Privacy Policy

This Privacy Policy explains how the apps published by nchanted (“we”, “us”, or “our”) handle your information. It covers Waterline, Approach Control, and BBQ Truck. By installing or using any of these apps you agree to this policy as it applies to that app.

At a glance, per app

Waterline

Waterline is an indoor-rowing app that reads your rowing machine over Bluetooth. It has no advertising, no analytics and no tracking, and it keeps no workout history on our side: the figures your machine sends are shown while you row and discarded when the piece ends. A small settings file on your device remembers your route, your best times, your colours, your workouts and which machine and strap to reconnect to. Signing in is optional and adds an account — see accounts below.

Two things you tap send anything at all, and one of them has a consequence on our server that is worth naming:

• Row Online. While you are rowing online, the display name you typed, the flag you picked, your route, your distance, stroke rate and power are relayed to the other people on that route. The relay holds that session in memory only and writes none of it to a database: when you disconnect, the rowing is gone.
• Connection logs. Separately from the rowing itself, the server that runs the relay records connections, disconnections and rejected attempts in its system log, and those entries include your IP address. This is how the service is kept secure and abuse is investigated; it is not used to build any picture of you, and it is kept for a limited period rather than indefinitely.
• Strava and Intervals.icu. You can send a finished piece to your own Strava or Intervals.icu account, one piece at a time, from the summary screen. It carries no location data, because a rowing machine has none. The file leaves your device by way of our own server, which passes it straight on and keeps no copy.

Heart rate

Waterline can connect a Bluetooth heart-rate strap. Nothing asks you to: if you never connect one, the app never reads a heart rate and none of this applies to you.

When a strap is connected, the reading is shown while you row and recorded in that piece on your device. It is not sent to the online river — the other rowers on your route never see it. If you choose to send a piece to Strava or Intervals.icu, your heart rate goes with it, under the same per-piece choice as everything else. It is not used to advise or diagnose anything, and disconnecting the strap in settings both drops the connection and forgets it.

Backing it up with your account is your choice, and it is off until you make it. If a piece arrives carrying a heart rate and you have not opted in, the server strips it and keeps the rest of the row. If you sign in and turn on BACK UP MY HEART RATE on the ACCOUNT page, Waterline stores two numbers for each piece you row from then on — your average and your peak heart rate — alongside the rest of that piece, so they come back on a new device and appear in your profile on waterlinerowing.com. Never a second-by-second trace. Heart rate is health data, so the only basis we rely on for this is your explicit consent (GDPR Article 9(2)(a)); we record when you gave it and the exact wording you saw. You can withdraw it on the same page in one tap, and withdrawing erases every stored value in the same operation — not at some later clean-up. Deleting your account erases them too. Pieces backed up before you turned it on carry no heart rate, and nothing is ever back-filled.

Comparing yourself with other rowers

Waterline can tell you where your best times stand among other rowers. It is off until you turn it on, with COMPARE ME WITH OTHER ROWERS on the ACCOUNT page in the app, beside the heart-rate switch, and it is the only reason any of what follows leaves your device.

What travels is a set of brackets, never your measurements: which of six age bands you are in, which of five weight bands, which of four height bands, your sex, and the country you already chose for your flag. Your height and weight themselves stay on your device — we are not told a centimetre or a kilogram, so there is none for us to lose. Each of the five is optional on its own; leaving one blank simply leaves that comparison empty.

What comes back is a count, a percentage and a spread. No other rower is ever named to you, and you are never named to them — nobody sees another person’s time. A bracket with fewer than eight rowers in it returns its size and nothing else, because a group small enough to count through is a group somebody can be identified in.

The basis for this is your consent; we record when you gave it and the wording you saw. Turn it off on the same page and all five values are erased in that moment, and you drop out of everyone else’s figures. Deleting your account removes them too.

Bluetooth, and the Android location permission

Waterline requests Bluetooth solely to find your rowing machine and heart-rate strap. On Android 11 and below the operating system will not let an app scan for Bluetooth devices at all unless it holds the location permission, so Waterline declares it for that reason only and restricts it to those versions (maxSdkVersion="30"). On Android 12 and above the scan permission is declared with the neverForLocation flag, which tells Android to withhold location information from the app. Waterline does not request, read, derive, collect, store or transmit your location on any version, and workouts sent to Strava or Intervals.icu carry no GPS track, because a rowing machine has no position.

Boats that are not people

Some of the boats you meet online are pace boats: software, named so that this is obvious. They are not real rowers and have no connection to anyone's data.

Accounts, and what the server keeps

An account is optional and Waterline rows without one. You sign in only if you want your rowing history, achievements and membership to survive a lost phone and follow you to the next one.

You sign in with Google or Apple. There is no Waterline password, because Waterline never sees one and never wants to hold one.

What the identity provider tells us, and what we keep of it

When you sign in, Google or Apple gives us a signed token about you. That token carries an opaque subject identifier — a meaningless string that means “this person” to us and nothing at all outside Waterline — and it also carries your email address and display name.

The server stores only the opaque identifier. There is no column for your email address and no column for your name. Your email and name are passed once to the app on your own device, so it can show you which account you are signed in with, and they stay in that app's private storage. If you use Apple's private relay address, that works here and we are none the wiser.

What your account holds

• an internal Waterline ID that is random and means nothing outside our database;
• the display name and country flag you chose, which are the same ones other rowers see when you row online;
• summaries of your sessions — distance, time, splits, the route — and the achievements they earned;
• your best 2 km split, if you have measured one. Training plans are paced from it, so it follows your account rather than sitting on one device;
• the boat colours and kit you picked, so the same boat turns up on a new device;
• the scheduled events you said you were coming to, and your results in the ones you rowed — see events below;
• whether you hold a membership, and which devices have asked about it;
• only if you opted in on the ACCOUNT page: your average and peak heart rate per piece — see heart rate above;
• only if you opted in to being compared: an age band, a weight band, a height band and your sex — see comparing yourself with other rowers below.

Events, and what a result shows

Waterline runs scheduled rows — a set time, the same water, whoever turns up. If you say you are coming, we store that so the app can show how many people are expected; other rowers see only the number, never who.

If you row one, we store your time and where you finished. The results for an event are public — anyone can see the finishing order, because a race needs one — but they carry no names. A result is a placing, a time and a split, and nothing on our server ties it to a name, because we do not keep one. You see which row is yours because you are signed in; nobody else can.

Your record across events — what you raced and what you won — is yours alone and needs your sign-in to read. You can row an event without an account; you simply cannot be ranked in one, because there would be nothing to attach the result to. Deleting your account deletes your signups and your results with it.

Your progress belongs to the internal Waterline ID, never to an email address, so changing your email or hiding it behind a relay cannot orphan your rowing.

Deleting it

You can delete your account from inside the app, without emailing anyone to ask permission: profile → ACCOUNT → DELETE ACCOUNT. That removes your history and profile from our server. It does not cancel a subscription — do that in Google Play or your Apple account settings first — and it cannot reach into anything you chose to publish elsewhere, such as a workout you sent to Strava or Intervals.icu. Anything on your device stays there until you clear the app or uninstall it.

If you cannot reach the app — phone lost, app already uninstalled — you can request deletion here instead, and it will be done within 30 days at the latest. That page also lists exactly what is removed and what is not.

The membership

If you take the membership, Google or Apple takes the payment and holds your payment details, not us. We never see your card. What reaches us is the fact that a valid subscription exists, recorded against your account so that it still counts when you open the app on a different device.

Some things are deliberately absent, and stay absent: no passwords, no advertising identifiers, no analytics SDK, no third-party trackers, no precise location, no exact height or weight, and no heart rate leaving your device unless you switch that on yourself — and then only two numbers per piece, never a trace.

Approach Control

Approach Control collects no personal data. It has no account system, no sign-in, no ads, no analytics, and no tracking. The app:

• requests no device permissions — no internet, location, contacts, storage, camera, microphone, Bluetooth, or device identifiers;
• makes no network requests — it runs entirely from files bundled inside the app and never contacts any server;
• contains no advertising, analytics, tracking technologies, or third-party SDKs, and uses no cookies or similar identifiers.

To make the game playable, it saves data locally on your device only (in the app’s private storage): your progress and saved shifts, preferences such as sound and display settings, gameplay statistics, achievements, and best scores. This information never leaves your device, is not accessible to us or any third party, and is removed when you clear the app’s data or uninstall it.

BBQ Truck

BBQ Truck collects no personal data. It is a single-player game that runs entirely offline: it holds no internet permission at all, makes no network requests, and contains no ads, analytics, tracking technologies or third-party SDKs. Your save file, settings and progress are stored locally in the app’s private storage, never leave your device, and are removed when you clear the app’s data or uninstall it.

Who else handles your data

A short and deliberately complete list.

• one.com hosts the server that runs the relay and, if you have an account, stores it. They act only on our instructions and may not use anything for their own purposes; a data processing agreement is signed and on file.
• Google and Apple, when you sign in with them. They are not acting for us: they decide for themselves what to record about the fact that you signed in, under their own privacy policies. Signing in tells them you use Waterline.
• Google Play and the App Store, if you buy a membership or leave a tip. They take the payment and hold the payment details; we receive only the fact that a purchase is valid.
• Strava, and only for the individual workouts you choose to send it.
• Intervals.icu, on the same terms: only the individual workouts you choose to send it.

That is the whole list. There is no advertising network, no analytics provider and no data broker in it, and we sell nothing to anyone.

App stores and platforms

Google Play (all three apps). When you download or use apps from Google Play, Google may collect and process certain information (for example for purchases, delivery, and crash reporting you opt into at the device level) under its own terms. That processing is governed by Google’s Privacy Policy at policies.google.com/privacy. We do not receive personally identifiable information from Google about individual users.

Strava (Waterline only). If you connect Strava, workouts you choose to upload are held in your own Strava account under Strava’s privacy policy. You can revoke Waterline at any time at strava.com/settings/apps.

Intervals.icu (Waterline only). If you connect Intervals.icu, workouts you choose to upload are held in your own Intervals.icu account under Intervals.icu’s privacy policy. Waterline asks for permission to write activities and nothing else — not your wellness data, not your calendar. You can withdraw it at any time from your Intervals.icu settings.

Children’s privacy

Our apps are not directed at children under the age of 13 (or the equivalent minimum age in your jurisdiction), and we do not knowingly collect personal information from them. Approach Control and BBQ Truck collect nothing at all; in Waterline, the only thing a child could make public is the display name they type for Row Online, which is optional, is never sent unless they tap ROW ONLINE, and is filtered before anyone else sees it.

Your rights

Privacy laws such as the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA) give you rights to access, correct, delete, or restrict the use of your personal data. Almost everything our apps hold about you is on your own device, where you control it directly and can erase it by clearing an app’s data or uninstalling it. Where you have connected Waterline to Strava or Intervals.icu, exercise your rights over the workouts held there with that service.

The one thing we hold on our own systems is the relay’s security log, which records connections along with the IP address they came from. If you want to know whether it holds anything of yours, or want it erased, write to info@nchanted.eu and say roughly when you were rowing; without that there is no name attached to a log line for us to search on. We will not ask you to prove who you are beyond what is needed to answer the question.

Data security and retention

Our apps store data in your device’s private storage, and Approach Control and BBQ Truck transmit nothing at all. Waterline transmits only while you are actually rowing online — over an encrypted connection, into memory on our relay, kept for no longer than your session — or when you send a single piece to Strava or Intervals.icu yourself. On-device data persists only until you clear it or uninstall the app.

The relay and the account server run on one machine we operate: SSH by key only with the root login disabled, a default-deny firewall with three ports open, TLS terminated at the front door, automatic security updates, and automated banning of hosts that hammer it. Its security log, the one place an IP address is written down, is kept for a limited period rather than forever, and is read only when something needs investigating.

How long we keep account data: for as long as you keep the account. Delete it in the app and the history and profile go with it. We do not keep a shadow copy for analytics, because there are no analytics.

Changes to this policy

We may update this policy from time to time — for example, if a game’s functionality changes or a new game is released. When we do, we will revise the “Last updated” date above and publish the new version at this page. Significant changes will also be reflected in the relevant store listing. Your continued use of a game after an update constitutes acceptance of the revised policy.

Contact

If you have any questions about this Privacy Policy, contact us at info@nchanted.eu.