Privacy Policy

1. About Rhumby

Rhumby, Inc. ("Rhumby", "we", "us") operates the regatta management platform at rhumby.com. This policy describes how we collect, use, disclose, and protect personal information when you use our services. Yacht clubs that use Rhumby to manage their events act as separate data controllers for their member and registration data; please review your club's own privacy notices as well.

Contact: privacy@rhumby.com  |  Rhumby, Inc., 123 Harbor Way, Sarasota, FL 34236

2. Notice at Collection (CCPA § 1798.100)

We collect the following categories of personal information, for the purposes and retention periods listed:

3. How We Use Your Information

• Operate and improve the platform (account management, event scheduling, scoring)
• Process registrations and payments via Stripe Checkout
• Send transactional emails: registration confirmations, race results (Resend)
• Safety communications: emergency contact access during events
• Fraud prevention and security monitoring
• Legal compliance (tax records, COPPA consent evidence, breach notification)
• Marketing emails only with your separate consent; you can opt out at any time via your email preferences

We do not use personal information for behavioral advertising or sell it to third parties.

4. Sensitive Personal Information

Under California law and other state privacy statutes, certain information is classified as "sensitive." We collect the following sensitive categories only with your explicit consent and for limited purposes:

• Medical information: Used solely by the race committee for on-water safety. Only race committee members for your specific event can access this. Encrypted at rest; never shared with marketing or analytics systems.
• Precise geolocation (GPS): Collected only during active races with your consent. Used for race analysis, replay, and protest hearings. Deleted after 2 years.
• Youth data (under 13): Collected only after verifiable parental consent. See our Children's Privacy Notice.

You may withdraw consent for sensitive data at any time by submitting a data request or contacting privacy@rhumby.com. Withdrawal does not affect the lawfulness of prior processing.

5. Disclosure of Personal Information

We disclose personal information only as described below. We do not sell personal information and do not share it for cross-context behavioral advertising.

• Service providers (sub-processors): Clerk (authentication), Stripe (payments), Vercel (hosting/analytics), Resend (email). Each is bound by a data processing agreement. Full list below.
• Yacht clubs: Registration details (name, boat, fleet, results) are shared with the organizing yacht club as necessary to run the event. Clubs act as separate data controllers for this data.
• Public results: Race standings and finish times are published publicly as part of regatta records (legitimate interest in historical standings).
• Legal obligations: We disclose when required by law or to protect rights and safety.

6. Do Not Sell or Share My Personal Information

Rhumby does not sell personal information and does not share personal information for cross-context behavioral advertising. You do not need to opt out because we do not engage in these activities.

We honor the Global Privacy Control (GPC) signal. If your browser sends a GPC header, we automatically disable Vercel Analytics for your session and record your opt-out preference.

7. Sailors Ages 13–16 (CCPA Minor Opt-In)

We do not sell or share the personal information of sailors we know to be between 13 and 16 years of age without their affirmative opt-in. At signup, sailors in this age group receive age-appropriate disclosures and must explicitly acknowledge them before proceeding.

For sailors under 13, see our Children's Privacy Notice.

8. Your Privacy Rights

Depending on your state of residence, you may have some or all of the following rights:

• Know / Access: request a copy of the personal information we hold about you
• Delete: request deletion of your personal information (subject to legal exceptions)
• Correct: request correction of inaccurate personal information
• Portability: receive your data in a portable format (JSON/ZIP)
• Opt out of sale/sharing: (we do not sell, but you may still submit this request)
• Limit sensitive PI use: restrict our use of sensitive categories beyond stated purposes
• Non-discrimination: we will not discriminate for exercising your privacy rights

To exercise these rights, submit a Data Subject Access Request or email privacy@rhumby.com. We verify identity before processing requests and respond within 45 days (CCPA statutory deadline). Requests from authorized agents are accepted with written permission.

9. Data Security

• TLS 1.2+ for all data in transit; HSTS enforced
• AES-256-GCM column-level encryption for sensitive fields (medical, emergency contacts, phone)
• Encryption at rest on managed database
• API keys stored as SHA-256 hashes; never logged in plaintext
• Continuous dependency scanning, SAST, and secret scanning in CI
• Access controls: Clerk-managed authentication, role-based access

To report a security vulnerability, see our Security Policy.

10. Cookies & Tracking

We use essential cookies for authentication (Clerk session) and payments (Stripe). We use analytics cookies (Vercel Analytics) only with your consent or when no GPC signal is present.

For the full cookie inventory, see our Cookie Policy.

11. Sub-Processors

12. Children's Privacy

We comply with the Children's Online Privacy Protection Act (COPPA). Sailors under 13 require verifiable parental consent before we collect any personal information. For full details, see our Children's Privacy Notice.

13. Changes to This Policy

We will post changes to this page with an updated "Last Updated" date. Material changes affecting your rights will be notified by email or in-app alert at least 30 days before taking effect.

14. Contact Us

Privacy inquiries: privacy@rhumby.com

Data requests: rhumby.com/privacy/request

Mailing address: Rhumby, Inc., 123 Harbor Way, Sarasota, FL 34236