Privacy Policy

Plan a route

Last updated: 27 August 2026

1. Introduction

Things That Ltd ("we", "our", or "us") operates On the River, a map and route planner for rivers and canals across Britain, Ireland, France, the Netherlands, and Belgium. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the website or the iOS app.

We are the data controller for personal data processed in connection with On the River, where that data is personal data under the UK GDPR.

We do not send marketing emails. We do not sell your personal data. We do not use the service for behavioural advertising.

2. Information we collect

We collect information that you provide directly to us, and technical data needed to run the map.

  • Account. If you sign in, we store your authentication details with Supabase (email address, or the identifier Apple or Google provides) and a display name. Named routes and favourites you save while signed in are stored on that account so they can appear on other devices you sign in on. You can delete the account from Sign in / Account in the map menu or the iOS app.
  • Analytics. We use Fathom Analytics to understand aggregate site usage (for example page views, referrers, and whether people use features such as waterways browse, route creation, GPX export, search, and map layers). Events are counted anonymously by name; we do not attach them to individuals or advertising profiles. Fathom is designed to be privacy-friendly: it does not use cookies or similar tracking technologies for analytics. Fathom may briefly process technical data such as IP address and user-agent to produce anonymised statistics. See Fathom’s legal pages.
  • Browser and device storage. We store route drafts, layer visibility, feedback-form drafts, appearance, and similar preferences in localStorage so the planner works as you expect. While you are signed in we also keep a local cache of your saved routes and favourites, and the Supabase sign-in session. Signing out clears that cache. Drafts and ungated preferences stay on the device until you clear them.
  • Server requests you trigger while using the map. When you use land routing or the optional England storm overflow layer, our hosting (Netlify) and upstream providers receive the technical request needed to return a result (for example coordinates or a map bounding box). Those providers also receive standard web server logs such as IP address and user-agent.
  • Support email. If you write to hello@thingsthat.com, we receive the address you send from and the message.
  • In-app feedback. If you use Feedback / Support in the website map menu or the iOS app, we receive the message you type, the type you choose, and any email address you optionally leave. We also attach technical context: which client you used, the app or site version, and, when you submit from the planner, the selected waterway and the map centre and zoom. We do not attach device GPS. That submission is stored in Notion so we can triage it. The website form uses Cloudflare Turnstile to reduce automated abuse. Turnstile may receive your IP address for that check. The iOS form does not use Turnstile.

3. How we use your information

We use the information we collect to:

  • Provide, maintain, and improve the map, route planner, and your account
  • Store saved routes and favourites you choose to keep
  • Load map tiles, run land routing, and fetch optional map layers when you use those features
  • Respond to support email and in-app feedback
  • Monitor aggregate usage so we can keep the site useful and reliable
  • Detect, investigate, and prevent abuse of the service

4. Cookies and similar technologies (PECR)

We do not use advertising cookies or non-essential analytics cookies. Fathom Analytics is loaded without cookies, so we do not show a cookie consent banner for analytics alone.

LocalStorage used for route drafts, interface preferences, and your sign-in session is needed to provide the features you ask for. You can clear it at any time in your browser or device settings. Signing out clears the on-device cache of saved routes and favourites.

5. Legal bases (UK GDPR)

  • Legitimate interests for privacy-friendly analytics so we can keep the site useful and reliable, balanced against your privacy rights.
  • Performance of a service you request for creating and running your account, storing saved routes and favourites you choose to keep, drawing routes, loading map tiles, running land routing, fetching optional map layers when you use those features, and receiving support email or an in-app feedback submission you send.

6. Third parties

Depending on how you use the site or app, the following may process data:

  • Supabase (account sign-in, saved routes, and favourites)
  • Apple or Google (if you choose that sign-in method)
  • Fathom Analytics (usage statistics)
  • Netlify (website hosting and serverless functions)
  • OpenFreeMap / OpenStreetMap-related tile and routing services (basemap tiles and foot routing)
  • Mapbox (optional Detailed and Satellite basemap tiles when you are signed in and choose those map styles)
  • Water company / Stream EDM feeds (optional England storm overflow layer)
  • Notion (in-app feedback and support inbox)
  • Cloudflare Turnstile (website in-app feedback form abuse check)

Map data attribution and a liability disclaimer are shown on the planner.

7. International transfers

Some providers (including hosting and analytics) may process data outside the UK. Where they do, they are expected to use an appropriate transfer mechanism under UK data protection law, such as the UK International Data Transfer Agreement or adequacy decisions, as described in their own privacy documentation.

8. Data retention

  • Route drafts and ungated preferences remain in your browser or on your device until you clear them or overwrite them.
  • Saved routes and favourites remain on your account until you delete them or delete the account. Signing out clears the on-device cache of those items.
  • Support email we receive is kept for as long as needed to handle the request.
  • In-app feedback and support rows remain in Notion until we delete them.
  • Fathom retains aggregated analytics according to our Fathom site settings and Fathom’s retention model.
  • Hosting and upstream providers retain server logs for short operational periods under their policies.

9. Your rights

Under UK data protection laws, you have rights including:

  • Right to access your personal data
  • Right to rectification of inaccurate data
  • Right to erasure (the "right to be forgotten")
  • Right to restrict processing
  • Right to data portability, where applicable
  • Right to object to processing
  • Right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk

For account data, use Delete account in the app or website, or contact us at hello@thingsthat.com. Drafts and other device-only preferences stay on this browser or phone until you clear them. For analytics or server-log questions, contact us via the same address.

10. Security

We implement appropriate security measures to protect your personal information. However, no electronic transmission or storage technology is completely secure, and we cannot guarantee absolute security.

11. Children

The site is a general-purpose waterways map and is not aimed at children. We do not knowingly collect personal data from children for marketing. Account sign-in is for people who can agree to this notice and to our Terms of Service.

12. Changes to this Privacy Policy

We may update this Privacy Policy periodically. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date.

13. Contact us

If you have any questions about this Privacy Policy, please contact us at:

THINGS THAT LTD
Registered address: THINGS THAT LTD, 3rd Floor, 86-90 Paul Street, London EC2A 4NE
Company number: 08588000
Registered in England and Wales.
Email: hello@thingsthat.com