Privacy

Short version: if you don’t make an account, we collect nothing at all. If you do, we collect the least we can get away with while still running a league.

Using it without an account

The tracker works entirely on your device. Your goals, your check-ins, your streaks and your achievements are stored in your browser and never sent anywhere. We can’t see them, because they never reach us.

That also means we can’t recover them. If you clear your browser data, or if Safari evicts it (which it does after about a week of not opening the site, unless you’ve added it to your home screen), it’s gone. Export occasionally.

If you make an account

Then we store:

• An opaque ID from whoever you signed in with. Not a password. We never see one.
• Your email address, unless your sign-in provider hides it from us. Some do, and that’s fine.
• A generated handle like BriskOtter-3411. You don’t choose it and you can’t type one.
• Your avatar settings, which are a handful of numbers and option names. Not an image.
• That you confirmed you’re 16 or older.
• Which of the six categories you track, how often, and which days you checked in.
• Your cohort, your score and your rank.
• Whether your subscription is active.

What we never collect

• Your goal titles. What you’re actually working on stays on your device. We know you kept a fitness goal and which days you kept it. We don’t know what it was.
• Location, at any level. Not GPS, not city, not country. Your cohort is matched on category and pace, not proximity.
• Photographs. There’s no upload, no camera access, and we don’t pull the photo from the account you sign in with. We don’t even ask for it. Avatars are generated from your ID.
• Anything you type that another person can see. There are no usernames, comments, messages or reactions. Not because we moderate them well, but because they don’t exist.
• Your card details. Stripe handles payment and we never receive them.

Who else touches it

• Supabase hosts the database and handles sign-in.
• Stripe processes payments. Your card details go straight to them over a PCI-compliant connection and never reach our servers.
• Cloudflare serves this site.
• Google or Microsoft, whichever one you choose to sign in with. We ask them who you are and nothing else, so we never receive your name or your profile picture.

We don’t sell anything to anyone, and there’s no advertising network involved.

Analytics and cookies

There are none. No analytics script, no tracking pixel, no advertising cookie. The only thing stored in your browser is your sign-in session and your own tracker data. Fonts are served from our own domain rather than a font CDN, so loading a page doesn’t tell a third party you were here.

What you can do

• Export your tracker data at any time, as a plain JSON file you can read.
• Delete your account from inside the app. It removes everything above, permanently, and we can’t undo it.
• Ask what we hold by emailing us. It’ll be the list above.

How long we keep it

Until you delete it. Closed cohorts keep your score and rank for the historical board. Delete your account and those rows go too.

Children

This is for people 16 and over. We don’t knowingly collect anything from anyone younger, and if we find out we have, we delete it.

Changes

If this changes in a way that affects what we collect, we’ll say so here and date it. We won’t start collecting something new and quietly update the page.

Contact

[ENTITY NAME], [CONTACT EMAIL]. We’re a one-person operation, so replies take a day or two.