Privacy Policy
Version 1.7 · Effective 7 September 2026
1. Who we are
TillerWise (“we”, “us”, “our”) is operated by TillerWise, trading as TillerWise, based in England, United Kingdom. We are the data controller for the personal data processed through this application. If you have questions about how we handle your data, contact us at lucas@tillerwise.com. If you need our postal contact details for a legal notice or data-rights request, email us and we will provide them promptly.
2. What data we collect and why
We only collect data that is necessary to provide the sailing analytics service. The table below lists each category of personal data, the purpose of processing, and the legal basis under UK GDPR.
| Data | Purpose | Lawful basis |
|---|---|---|
| Email & display name | Account creation and authentication | Contract performance (Art 6(1)(b)) |
| Date of birth | Confirm you are 13 or over, and keep under-18 accounts inside their groups (see section 9). Held on your sign-in account; our database stores only the date you turn 18, never the birth date itself | Legal obligation (Art 6(1)(c)) |
| Profile details | Personalise your account (bio, location, boat type, experience level, club affiliation, avatar) | Legitimate interest (Art 6(1)(f)) |
| GPS track files & derived data | Core service: replay maps, metrics, coaching insights, session scoring | Contract performance (Art 6(1)(b)) |
| Location coordinates (weather) | Sent to Open-Meteo (reduced precision) to enrich sessions with weather context | Legitimate interest (Art 6(1)(f)) |
| GPS coordinates (map rendering) | Your browser fetches map tiles from Mapbox to draw the replay map, and asks Mapbox for a small map image of the recorded track for each session card in the feed. That image request carries a simplified copy of the track (at most 64 points) for the session being shown, so Mapbox receives that sample for every card you look at | Legitimate interest (Art 6(1)(f)) |
| Strava / Garmin connections | Connect your account and request activity imports from connected providers | Consent (Art 6(1)(a)) |
| Imported provider activity data | Activity identifiers, titles, sport types, timestamps, track streams, and related metadata received from Strava when you connect it (and from Garmin once that integration becomes available) | Consent (Art 6(1)(a)) |
| Sharing your sessions with other sailors | Show your sessions, figures, and milestones to the audience you chose — the feed, venue and group leaderboards, your profile, and side-by-side comparison. Nothing is shared until you choose (section 4) | Consent (Art 6(1)(a)) |
| Appearing in search and suggestions | Let other sailors find you by name and see you suggested at your venue. Off unless you switch it on, and separate from the setting above | Consent (Art 6(1)(a)) |
| Who you follow and the groups you join | Build your feed, run your groups, and work out who is allowed to see what | Contract performance (Art 6(1)(b)) |
| Fives and comments you write | Let you respond to sessions other sailors have shared with you. Comments are free text, so please do not put anything in one you would not want the people who can see that session to read | Contract performance (Art 6(1)(b)) |
| Photos you add to a session | Let you show where you sailed instead of the map. A photo is shown to the same people who can see the session. Please do not add photos of people who have not agreed to appear. | Contract performance (Art 6(1)(b)) |
| Support requests | Respond to questions and resolve issues you report. If you report a comment or dispute a leaderboard figure, the report includes a copy of what you reported | Contract performance (Art 6(1)(b)); legitimate interest in platform safety for reports about someone else (Art 6(1)(f)) |
| Browser-side analytics | Understand how the service is used in the browser (page views, feature usage, click patterns). Only collected if you accept the analytics consent banner. No name or email is transmitted. | Consent (Art 6(1)(a)) |
| Server-side analytics & error monitoring | Record key actions (sessions uploaded, exports requested, integrations connected) and capture server-side exceptions to improve reliability. Events are keyed to your internal user ID — no name or email is transmitted. | Legitimate interest (Art 6(1)(f)) |
| Request metadata (IP address, timing) | Rate-limit sign-in, sign-up and API requests to reduce automated abuse and credential stuffing | Legitimate interest (Art 6(1)(f)) |
Some personal data is collected from you directly, and some comes from other services when you ask us to connect to them. If you connect Strava, we receive provider account identifiers, activity metadata, and eligible GPS track data from Strava at your request. Garmin import is not yet available; requesting Garmin access records that request on your account only.
3. Automated decision-making
TillerWise uses algorithms to generate session scores, coaching insights, manoeuvre quality labels, and VMG analysis from your GPS track data. These are informational aids to support your training.
We also check each figure automatically for plausibility against the boat class you declared — a top speed no boat of that class could reach, for example. A figure that fails the check stays in your own record with a plain-language reason, and is left off leaderboards. You can dispute it from the session and a person will look at it. No decision with a legal or similarly significant effect is made solely by automated processing.
4. Who can see your sailing
Everything you record is private until you choose otherwise. A session you upload is visible to you and to nobody else. It is in no feed, on no leaderboard, and on no profile. If you never make a choice, or you close the privacy screen without picking anything, you stay private. We do not share anything on your behalf, and there is no default that shares for you.
When you do choose, you choose one rung of an ordered ladder. Each rung includes everyone on the rungs above it in this table. You set a default for your account, and separately you can keep any single session more private than that default — including a session you have already shared.
| Setting | Who can see it | What they see |
|---|---|---|
| Private | Only you | Everything: the full session, the map of where you sailed, your figures, and your notes |
| Followers | You, and the sailors who follow you. Following does not need your approval, so anyone signed in can follow you — you can remove a follower at any time, and doing so takes away everything this rung gave them | The full session: the map of where you sailed, your figures, and your notes |
| Groups | Everyone above, plus members of the groups you share with them | The full session, as above, and your figures can be ranked on those groups’ leaderboards |
| Venue | Everyone above, plus every signed-in TillerWise user | Followers and shared group members still see the full session. Everyone else sees the session summary, and your figures can be ranked on the leaderboard for the venue you sailed at |
| Public | Everyone above. TillerWise has no signed-out browsing, so this still means signed-in users | The same as Venue, and the session can also be reached from your profile page |
The session summary includes the map of where you sailed.
A session summary is the title, date, venue and boat class, the figures (distance, time, speeds, tacks, gybes, wind), and the map of where you sailed. It does not include your session notes. So from the Venue rung upwards you are publishing your GPS track — the path you took, the water you were on, and the date and time you were there — to every account on TillerWise, not a headline number. Pick those rungs if you are happy for that to be visible, and one of the rungs above if you are not.
What other sailors can do with a session they can see
- Feed — it appears in the feed of the sailors you shared it with.
- Leaderboards — your figure can be ranked at a named venue or in a group, shown next to your display name, your photo, and the date you sailed. Standings are worked out fresh every time someone opens them; we do not store them anywhere.
- Fives and comments — anyone who can see the session summary can give it a five and write a comment on it, and everyone else who can see that session can read the comment. You can delete any comment on your own session, and you can report one to us — a report sends us a copy of the comment and who wrote it.
- Photos — a photo you add to a session is shown, in place of the map, to the same people who can see that session. You can remove it at any time from the session page. Anyone who can see a photo can report it to us through the support page, and we may hide it while we look at it.
- Milestones — a personal best, a season distance, a first visit to a venue. A milestone goes to the same audience as the session that produced it, and disappears if you make that session more private.
Your display name and photo are an exception
Whichever rung you pick, your display name and profile photo can be seen by any signed-in TillerWise user. They are how you are identified everywhere you appear — a comment you wrote, a leaderboard row, a follower count — and we do not narrow them to your visibility setting. The rest of your profile is scoped: your bio, boat classes, home venue, and season totals follow the rung you chose. If you would rather not be identifiable to other sailors, use a display name that does not identify you and leave the photo blank.
Being findable is a separate choice
Appearing in search and in “sailors at your venue” suggestions is its own setting, and it is off until you switch it on. It never makes a session visible: it only decides whether people can find you. You can be findable and share nothing, or share with your followers and stay unfindable.
Changing your mind works backwards as well as forwards
Moving down a rung, making one session private, or removing a follower takes effect immediately and retroactively. There is no stored feed and no stored leaderboard to catch up: the next time anybody loads the page, the session, its fives, its comments, and any milestone it produced are simply not there for them. You do not have to wait for anything to be cleaned up, and you do not have to delete anything to unshare it.
The one thing we cannot reverse is what somebody already saw and copied out of TillerWise by hand. Nothing in the design can undo that, and we would rather say so than imply otherwise.
5. Who we share data with
Two different things count as sharing, and they are worth keeping apart.
Other TillerWise users are recipients of your personal data in their own right, not our processors. Your display name and profile photo can be seen by any signed-in user whichever rung you are on. Everything else — your sessions, your figures, your GPS track, your milestones, and the rest of your profile — reaches them only once you choose a rung above Private, and exactly what they get is decided by that setting and nothing else. Section 4 sets out who sees what.
Processors are the companies that run the service for us. They act on our instructions, they do not decide anything about your data, and they are listed in full below. We do not sell personal data, and we do not share it with advertisers or data brokers.
| Processor | Data shared | Purpose | Location |
|---|---|---|---|
| Amazon Web Services (AWS EMEA SARL) | All account, session, and file data | Cloud hosting: authentication and account verification emails (Cognito), database (RDS), file storage (S3), application compute (Lambda), rate limiting and job coordination (DynamoDB) | UK (London, eu-west-2) |
| Open-Meteo | Approximate location coordinates and session timestamps | Historical weather enrichment | Germany (EU) |
| Mapbox | Map tile requests, and a simplified track sample (at most 64 points) for each feed card’s map image | Map rendering in your browser and feed card map images | US |
| Strava | OAuth tokens, activity sync requests, provider identifiers | Activity import (when you connect) | US |
| PostHog | Internal user ID and behavioural event metadata (e.g. activity type, export format, support category). No GPS data, email, or display name. | Product analytics and server-side error monitoring | EU |
Your account, session, and file data is stored by AWS in its London (eu-west-2) region in the United Kingdom, so hosting your data does not involve an international transfer. Where other processors are located outside the UK, we rely on UK adequacy regulations or UK International Data Transfer Agreements (IDTAs) to ensure your data remains protected.
Garmin import is not yet available. If you request Garmin access, we record that request on your TillerWise account, but no personal data is shared with Garmin until the integration launches; we will update this policy when it does.
If you connect Strava, Strava may monitor and collect usage data related to your use of the Strava API within TillerWise and may use that data for its own business purposes, as described in the Strava API Agreement. If you delete an activity on Strava, TillerWise will reflect that deletion within 48 hours.
6. How long we keep your data
| Data | Retention |
|---|---|
| Account and profile | Until you delete your account |
| Sessions and GPS data | Until you delete the session or your account |
| Visibility and discoverability choices | Until you change them or delete your account. We keep the date you made the choice as the record of it |
| Follows and group memberships | Until you or the other sailor ends them, or you delete your account |
| Fives, comments, and milestones | Until deleted, or until the session they belong to is deleted, or until either account is deleted |
| Photos you add to a session | Until you remove them, or until the session or your account is deleted |
| Leaderboard standings | Not stored at all — worked out fresh each time they are shown |
| Data exports | 7 days after generation, then automatically deleted |
| Support requests | Until you delete your account |
| Provider connections | Until you disconnect or delete your account |
| Deletion audit records | 3 years (to demonstrate compliance) |
7. Your rights
Under UK GDPR you have the right to:
- Access — request a copy of all personal data we hold about you.
- Rectification — correct inaccurate or incomplete data via your profile settings.
- Erasure — delete your account and all associated data from your profile page. Read the note below on what that does to other sailors’ comments.
- Data portability — download your data in a machine-readable format from your profile page.
- Restrict processing — request that we limit how we use your data.
- Object — object to processing based on legitimate interest.
- Withdraw consent — move your visibility back down the ladder, or all the way to Private, at any time from your privacy settings or from the session itself; turn discoverability off; disconnect Strava or Garmin from your integrations page; and turn browser analytics on or off from the privacy controls below or from your profile page. Every one of these takes effect immediately, and the visibility ones work retroactively (section 4).
To exercise any of these rights, use the controls on your profile page or contact us at lucas@tillerwise.com. We will respond within one month.
What deleting your account does
Deleting your account is immediate and permanent. There is no grace period and nothing is archived: your profile, your sessions, your uploaded track files, your photos, your figures, your fives, your comments, your milestones, your group memberships, and your Strava connection all go, and we ask Strava to disconnect us at the same time.
Two consequences reach other people, and you should know about them before you do it:
- Comments other sailors wrote on your sessions are deleted too. A comment cannot outlive the session it was written on, so deleting your account removes their words from TillerWise as well as yours. The same happens the other way round: comments you wrote on other sailors’ sessions are deleted, and disappear from their threads.
- Groups you own are handed on, not destroyed. Ownership passes to the longest-standing remaining member so the group survives, and we rotate the invite link so any link you circulated stops working. If you were the only member, the group is deleted. Nobody else’s sessions are touched.
We keep one record of the deletion itself — your user ID, your email address, and the dates — for three years, because we have to be able to show that we carried it out. If somebody reported one of your comments before you deleted your account, our copy of that report stays with the moderation record.
8. Browser storage, analytics, and abuse prevention
TillerWise uses browser localStorage (not cookies) for two purposes:
- Authentication (strictly necessary) — to maintain your login session. This storage is essential for the service to function and does not require consent.
- Product analytics (consent required) — if you accept analytics, PostHog stores a pseudonymous identifier in localStorage to link your in-app actions (page views, feature usage) across a session. This identifier is a random UUID associated with your internal account ID after login. No name or email address is transmitted to PostHog.
We do not set tracking cookies or advertising pixels. Under PECR, localStorage used for non-essential purposes such as analytics requires your consent. When you first visit TillerWise, a consent banner is displayed. Analytics data is only collected if you accept. You can change your choice at any time using the controls below or from the privacy section of your profile page.
If you decline analytics, PostHog will not capture any browser-side events or store any analytics identifiers. Authentication storage continues to function regardless of your analytics choice.
We do not use a bot-challenge service on the sign-in or sign-up forms. Automated abuse is limited by rate limiting on our own servers, which uses the request’s IP address and timing and sends nothing to a third party.
In addition to browser-side analytics, our servers send pseudonymous events (keyed to your internal user ID, not your email or name) to PostHog’s EU infrastructure when you perform actions such as uploading a session, requesting an export, or connecting an integration. Server-side exception autocapture is also enabled to help us detect and fix errors. These server-side events are processed under legitimate interest (Art 6(1)(f)) and are not affected by your browser consent choice.
Analytics preferences
Browser-side product analytics are optional. Strictly necessary authentication storage and anti-abuse checks continue to operate regardless of this choice.
You have not chosen a browser analytics preference yet.
9. Children
TillerWise is not directed at children under 13. We ask for your date of birth when you create an account and will not open an account for anyone under 13, in accordance with the UK Data Protection Act 2018.
Club sailing has a lot of junior sailors in it, so this is worth spelling out. If you are under 18, your sessions stay inside your groups: the Venue and Public rungs — which put your name, your photo, the water you sail on, and the time of day you were out in front of every signed-in TillerWise account — do not take effect until your 18th birthday, and you do not appear in sailor search or on venue leaderboards before then. Private, Followers, and Groups work as they do for everyone. Accounts that predate this rule, and any account whose date of birth we do not hold, are treated the same way until the date is added.
10. Security
We implement appropriate technical and organisational measures to protect your data, including encrypted connections (TLS), row-level security on all database tables, scoped storage access policies, and regular dependency updates. No system is completely secure, and we encourage you to use a strong, unique password for your account.
The visibility rules in section 4 are enforced by the database itself rather than by each screen, so every read of a session, a comment, a milestone, or a leaderboard is checked against the setting you chose at the moment it is read. Deleting your account and downloading your data both require you to confirm your identity again first.
11. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you by email or through the application before they take effect. The version number and effective date at the top of this page will always reflect the latest revision.
When you create an account we record which version of this policy was in force, the date you accepted it, and your date of birth. When you acknowledge a later version we record that version too. Those records are deleted with your account.
12. Complaints
If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Telephone: 0303 123 1113