Privacy Policy

Effective 15 September 2026 · Last updated 15 September 2026 · Version 1.3

1. Who We Are

Fetch is operated by IDFALCON PTY LTD (ABN 12 684 389 188), an Australian company registered in Victoria. In this policy, "we", "us" and "our" mean IDFALCON PTY LTD. We operate this website, the Fetch Club portal, and the Fetch mobile application. For privacy enquiries, contact us at privacy@fetchthemark.com.

We aim to handle personal information consistently with the Australian Privacy Principles whether or not the Privacy Act 1988 (Cth) applies to a particular activity. Nothing in this policy limits a right or remedy you have under applicable law.

2. Data We Collect

We collect the following categories of personal data:

• Information you provide: name, email address, and message content submitted via contact or newsletter forms.
• Usage data: pages visited, session duration, referral source, and UTM parameters, collected via PostHog analytics.
• Technical data: browser type, device type, network information, and approximate location derived from an IP address. Our analytics, hosting and security providers may process IP addresses to deliver, analyse and protect the service.
• Legal acceptance records: when you accept the Terms and acknowledge this Privacy Policy in the Fetch app or the club portal, we record which versions you accepted, the effective date of those documents, that you confirmed you are 18 or over, whether you accepted in the app or the portal, and the time you accepted. The time is set by our server, not by your device.

The Website's Port Phillip demonstration map loads nautical chart tiles from Mapbox. Mapbox receives the standard tile request (your IP address and the map area shown) but not your identity or any Fetch account. Web fonts and the map library itself are served from our own domain rather than a third-party content-delivery network.

3. How We Use Your Data

• To respond to your enquiries and notify you when the App launches.
• To send newsletters or product updates you have opted into.
• To understand how visitors use the Service and improve it.
• To show a sailor's live position to the race officers of the club running a race, where the sailor has chosen to share it.
• To comply with our legal obligations.

4. Analytics: PostHog

We use PostHog for product analytics. Website and club-portal events such as page views and form interactions are not linked to your Fetch account. In the mobile app, PostHog uses your Supabase account UUID as a pseudonymous identifier so account-linked analytics can be found for deletion; it is not anonymous. We do not send GPS coordinates, email addresses, race tracks, boat IDs, or race IDs to PostHog. We operate PostHog in EU data-residency mode. PostHog receives the IP address of the request and derives an approximate location from it, which we use to understand which regions our visitors and sailors come from. PostHog is not initialised at all unless you accept it first. See our Cookie Policy.

PostHog's privacy policy is available at posthog.com/privacy.

5. Form Submissions: Supabase and Resend

Contact and newsletter form submissions are stored in Supabase, a managed database platform that processes data on our behalf.

When you submit a form we send a confirmation or acknowledgement email via Resend, an email delivery provider. Resend receives your name and email address (and, for contact messages, your message content) solely to deliver these emails on our behalf. Resend's privacy policy is available at resend.com/legal/privacy-policy.

6. Error Monitoring: Sentry

We use Sentry to detect and diagnose crashes and errors. When something goes wrong, Sentry receives technical diagnostics such as an error message, stack trace, and limited browser or device context. Sentry is configured to minimise personal data: default PII is disabled, and known account, user, email, GPS, club, boat, race, position and navigation identifiers are stripped before sending. Session Replay and application-log capture are disabled. This processing is operational and is not used for marketing or profiling.

Sentry's privacy policy is available at sentry.io/privacy.

7. The Fetch Mobile App

The Fetch app collects additional data to provide race navigation:

• Location (GPS): used in real time to calculate bearing, distance, and VMG to race marks. During an active race your position track (latitude, longitude, speed, heading, timestamp) is recorded and uploaded to Supabase. Your track is private to you by default. If you turn on "Share my track with this race", another Fetch account holder who has entered a boat in the same race may replay the shared positions, speed, heading, and timestamps. Club membership alone does not give access. You can turn sharing off at any time to stop future access, although someone who previously had access may already have seen the track. Fetch records the sharing-notice version and the time you opted in or withdrew. Offline points are queued in the app's private on-device storage. With device permission, active-race recording may continue while the screen is locked or the App is in the background and stops when race recording stops. Queued points are removed from the device within 7 days of being uploaded, and points that never upload are removed after 30 days; how long we keep the uploaded track on our servers is described in section 9. Outside an active race, location is processed on your device only and never stored.
• Sharing your position with your club: Sharing is off until you choose Share with your club. After that, during an official club race you have entered, the App sends your boat's latest position, speed, heading and the time of that position to Fetch about every 10 seconds, including while your phone is locked or Fetch is in the background, until your boat finishes, you end the race or you stop sharing. The race officers and administrators of the club running that race can see it in the Fetch Club portal, so they know which boats are on the water and which have finished. Other sailors and club members cannot. Fetch keeps only the latest position for each boat. It is deleted when your boat finishes or withdraws, when the race ends, within seven hours of the last update, or straight away when you stop sharing. Practice sessions are never shared, and you can stop at any time from the race screen or Settings. This is not a safety or emergency service: a phone can lose signal or battery, so your club's sign-on and sign-off procedures still apply. The App records the notice version you were shown and when you said yes or no.
• Profile and account data: boat name, sail number, helm name, home club, racing class, and your email address, stored in Supabase with row-level security.
• Purchases: App Store / Google Play subscriptions are validated by RevenueCat using your Supabase account UUID as a pseudonymous identifier; your card details are handled by Apple or Google and never reach us. Club portal subscriptions are processed by Stripe.
• Maps and weather: nautical chart tiles are served by Mapbox, which receives standard tile requests (your IP address and the viewed map area, never your identity). Wind forecasts come from MET Norway (the Norwegian Meteorological Institute), which receives an area-level location and your device's IP address, never your precise personal location or your identity.
• Saved race cards: only when you tap Save, the App writes the race-card image it generated to your photo library. It does not read or upload your existing photos.
• Diagnostics: mobile PostHog usage events use the pseudonymous account UUID described above so they can be deleted with the account. Sentry is configured not to attach your Fetch identity and to remove known navigation/account fields before sending diagnostics. Your GPS coordinates are never intentionally sent to either service, and we do not use session recording or screen replay.

8. Service Providers and Overseas Processing

We use Supabase, Vercel, Cloudflare Turnstile, Resend, Stripe, Apple, Google, RevenueCat, PostHog, Sentry, Mapbox and MET Norway only as needed to provide, secure, diagnose and improve the service, process payments, deliver requested messages, render maps or obtain area-level weather. Vercel hosts and secures the Website and Portal and processes request metadata such as IP addresses. The Portal's status bar gets wind for the club's location from MET Norway through our servers, with neither a Fetch account identifier nor the visitor's IP address, and calculates its tide reading itself.

Our providers and their subprocessors operate in Australia and overseas. Depending on the service, production configuration, support request and network route, information may be processed in the United States, countries in the European Union, and other countries identified in a provider's current subprocessor or data-location documentation. Vercel also uses a distributed network. Where Australian privacy law requires reasonable steps for an overseas disclosure, we assess the information and recipient and use appropriate contractual, technical and organisational safeguards. This is not a promise that every recipient is subject to Australian law or that processing can occur only in a named hosting region.

9. Data Retention

We retain personal data only as long as necessary for the purposes described above, or as required by law. Contact and newsletter data is retained for up to 2 years. Analytics, diagnostic, security and delivery records follow the applicable configured or operational provider period. Payment providers may retain transaction records for legal, financial, fraud-prevention and dispute purposes.

If an account has no successful sign-in for 3 years, we give 60 days' notice before deleting the dormant account and its attributable tracks, unless a documented legal hold, active dispute or mandatory record requirement applies. Signing in during that period cancels the deletion.

Race tracks. We keep the race tracks you record for as long as your account exists, so your racing history stays available to you. Tracks from the last 24 months are kept at full recording detail. Older tracks are reduced to a lower resolution (about one point every 10 seconds, always keeping the start and the finish of each track), which keeps the race replayable while we hold less location data about you. That reduction is permanent and cannot be reversed. If you delete your account, all of your tracks are deleted in full, whatever their age.

Live position shared with your club. Latest position only. Deleted when your boat finishes or withdraws, when the race ends, within seven hours of the last update, or straight away when you stop sharing.

Legal acceptance records. We keep a record of each acceptance, including acceptances of versions that have since been replaced, for as long as your account exists, and delete them when you delete your account.

Sharing decisions. Each yes or no with the notice shown, while the account exists; deleted on account deletion.

Official club race entries and results may remain for the club's operational period after an account is deleted, but without the deleted Fetch account/profile link and without that person's GPS track. Deleting a sailor or Club administrator does not delete the Club, its courses, or its past official races.

10. Your Rights

Under applicable Australian privacy law, you may ask us to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data.
• Withdraw consent to communications at any time.
• If the Australian Privacy Principles apply to our handling, lodge an eligible complaint with the Office of the Australian Information Commissioner at oaic.gov.au.

Signed-in users can permanently delete their Fetch account from Settings in the mobile app or the club portal. This immediately removes the Fetch identity, profile, private practice data, and attributable GPS tracks. Cleanup requests to processors may continue securely in the background for up to 30 days. Deleting Fetch does not cancel an Apple App Store or Google Play subscription; cancel store billing separately in the relevant store subscription settings. See our account deletion instructions.

If you cannot sign in, or to exercise another privacy right, contact us at privacy@fetchthemark.com. We will respond within 30 days.

11. If You Are in the EU, EEA or the UK

Where Fetch is expressly made available to you in the European Union, European Economic Area or United Kingdom, the EU General Data Protection Regulation or UK GDPR applies as relevant. IDFALCON PTY LTD is the controller. We will not actively launch Fetch in those markets until the applicable Article 27 representative and transfer-documentation requirements are completed; the representative contact details will be published here before that launch.

Why we are allowed to use your data

• Performance of a contract: creating and running your account, providing navigation, recording and replaying your race tracks, administering your subscription, and giving other entrants access to a track you chose to share.
• Consent: product analytics and the approximate location derived from your IP address, marketing or newsletter emails you asked for, sharing a race track with the other entrants in that race, and sharing your position with the club running a race you have entered. You can withdraw any of these at any time; withdrawal does not make our earlier use of the data unlawful.
• Legitimate interests: keeping the service secure and available, diagnosing crashes, preventing automated abuse of our forms, and establishing or defending legal claims. We weigh these against your rights and use the least data that achieves them.
• Legal obligation: keeping financial and tax records and responding to lawful requests.

Precise location is only ever recorded during a race you start, and never in the background outside one. It is used to provide the feature you opened the app to use, not to profile you, and it is not sold, shared for anyone else's marketing, or used for advertising.

Your rights

You may ask us to give you a copy of the personal data we hold about you, correct it, delete it, restrict how we use it, or object to our use of it, and to provide the data you gave us in a portable, machine-readable form. Where we rely on your consent you may withdraw it at any time: for analytics, use the controls on our Cookie Policy page or the Product Analytics setting in the app; for track sharing, turn sharing off for that race; for sharing your position with your club, stop at any time from the race screen or from Settings → Privacy → Share position with club; for email, use the unsubscribe link in any message. We do not carry out automated decision-making that produces legal or similarly significant effects about you.

We answer within one month. If a request is complex we may extend that by up to two further months and will tell you why within the first month. We may ask you to verify your identity before acting on a request.

Sending data outside Europe

We are established in Australia, and some of our providers process data in the United States and elsewhere. Where a transfer leaves the EEA or the UK to a country with no adequacy decision, we rely on the European Commission's Standard Contractual Clauses (together with the UK International Data Transfer Addendum where UK data is involved) as incorporated into that provider's data processing agreement, alongside the technical and organisational measures described in section 8. We operate PostHog in EU data-residency mode.

Complaints

Please contact us first at privacy@fetchthemark.com so we can put things right. You also have the right to lodge a complaint with the supervisory authority in the country where you live or work, or where you believe the problem occurred: for example the Agencia Española de Protección de Datos in Spain, the Data Protection Commission in Ireland, or the Information Commissioner's Office in the United Kingdom.

12. Adults Only

Fetch is intended for adults. You must be at least 18 years old to create a Fetch account. We do not knowingly collect personal information through an account belonging to anyone under 18. If we learn that a minor has created an account, we will disable the account and delete the information unless law requires us to retain it. Contact us if you believe a minor has created an account.

13. Changes to This Policy

We may update this policy when our services or legal obligations change. We will update the date and version above and, for a material change, give notice through an appropriate service screen or by email before it takes effect where practicable. We will seek consent where required by law. A policy change does not permit us to use information already collected for a materially different purpose without any notice or consent required by applicable law.

14. Contact

IDFALCON PTY LTD (ABN 12 684 389 188)
Privacy enquiries: privacy@fetchthemark.com