Privacy Policy — 100K Step Club

This policy explains what the 100K Step Club mobile app and website collect, why, where it lives, and the control you have over it. Plain version up front: we collect the minimum we need to run a step-tracking community, your daily steps are visible only to friends you mutually approve, and we never sell your data or use your health data for advertising.

What we collect

Account identity. When you sign in with Apple or Google, we receive a unique account identifier and an email address. With Sign in with Apple you may use Apple's private email relay, and we only ever see that relay address.
Google sign-in information. Google's sign-in component declares processing of account details, including a phone number where held by Google, general location, account and device identifiers, and other sign-in or usage information for sign-in functionality and service analytics. Google also describes using an IP address to estimate general location for fraud prevention. We do not ask you to enter a phone number or give Google your Health step records. See Google's sign-in privacy information.
Profile. A @handle and display name you choose, an optional profile photo, an optional home city, and whether you want your profile to be discoverable by other members. New photos are held privately for human safety review before publication. A replacement leaves your current photo in place until approved. Published photos use a public URL so they can load for other members; choose a photo you are happy to share. Other members receive only your account ID, handle, display name, and profile-photo URL when you appear in search or have a relationship with them. They do not receive your base profile row, home city, discovery setting, or profile timestamps.
Daily step totals. With your permission, we read your daily step count from Apple Health (iOS) or Health Connect (Android) — a single number per day. We do not read heart rate, precise location, routes, workouts, or any other health data. We sync from the exact moment you finish joining through today, so the first day excludes steps taken before you joined. Some Android health providers may limit history access, in which case the app syncs the available recent period and tells you that coverage is incomplete.
Coarsened step snapshots. When the app syncs, it sends today's step totals in 15-minute buckets so the current-day friend race can show when you actually walked. The server accepts only buckets that have already happened, never above your saved daily total and never decreasing; it cannot be used to add steps, and the account, date and time bucket are derived server-side. These snapshots are deleted after eight elapsed days.
Your friends. Seeing each other's step information requires mutual approval and neither person may have blocked the other. Accepted Crew receives your current-day total and coarsened current-day trail, recorded calendar-month step total, and lifetime badge counts by tier. Crew cannot read your base daily-step history. Pending requests do not expose steps, tiers, rankings, freshness, badges or Event targets.
Event plans. Your target and preparation checklist are stored on your device. If you explicitly share an Event target, the server stores that intention and makes it available to accepted, unblocked Crew. Turning target sharing off removes that visible intention; it does not change the step information shared through your Crew connection. A target is not proof of participation or website registration.
Fire and safety actions. We store the one-tap fire you send or receive, its server timestamp, your sending timezone and daily reset boundary, blocks you create, and reports you submit. Your timezone sets the daily sending limit; changing it may delay the next reset to prevent repeated sends. A report can include the reason and up to 1,000 characters of detail. We keep restricted records of review decisions and actions to handle reports.
Preferences on your device. Your Crew race selection and records of fire already shown are stored separately for each account on your device. They survive ordinary sign-out so your selection remains and old fire does not replay when you return. Removing your account clears these records on that device. The Crew filter changes only your view, not your friendships or access to step information.
Notification settings and device registration. If you opt in, we store a device push token, platform, timezone, registration timestamps, and your preferences (which tier crossings you want to hear about and quiet hours). A data export includes device metadata but replaces the push token itself with [REDACTED].
Website signup. If you join through this website, we collect the first name, email, tier, country, city, and optional newsletter consent you submit. Country and city support the signup view on the Claim Board. The newsletter box is optional and is not pre-selected; only an exact opt-in sends your email to Loops for the newsletter signup event.
Website abuse prevention. The signup form uses Cloudflare Turnstile. Cloudflare processes the verification token and network/device signals, including the request IP address, to distinguish people from automated abuse. Our signup service sends the request IP to Turnstile for verification, but does not store the raw IP. It stores only daily rotating keyed hashes of the IP and email for rate limiting, and deletes those rate records after 48 hours.
Basic technical data. Standard app and server logs needed to operate, diagnose, and secure the service (for example, an app version, incident code, error name, and limited error details). We do not intentionally include step totals, friend lists, profile details, or authentication tokens in crash reports.

We do not read your phone's address book, precise location, routes, heart rate, workouts, microphone recordings, or advertising identifiers. Your accepted Crew connections are the relationship information described above.

Why we collect it

To show you your steps, your tier for the day, and your personal Journey.
To let friends you have mutually approved see each other's current-day steps, and to nudge them when someone crosses a tier.
To show the current-day friend race, deliver fire, review profile content, and operate block/report safety tools.
To register website participants, show participating cities, deliver an opted-in newsletter signup, and prevent automated signup abuse.
To create your account and keep it secure.
To diagnose service problems, including the sign-in provider's operational analytics described above. We do not build advertising profiles or use Health records for analytics unrelated to the app's step features.

Where it lives and who can see it

Your data is stored in our database, hosted on Supabase (Postgres) infrastructure in East US (North Virginia), United States.
Your base step records and base profile row are self-only. Accepted, mutually unblocked Crew receives the limited step, badge and identity projections described above, plus an Event target only when explicitly shared. Search and pending requests expose the identity needed to connect, not health information. Database rules enforce these boundaries.
We do not make your steps public, and we do not show them to advertisers.

What we never do

We never sell your personal information or your health data.
We never use your health data for advertising.
We use service providers to run these features: Supabase for database and server functions, Apple and Google for sign-in, Expo plus Apple/Google for push delivery, Cloudflare for website abuse prevention, and Loops for email only when you opt in. Their processing is subject to their own terms, including the sign-in information described above. We do not send Health step records to advertising services.

Your choices and controls

Health permission. You grant step access through the OS health permission prompt, and you can revoke it any time in your device's Health (iOS) or Health Connect (Android) settings. If you revoke it, new steps stop syncing.
Notifications. You can turn notifications off in the app or in your OS settings.
Profile and discovery. You can change your display name, profile photo, and whether other members can find your handle. You can remove friends and block or report members.
Website newsletter consent. Joining the event does not require newsletter consent. Leave the box unchecked if you do not want the newsletter, or use the unsubscribe link in an email after opting in.
Access and portability. You can use Export my data in app Settings to create a JSON copy of the account and app data tied to your signed-in account, including photo-review status, any private photo still awaiting review, and your fire calendar. It does not include another person's private records or internal reviewer notes. Device-only preferences stay on that device. The server identifies you from your authenticated session; the app cannot request another member's export. Contact us about a separate website signup record.
Delete your account. Account removal is in You → Settings → Remove my account. If in-app removal is temporarily unavailable or you cannot access the app, use the web deletion request. Completed deletion removes your account, profile, profile photo, step records and snapshots, follow relationships, cheers, blocks, push tokens, and notification settings from active product systems. Reports are removed from normal member-facing systems, but restricted pseudonymized moderation evidence may remain for the safety period described below.

Data retention

A private photo candidate is removed from the review queue when approved, rejected, cancelled, or expired. Its private image bytes are erased at that point; approval publishes the reviewed image at your profile-photo URL. Unreviewed candidates expire after seven days, processed by a daily job. Review status, image identity and timestamps remain while your account is active. Account deletion removes private candidates and their review records along with your published photo.

We keep daily totals and other account data while your account is active. Coarsened step snapshots are deleted after eight elapsed days by a daily server-side retention job. Daily rotating website rate-limit hashes are deleted after 48 hours. We keep a website signup while it is needed to manage club participation and related communications; contact us to request access or deletion.

When you delete your account, we remove associated records from active product systems. To investigate abuse, protect members, and defend against repeat malicious activity, we may retain a restricted moderation-evidence copy of a report and its handling notes for no more than 24 months from the report date. Account identifiers in that evidence are replaced with one-way pseudonyms; the evidence is not available through the app or normal client API. Report text may still contain information the reporter typed, so access is restricted and the same 24-month maximum applies. The server deletes evidence and handling notes when that period expires.

Limited copies may remain temporarily in encrypted operational backups until they expire under our provider's routine retention cycle; they are not used for ordinary product access and are restored only for disaster recovery.

Children

The app is for adults aged 18 and older. We do not knowingly collect personal information from children.

International note

We are based in Canada. Our primary database is processed in East US (North Virginia), United States, and service providers may process limited operational data in other regions under their terms. By using the app you understand that your data may be transferred outside Canada.

Changes to this policy

If we change what we collect or how we use it, we will update this page and its effective date, and — for material changes — let you know in the app.

Contact

Questions or requests (including data access or deletion): graeme@100kstepclub.com.