Privacy

If you register a challenge, we keep what you typed into the form: your name, your email address, your club or organisation if you gave one, the discipline, where and when, and your description. We keep the time you gave your consent and a reference number.

If you have an account — organisers and invited participants only — we keep your email address, a display name, your role, a scrambled copy of your password that cannot be turned back into it, and the times your sessions began and ended. When an organiser looks up a place in the console, the words they typed are sent by our server to Mapbox to find it on the map; the organiser's browser, and every visitor's, never talks to Mapbox.

If you ride a tracked challenge, we keep a display name and your positions on the water for the day, and we delete the raw positions within thirty days of the finished route being published.

We keep nothing else about you. No analytics, no advertising cookies, no third-party trackers. The only cookie this site sets is the one that keeps an organiser signed in.

Videos are kept on YouTube or Vimeo, and nothing is loaded from either until you press play. When you do, the video plays here through their player — YouTube's in its no-cookie mode — and they then handle your visit under their own privacy terms. If you would rather not, the play button is also an ordinary link to the video on their site.

The wind on the map is a public forecast from the US weather service (NOAA). Our own server collects it a few times a day and your browser gets it from this site: switching the wind on does not connect you to a weather company, and nothing about you or where you are is sent to anyone to show it.

A challenge request is kept so an organiser can reply to you and, if it goes ahead, put the challenge on the map. It is seen by TAWR's organisers and no one else; it is not published. Your email address is never shown on the site.

Account details are kept so that the person signing in is the person we invited. Everything an organiser does in the console is recorded against their name.

• A challenge request: until it is answered, then a year, then deleted.
• A sign-in session: fourteen days from the last visit, and never more than thirty.
• An invite link: seven days.
• Raw positions from a tracked challenge: thirty days after the route is published.
• An account: until you ask for it to be closed.

Backups of the database can outlive these deletions for a short while; they are not read except to restore the service.

Write to the organisers named on the Challenges page. We will confirm what we hold and remove it if you ask, unless we have a reason in law to keep it. The data controller is the charity.