Privacy Policy

1.1 Account Information

When you create an account, we collect:

• Full name - to identify you within your club
• Email address - for authentication and account recovery
• Phone number (optional) - for club invitation matching and contact purposes
• Password - stored securely by our authentication provider (Firebase Authentication); we never store passwords in plain text

1.2 Club and Activity Data

As you use the App, we collect data related to your participation in outrigger canoe clubs:

• Club memberships and roles (admin, coach, or member)
• Event registrations, RSVP status, and waitlist positions
• Attendance check-in records
• Crew and canoe assignments
• Role change history (audit logs)

1.8 Waiver Data

If your club uses the waiver compliance feature, we collect and store the following waiver-related data:

• Waiver status — whether a member has a valid waiver on file (signed or not signed)
• Waiver expiration date — the date on which the waiver expires, set either by an admin manually or imported from a third-party waiver provider
• Who marked the waiver — the identity of the admin who manually recorded a waiver, retained for audit purposes
• Waiver source — whether the waiver was recorded manually by an admin or automatically imported via a third-party integration (e.g., SmartWaiver)

This data is stored within your club's data in Cloud Firestore and is accessible to club admins and coaches.

1.3 Guest User Data

Coaches may register guest participants for events. Guest records include a name and phone number. A synthetic email address is generated for system purposes and is never used for communication.

1.4 Subscription and Payment Data

If you are a club administrator and subscribe to a paid plan, the following data is collected:

• Subscription status - whether your club has an active, trial, or expired subscription
• Transaction identifiers - provided by Apple App Store or Google Play to track your subscription
• Subscription period - start and end dates of your current billing cycle

We do not collect or store credit card numbers, bank account details, or other financial information. All payment processing is handled entirely by Apple (App Store) or Google (Google Play). We only receive confirmation of your subscription status.

1.5 Device Information

• Push notification token - to deliver notifications to your device
• Biometric capability - we check whether your device supports Face ID or fingerprint authentication, but we do not collect or transmit biometric data (see Section 3)

1.6 Location Data

When you create or edit an event, the App may request temporary access to your approximate location to improve address search results. This location data is:

• Used only momentarily in memory
• Sent to a geocoding service to sort address suggestions by proximity
• Never stored on our servers or your device

1.7 Automatically Collected Data

We use analytics and crash reporting tools to improve the App's performance and stability. These tools may collect:

• Anonymous usage data — screens viewed, feature interactions, and app session duration
• Crash reports — technical information about app errors, including device model, operating system version, and stack traces
• Device identifiers — anonymous identifiers assigned by analytics services (not your personal identity)

This data is aggregated and anonymized. We do not use advertising SDKs or collect browsing history.

5.1 Firebase (Google LLC)

• Firebase Authentication - manages user accounts and login sessions
• Cloud Firestore - stores application data (user profiles, clubs, events, etc.)
• Firebase Cloud Messaging - delivers push notifications on Android

Firebase processes your email address and account data. See Google's Privacy Policy.

5.2 Expo (Expo, Inc.)

• Expo Push Notification Service - relays push notifications to Apple (APNs) and Google (FCM)

Expo receives your device's push token, notification content, and payload. See Expo's Privacy Policy.

5.3 Apple App Store & Google Play (In-App Purchases)

• Apple App Store - processes subscription payments for iOS users. Apple handles all payment information and shares only transaction identifiers and subscription status with us. See Apple's Privacy Policy.
• Google Play - processes subscription payments for Android users. Google handles all payment information and shares only transaction identifiers and subscription status with us. See Google's Privacy Policy.

We do not have access to your credit card, bank account, or other payment details.

5.4 Analytics & Crash Reporting

• Firebase Analytics / Google Analytics — collects anonymous usage data such as screen views, feature interactions, and session duration to help us understand how the App is used. See Google's Privacy Policy.
• Sentry (Functional Software, Inc.) — collects crash reports and error data to help us identify and fix bugs. Sentry receives technical information about errors, device model, and operating system version. See Sentry's Privacy Policy.

These services collect anonymized, non-personal data. We do not use any advertising or user-profiling analytics.

5.5 SmartWaiver (Waiver Forever, Inc.)

Clubs that choose to enable the SmartWaiver integration can connect their SmartWaiver account to Va'a Sync using their SmartWaiver API key. When this integration is active:

• Va'a Sync periodically queries the SmartWaiver API to retrieve signed waivers for your club's SmartWaiver template
• To match signed waivers to club members, Va'a Sync sends each member's email address and full name to the SmartWaiver API for comparison against waiver records
• Matched waiver data (waiver status and expiration date) is stored in Cloud Firestore and displayed within the App
• SmartWaiver data is only used for waiver status matching; it is not used for any other purpose

The SmartWaiver integration is an optional, admin-configured feature. It is only active if an admin has entered a SmartWaiver API key in the club settings. See SmartWaiver's Privacy Policy.

5.6 Other Services

The App also uses third-party geocoding and weather services to provide address search and event weather forecasts. These services receive only search queries, event location coordinates, and optionally your approximate location for sorting results. No personal data (name, email, phone, or account information) is sent to these services.

For California Residents (CCPA)

You have the right to know what personal information we collect and how it is used. We do not sell personal information. You may request deletion of your data by contacting us.

For European Residents (GDPR)

Our legal basis for processing your data is:

• Contract performance - to provide the App's services you signed up for
• Legitimate interest - for club administration and security
• Consent - for optional features like push notifications, biometric login, and location access

12.1 Types of Messages

• Club invitations — sent when an existing club admin or member invites you to join their club
• Account notifications — transactional updates related to your account or club membership

We do not send marketing or promotional SMS messages.

12.2 Consent

By providing your phone number to a club admin or existing member who invites you, or by entering your phone number directly in the Va'a Sync app, you consent to receive these messages.

12.3 Message Frequency

Message frequency is infrequent. You will typically only receive an SMS when you are invited to a club or when there is an account-related event.

12.4 Message and Data Rates

Message and data rates may apply. Carriers are not liable for delayed or undelivered messages.

12.5 Opt-Out

Reply STOP to any message to unsubscribe. You will receive a confirmation message and no further SMS will be sent to your number.

12.6 Help

Reply HELP for assistance, or email us at [email protected].

12.7 No Third-Party Sharing for Marketing

We do not share your phone number with third parties for marketing purposes. SMS messages are delivered via our service provider (Twilio, Inc.) solely to facilitate the messages described above.