Privacy Policy

PaddleRoam is an independent, unregistered UK project. For the purposes of data protection law, the person responsible for your data (the “data controller”) is the individual operator of PaddleRoam, contactable at hello@paddleroam.co.uk.

What we collect

Account details: if you sign up, we store your email address, display name, and any optional bio or home region you add. Authentication is handled by Supabase Auth, our third-party account provider. We never see or store your password in readable form, and we don't store card numbers.

Location: if you use “near me” search, your browser shares your current coordinates with the site for that search only. We don't continuously track your location, and we don't store a history of it.

Route data: when you submit a route, the path you plot is stored and published publicly as part of the directory. This is public information by design — don't plot a route starting at your home address if you don't want that location published.

Photos: we strip EXIF metadata (including GPS location tags) from photos before storing them, so a review photo shouldn't leak a home address through its metadata. Please don't upload photos of other people without their consent.

Offline saves: if you save a route for offline use, that data is stored locally in your browser (local storage / service worker cache) on your own device. It isn't sent to or stored on our servers, and clearing your browser data will remove it.

Cookies and analytics: PaddleRoam doesn't currently use cookies, analytics, or advertising trackers. If that changes (for example, if we add privacy-friendly analytics), this page will be updated first and, where required, you'll be asked for consent.

Why we use your data

To run your account and let you use the Service (route submissions, saved routes, offline saving), to keep the site secure, and to respond if you contact us. We don't sell your data, and we don't use it for advertising profiling.

Who we share it with

• Supabase — hosts our database and handles account authentication, as our data processor.
• Stripe — if you purchase advertising once packages go live, payment is handled directly by Stripe; card details never reach our servers.

We don't share your personal data with anyone else, except where required by law.

Where your data is stored

Data may be stored and processed outside the UK/EEA by our providers (Supabase's infrastructure). Where that happens, it's covered by their own safeguards for international transfers.

How long we keep it

We keep account and route data for as long as your account is active. If you delete your account, we'll remove your personal details; published routes you've submitted may remain on the site in anonymised form (as a route, without your name attached) unless you ask us to remove them entirely.

Your rights

Under UK GDPR you can ask us to: give you a copy of your data, correct it, delete it, or restrict how we use it. Email hello@paddleroam.co.uk and we'll deal with it directly, since this is a small independent project rather than a large organisation. If you're unhappy with how we've handled your data, you can also complain to the Information Commissioner's Office (ICO).

Children

PaddleRoam isn't intended for children under 13, and we don't knowingly collect data from them.

Changes to this policy

We may update this policy as the Service changes. The date at the top shows when it was last revised.