have to switch them on.

*Privacy zones.* Once you have launched from the same place more than once, we

treat it as a habitual put-in and hide the water within 1 km of it from the

public map. Those cells are still yours and still count towards everything.

They are simply not shown next to your name, because a cluster of cells around

one slipway tells a stranger where you launch, and for most people that is

close to where they live. You can widen or narrow the radius.

We never show who is on the water right now. Nothing you upload appears on

the public map until at least six hours after the paddle ended.

We never suggest where to paddle. Fulmaire records where you have been. It

does not point you at water nobody has recorded, because water nobody has

recorded is sometimes unrecorded for a reason.

How long we keep it

Your tracks, claims and awards stay while your account exists, because a

logbook you cannot look back through is not a logbook.

If your account is inactive for three years we will email you, and if we hear

nothing within 30 days we delete it. Server logs are kept 90 days. The record

of which parts of the app you used is kept 400 days, so one season can be set

beside the last. Deleted

accounts are gone within 30 days, including backups.

Your rights

Under the GDPR you can get a copy of your data, correct it, delete it, object

to processing, restrict it, and take it elsewhere.

Two of these are buttons rather than requests:

Your original files, exactly as you sent them, are a second download

beside it (GET /api/me/export/files).

Deletion removes your account, your tracks, your original files (including

any from a history import you never answered about, and the backup copies we

keep of them) and every record of where you paddled. It also removes your

request to join, if you made one, and your name from our upload log. Cells you

held return to whoever held them before you. Anything else, email support@fulmaire.com and we will respond within one month.

You can complain to the Data Protection Commission, 21 Fitzwilliam Square

South, Dublin 2, or to your own supervisory authority.

If you are in the United Kingdom, the UK GDPR and the Data Protection Act

2018 give you the same rights, and you can complain to the Information

Commissioner's Office (ico.org.uk, Wycliffe House, Water Lane, Wilmslow,

Cheshire, SK9 5AF).

Where it is stored

On servers in the European Union — Amsterdam — and backed up continuously to

object storage also held in the EU.

If you are in the United Kingdom, your data is stored in the EU too. UK law

recognises the EU as protecting personal data adequately, so no further

safeguard is needed for it to be held there.

Our hosting (Fly.io), backup (Cloudflare), sign-in (Google) and error

reporting (Sentry) providers are US companies. We use their EU locations for your data, but we cannot rule out

that they, or their support staff, can reach it from outside the European

Economic Area. Where that can happen, it is covered by the safeguards the GDPR

requires for it, such as the European Commission's standard contractual

clauses in each provider's data processing terms. Ask us and we will tell you

which applies to each one.

Signing in

You sign in with an account you already have, currently Google, or with a

code we email you. We never see a password.

With Google, Google tells us a permanent identifier for your account and the

email address on it, and we keep both: the identifier so that signing in again

reaches the same paddling history, and the address so you can see which account

you linked. Signing in tells Google that you use Fulmaire.

With a code by email, we use the address you type to send you a six-digit code

through our email provider (Google Workspace). The code is held in memory for

15 minutes and never written down. Once you sign in, we keep the address as your

sign-in, the same way we keep a Google one. If the address is already on your

account through Google, the code signs you in to that account.

You can see what we hold under *Your rights*, and deleting your account deletes

the link along with everything else.

Connected apps

You can connect an account you already have elsewhere, so that new paddles

arrive without you uploading them. Two are offered: Polar, for Polar watches,

and intervals.icu, a free training site that Garmin watches can send to.

Nothing is connected unless you press Connect and agree on that service's own

page.

Once connected, the service tells us when you have recorded a new activity,

and we fetch that one file from it. It is the same kind of file you could have

uploaded yourself, and we treat it exactly as an upload: a walk or a run is

skipped, a paddle goes on your map, and the privacy zones and six-hour delay

apply as usual. We keep the service's identifier for your account and the

access key it gives us, so that we can ask for new files and nothing else. The

key is never shown to anyone, including you, and is not in your data download.

You can disconnect on My map at any time. That stops new paddles arriving;

paddles already here stay until you delete them or your account. Each service

is a separate company with its own privacy notice, and connecting tells it

that you use Fulmaire.

The Fulmaire field on a Garmin watch

If you add the Fulmaire field to your watch, it keeps your position every ten

seconds while your activity's timer runs, and sends it to us through the

Garmin Connect app on your phone every few minutes. It records only while it

is on the activity you added it to, and only while the timer is running. What

it sends is kept as sent, in the same way we keep every uploaded file, and

becomes a paddle once the activity ends. From then on it is treated exactly

as an upload: the privacy zones and the six-hour delay apply as usual.

You link the watch by typing a code from My map into the field's settings.

The watch then holds a key of its own, and we keep only a scrambled form of

it. Disconnecting on My map stops the watch sending; removing the field from

your activity stops it recording. The points travel through Garmin's apps on

your watch and phone, so Garmin's own privacy notice also applies to them.

Processors

ledger, and a copy of each original file you upload. Deleting a paddle or

your account deletes that copy too.

Google; we receive an identifier and an email address.

Before a report leaves our server, positions, cells, tracks, tokens, email

addresses and the request itself are removed from it, so it says what went

wrong in the code, not who you are or where you paddled.

Each under a data processing agreement. Current list on request.

Children

Fulmaire is not intended for under-16s and we do not knowingly hold their data.

When you join you confirm you are 16 or over, and we keep the date you did.

Changes

We will email you before anything material changes.