Fulmaire

Part 1 — Privacy notice (for users)

*Last updated: 16 October 2026. Controller: Razorbill Technology Limited, Kildee, Dunmanway, Co. Cork, P47 NH01, support@fulmaire.com.*

The short version

Fulmaire records where you have paddled. That means we hold precise location

data about you, which is sensitive, and we treat it that way.

We do not sell it, and we never give advertisers where you paddle. The free

version shows ads from Google; premium has none. We hide the water

around the slipways you use regularly so the map does not tell anyone where you

launch from. You can download everything we hold, or delete all of it, at any

time, from inside the app.

What we collect

From the files you upload. GPS positions and timestamps for the whole

paddle, and where the file carries them, your device model and serial number

and your speed. We keep the original file.

From recording on your phone. If you press "Record a paddle on this

phone", Fulmaire asks your phone for its location until you press Stop. In a

web browser that is only while Fulmaire is open on screen; in the Android app

it carries on with the screen off, and Android shows a notification for as long

as it does. The positions are saved on your phone as they arrive and reach us

only when you stop, as an ordinary uploaded file, treated exactly like one. A

recording that has not been sent yet stays on your phone until it is, or until

you discard it. The Android app keeps your most recent finished recording on

the phone so you can send it again.

From you. A handle, and an email address if you have given one.

Anything you send us through Feedback, with the page you were on and the app

version unless you untick that. It is deleted with your account.

Derived by us. Which stretches of water you covered, which counties and

named waters you were in, distance and duration, which awards you have earned,

and which cells you currently hold.

Automatically. Basic server logs. And which parts of the app you use, by

day: for example, that on 15 October you opened Awards and uploaded a paddle.

One mark per part per day, not every tap, not the time, not where you were.

Fulmaire counts this itself, in its own database, and sends it to nobody,

Google included. We look

at it only as totals (how many people used Awards this month), to learn what

is worth improving and what is not.

Why, and on what basis

| What | Why | Lawful basis |

| Processing your tracks into claims and awards | It is the service | Contract |

| Showing your claims to other paddlers | It is a shared map; a private one would be a different product | Legitimate interests |

| Keeping your original files | So your history can be recalculated when the maps or the algorithms improve | Legitimate interests |

| Account security, abuse prevention | Keeping the register trustworthy | Legitimate interests |

| Emails about your account | Running the service | Contract |

| Counting which parts of the app are used, by day | Knowing what to improve, and whether people come back | Legitimate interests |

| Showing ads on the free version | It pays for the free version | Your consent, for advertising cookies and ads chosen for you; legitimate interests, for ads that are not |

Where we rely on legitimate interests you can object at any time, and we will

stop unless we have compelling grounds not to. Our assessment is in Part 3

below; ask and we will send it.

Advertising

The free version shows one ad at the foot of Paddles and of Awards, served by

Google Ireland Limited. Before any ad loads, Google's consent message asks

whether you agree to cookies for advertising. If you agree, Google may use

cookies and your device's identifiers to choose ads for you and to measure

them. If you do not, Google shows ads not chosen from your activity, and may

still use cookies to prevent fraud and limit how often you see the same ad,

where the law allows. Like any website you open, Google also sees your IP

address (which can suggest your rough area), your browser and the address of

the page.

We never give Google your paddles, positions, sightings, handle or email. You

can change your answer at any time under Settings, "Cookie and ad choices".

Premium has no ads. How Google uses this information:

policies.google.com/technologies/partner-sites

Who can see what

Competing for water is off when you join. While it is off, none of your

water appears on the World map, you hold no cells, and you are on no

leaderboard or league; your own map and awards are unaffected. You can switch

"Compete for water" on or off at any time on My map.

If you compete, other paddlers see the name you appear under on the map,

the cells you hold, the awards you have earned, and your position on

leaderboards. That name

is a generated alias such as "Paddler 4821" unless you choose an alias of your

own or choose to show your handle. You can change it at any time on My map.

If you make your profile public, other signed-in paddlers can open it from

the map: the cells you hold, your awards and your totals, under the same name.

Your profile is private until you switch it on. Your paddles, their dates, your

routes and your heat map are never shown to anyone else, public profile or not.

If you turn on "Show who I paddled with", and another paddler who has also

turned it on recorded a paddle on the same water at the same time, each of you

sees the other's map name on that paddle, six hours after you both finished. It

is off until you switch it on, it only ever names someone who has switched it

on too, and it shows nothing about anyone's other paddles. You can switch it

off on My map; names stop showing from then on.

If you turn on river times, your best time down each river stretch is shown

to other paddlers who have paddled that stretch, by your map name. Only your

best time is shown, never when it was or your route. It's off unless you turn

it on.

Notes you write on your paddles (a title and a few lines) are yours alone.

They are never shown to anyone else, and they are included when you download

your data and deleted with the paddle or your account.

Sightings you record (wildlife, a coastal or river feature, an invasive

plant, litter or pollution, a hazard) each keep a point and a time: placed

along one of your paddles, put on the map by hand, or taken from your phone's

location at the moment you press "Mark a sighting here". The phone's location

is read only when you press it, never in the background; without signal the

mark waits on your phone until it can be sent. Other paddlers never see your

sightings. Unless you switch off "Share my sightings" on My map, we share

what each sighting was, where it was (wildlife and other passing things to

about 100 metres, a coastal or river feature exactly), when (to the hour, or

for a feature only the day), how many, a feature's size and tidal access, and

what you wrote about it, with any email address, link, handle or phone number

taken out, with wildlife,

environmental and heritage recording groups, and may publish them in our

own publications. A shared record never carries your name, your account

or anything about the paddle, and we do not share one recorded near the places

you habitually launch from, or until six hours after the paddle. Please do not

name people in what you write about a sighting. Your sightings are included

when you download your data and deleted with the paddle or your account, or

one at a time; what was already shared, carrying nothing that identifies you,

cannot be recalled.

If you join a club, its other members see the water you have paddled on

the club's map, along with your map name, your recent awards, and your share of

the club's paddle and distance totals. Each cell shows how many members have

paddled it, never who or when. Your privacy zones still apply, nothing appears

until six hours after a paddle, and paddles from a source whose terms keep them

private to you are left out. Only members can open a club's page. We keep which

clubs you are in and when you joined; you can leave on the club's page, and

leaving or deleting your account removes you from every club at once.

A club's name is not private to its members. The club leagues, which every

signed-in paddler can see, show each club's name, its distance or count for

the period and how many of its paddlers counted, but never who they are.

If you join a club trip (an outing a member organises), the trip's club sees

that you are going, as a number, and the others going see your map name and

the club you are paddling for. Paddlers from other clubs can join by the

trip's link if its organiser allows it, and an organiser who asks to approve

people sees the map name and club of anyone asking. What you write in the

trip's chat is seen only by those going. Any of them can report a message to

us; we read the report and either leave the message or take it down, and if

we take down something you wrote you see that it was removed and why. The

person you reported is not told it was you. The chat closes a day after the trip

ends and its messages, and any reports of them, are deleted 48 hours after that. Paddles you log during

the trip count towards what it covered: those going see a map of the water covered,

with no names on it, and how much each club paddled; the trip's club sees the

totals. The same privacy zones, six-hour delay and private sources apply.

Leaving a club takes you off the trips it organised, and deleting your account

takes you off every trip and deletes your messages.

Other paddlers do not see your email, your device details, your original

files, your exact routes, or the water inside your privacy zones.

Two protections are on by default and you do not have to switch them on.

*Privacy zones.* Once you have launched from the same place more than once, we

treat it as a habitual put-in and hide the water within 1 km of it from the

public map. Those cells are still yours and still count towards everything.

They are simply not shown next to your name, because a cluster of cells around

one slipway tells a stranger where you launch, and for most people that is

close to where they live. You can widen or narrow the radius.

We never show who is on the water right now. Nothing you upload appears on

the public map until at least six hours after the paddle ended.

We never suggest where to paddle. Fulmaire records where you have been. It

does not point you at water nobody has recorded, because water nobody has

recorded is sometimes unrecorded for a reason.

How long we keep it

Your tracks, claims and awards stay while your account exists, because a

logbook you cannot look back through is not a logbook.

If your account is inactive for three years we will email you, and if we hear

nothing within 30 days we delete it. Server logs are kept 90 days. The record

of which parts of the app you used is kept 400 days, so one season can be set

beside the last. Deleted

accounts are gone within 30 days, including backups.

Your rights

Under the GDPR you can get a copy of your data, correct it, delete it, object

to processing, restrict it, and take it elsewhere.

Two of these are buttons rather than requests:

Deletion removes your account, your tracks, your original files and every

record of where you paddled. Cells you held return to whoever held them before

you. Anything else, email support@fulmaire.com and we will respond within one month.

You can complain to the Data Protection Commission, 21 Fitzwilliam Square

South, Dublin 2, or to your own supervisory authority.

Where it is stored

On servers in the European Union — Amsterdam — and backed up continuously to

object storage also held in the EU.

Our hosting (Fly.io), backup (Cloudflare) and sign-in (Google) providers are

US companies. We use their EU locations for your data, but we cannot rule out

that they, or their support staff, can reach it from outside the European

Economic Area. Where that can happen, it is covered by the safeguards the GDPR

requires for it, such as the European Commission's standard contractual

clauses in each provider's data processing terms. Ask us and we will tell you

which applies to each one.

Signing in

You sign in with an account you already have, currently Google. We never see

your password. Google tells us a permanent identifier for your account and the

email address on it, and we keep both: the identifier so that signing in again

reaches the same paddling history, and the address so you can see which account

you linked. Signing in tells Google that you use Fulmaire.

You can see what we hold under *Your rights*, and deleting your account deletes

the link along with everything else.

Connected apps

You can connect an account you already have elsewhere, so that new paddles

arrive without you uploading them. Two are offered: Polar, for Polar watches,

and intervals.icu, a free training site that Garmin watches can send to.

Nothing is connected unless you press Connect and agree on that service's own

page.

Once connected, the service tells us when you have recorded a new activity,

and we fetch that one file from it. It is the same kind of file you could have

uploaded yourself, and we treat it exactly as an upload: a walk or a run is

skipped, a paddle goes on your map, and the privacy zones and six-hour delay

apply as usual. We keep the service's identifier for your account and the

access key it gives us, so that we can ask for new files and nothing else. The

key is never shown to anyone, including you, and is not in your data download.

You can disconnect on My map at any time. That stops new paddles arriving;

paddles already here stay until you delete them or your account. Each service

is a separate company with its own privacy notice, and connecting tells it

that you use Fulmaire.

The Fulmaire field on a Garmin watch

If you add the Fulmaire field to your watch, it keeps your position every ten

seconds while your activity's timer runs, and sends it to us through the

Garmin Connect app on your phone every few minutes. It records only while it

is on the activity you added it to, and only while the timer is running. What

it sends is kept as sent, in the same way we keep every uploaded file, and

becomes a paddle once the activity ends. From then on it is treated exactly

as an upload: the privacy zones and the six-hour delay apply as usual.

You link the watch by typing a code from My map into the field's settings.

The watch then holds a key of its own, and we keep only a scrambled form of

it. Disconnecting on My map stops the watch sending; removing the field from

your activity stops it recording. The points travel through Garmin's apps on

your watch and phone, so Garmin's own privacy notice also applies to them.

Processors

ledger.

Google; we receive an identifier and an email address.

Each under a data processing agreement. Current list on request.

Children

Fulmaire is not intended for under-16s and we do not knowingly hold their data.

Changes

We will email you before anything material changes.

Part 2 — Record of processing (Article 30)

*Internal. Required if asked; users never see it.*

| Field | Entry |

| Controller | Razorbill Technology Limited, Kildee, Dunmanway, Co. Cork, P47 NH01, support@fulmaire.com |

| DPO | Not required at this scale. Contact point: support@fulmaire.com |

| Purposes | Recording and recognising paddled water; shared map; leaderboards; account security; counting which parts of the app are used; advertising on the free version |

| Categories of data subject | Registered paddlers |

| Categories of data | Precise location traces with timestamps; device identifiers; handle; email; connected-app account identifiers and access keys (Polar, intervals.icu, the Garmin field); derived claims, awards, ownership; which parts of the app each paddler used, by day |

| Special categories | None intended. See the risk note below |

| Recipients | Hosting provider; email provider; Google, for ads on the free version, receiving no location data. No data brokers, no sale |

| Third country transfers | Possible, through US-owned processors (Fly.io, Cloudflare, Google) using EU locations; covered by each processor's GDPR transfer safeguards, such as standard contractual clauses |

| Retention | Account lifetime; 3 years inactivity then deletion; logs 90 days; app use by day 400 days; deletion completes within 30 days including backups |

| Security | TLS in transit; Fulmaire sign-in tokens stored as SHA-256 hashes only; connected-app access keys stored as issued (they must be presented to the provider), never exported or displayed, deleted on disconnect; per-account rate limiting; ledger on an encrypted volume; daily snapshots with 14-day retention |

Risk note, recorded deliberately. Location traces can reveal special

category data by inference — a route ending at a place of worship every Sunday,

or at a hospital. Fulmaire does not seek this and cannot prevent it existing in

an uploaded file. Mitigations: privacy zones on by default, no route geometry

exposed publicly, original files never shared. This is the residual risk that

most justifies keeping the public surface as small as it is.

DPIA. Likely required: systematic monitoring of location at scale is on the

supervisory authority's list. Commission one before public launch.

Part 3 — Legitimate interest assessment

For the processing activities that rely on it.

A. Showing your claims to other paddlers

Purpose. A shared map is the product. Territory nobody else can see is a

private logbook, which is a different and much less useful thing.

Necessity. No less intrusive option achieves it. Fully anonymous claims

would remove the recognition that is the entire point.

Balancing. In the paddler's favour: they chose to join a shared map, the

public surface is a name (an alias unless they choose to show their handle)

plus a hexagon, no route geometry or timing is

published, privacy zones are on by default, and publication is delayed six

hours. Against: cumulative claims still reveal a pattern of activity.

Conclusion. Proportionate, with those mitigations, and only with them. A

right to object is offered and honoured by deleting the account or making it

private.

B. Keeping original uploaded files

Purpose. The ledger is derived from the file by a cleaning and mapping

pipeline. Without the original, a bug fix or a resolution change cannot be

applied to past paddles, and a paddler's history would be silently frozen at

whatever the code did on the day they uploaded.

Necessity. No alternative. Derived data cannot be re-derived from itself.

Balancing. In the paddler's favour: files are never shared, are deleted

with the account, are stored on the same encrypted volume, and the benefit

accrues to them — their own history improves. Against: it is the most detailed

data we hold and it is retained longest.

Conclusion. Proportionate, provided files are never shared and deletion is

genuinely complete.

C. Counting which parts of the app are used

Purpose. Knowing whether people come back between paddles and which parts

of the app they use, so effort goes where it helps and unused parts can be

removed. Uploads alone cannot tell one person ten times from ten people once.

Necessity. Totals with nothing per person cannot answer "did they come

back". A day and the name of a part is the least that can.

Balancing. In the paddler's favour: one mark per part per day, no times,

no positions, no taps; counted by Fulmaire on its own server from requests the

app already makes, with no tracker, no extra cookie and no third party; read

only as totals; included in the export, deleted with the account, kept 400

days. Against: it is a record of the days someone opened the app.

Conclusion. Proportionate at that grain. Anything finer, or anything

shared, would need a fresh assessment and probably consent.