BoatRun - Data Security for Schools
Last updated: 17 August 2026
This page is a summary for school and club administrators evaluating BoatRun for use with junior rowers. It covers what data is collected, where it's stored, and how it can be deleted. For full detail, see our Privacy Policy.
Summary
- No accounts required to row. Rowers open Metrics and start recording - no sign-up, no email address, no personal profile.
- Rowers set their own username. Coaches do not assign or edit a rower's display name.
- No advertising, no tracking, no data sale. BoatRun has no ad tech and does not sell or share data with third parties.
- Data stays with the school/rower, not on our servers. Session files live on the rower's device, their own private Google Drive folder, and (for coached sessions) the squad's cloud storage - we do not hold a separate copy ourselves.
- All cloud data is encrypted. Firebase traffic is encrypted in transit (TLS) and encrypted at rest by Google's infrastructure.
What data is collected
| Data type | When | Where it goes |
|---|
| GPS location | Only while actively recording | Stored in the session file only |
| Motion sensor data | Only while actively recording | Stays on-device unless saved/synced |
| Heart rate | Only if a strap is connected | Stored in the session file only |
| Username | Set by the rower, always | Attached to live and uploaded session data as the only identifying label |
| Live stroke rate / pace / position | Only while connected to a squad session | Broadcast to coach/squad screens in real time, not retained after the session |
| Full session file | Automatically, at the end of any coached session | Squad cloud storage, along with the rower's username only, until pruned (21 days) or deleted early |
Junior rowers and consent
BoatRun is not designed or marketed for children to use unsupervised. Where BoatRun is used by junior rowers through a school or club program, we rely on the school, club, or a parent/guardian to obtain any consent required by applicable law before a minor uses the app, and to supervise the minor's access to squad codes and any shared data.
- No account or personal profile is required - a squad code identifies a rower's device within a session, not the individual.
- The rower sets their own display name. We recommend schools instruct junior rowers to use first name or initials only - not full names.
- We do not use any user's data, including a minor's, for advertising, marketing, or profiling of any kind.
- We do not knowingly collect data for the purpose of building a profile of an individual child.
Coached sessions and squad storage
When a rower is connected to a coach, their full session file uploads automatically at the end of the session, along with their username only - no other identifying details are attached. This squad storage can optionally be password protected by the coach, and is only accessible to squad members at the "coach" role level, not to ordinary rowers or spectators.
Squad codes
A squad code is the only thing linking a rower's live data to a coach's screen - treat it like a shared password. We recommend schools generate a fresh code each term or season and avoid reusing it across squads, so past rowers lose visibility once they've moved on.
Deletion
- A rower or school admin can delete local session data from within the app at any time.
- Google Drive session data can be permanently deleted using the "Delete my Drive data" button in Metrics settings.
- Sent-to-coach cloud records are auto-pruned after 21 days, or a coach can remove them earlier from Settings.
- A school or parent/guardian can request coach to delete a specific junior rower's data saved in the squad storage.
Third parties
- Google Drive / Google Sign-In - only used for the rower's own private backup folder; we cannot read it.
- Firebase Realtime Database (Google Cloud) - used for live squad data and sent-to-coach session files, encrypted in transit and at rest.
- Strava - only contacted if a rower explicitly chooses to export a session there.
Contact
Questions from school IT, safeguarding, or DPO teams: bigwig.91mash@icloud.com