Challengers Privacy Policy

Who is responsible

Challengers is operated by Edoardo Tribulato, the individual responsible for the personal data described here.

Address: Maze Tower, 3407, Sheikh Zayed Road, Dubai, United Arab Emirates
Privacy and support: support@jointhechallenge.app

EU representative:
Tristan Borghese
Passeggiata di Ripetta 11
00186 Roma, Italy
Email: support@jointhechallenge.app
Please address EU representative enquiries to Tristan Borghese.

Information we use

We process:

• Account information: email, account identifiers, display name and optional profile photo. You may use a nickname.
• Challenge information: exercise names and units, settings, memberships, activity totals, corrections, timezones, reward choices, eligibility and results.
• Operational records: invitation reviews and acceptance, cancellation records, save-request identifiers and photo-processing records.
• Correspondence: messages and information you provide when contacting support or exercising privacy rights.

Information comes from you, your use of the app and other members managing shared challenges. Providers also process information such as IP addresses, request metadata and security events.

We use this information to provide accounts and challenges, share progress, calculate results, record agreed rules, prevent duplicate actions, protect the service and respond to requests.

Accounts require an email and display name. Photos and reminders are optional. Exercise entries are self-reported. Reward commitments are chosen by participants; Challengers does not process payments or enforce them.

We do not sell personal data, use it for advertising or use it to train AI.

Legal bases

For EEA users, we rely on:

• Contract necessity for essential account, authentication and challenge features.
• Legitimate interests in maintaining a secure, reliable service and preventing errors or abuse.
• Consent for optional processing where required, including optional photos and reminders. You can remove your photo or disable reminders.
• Legal obligations when handling requests or retaining information that applicable law specifically requires.

What other people can see

Members can see shared challenge information, display names, permitted profile photos, progress, standings and reward outcomes. Your email is not displayed to other members.

Certain playoff values and related results are temporarily hidden under the challenge rules.

Authenticated holders of valid invitations can review limited challenge terms before joining. This does not grant access to member profiles, activity logs or standings. Invitation and acceptance histories are not public member lists.

Photos, device storage and reminders

Selected profile photos are processed to remove embedded metadata before storage. You can remove your photo without deleting your account.

Sign-in sessions and notification preferences are stored on your device. Preferences do not sync across devices and may remain after ordinary sign-out. Account deletion attempts to remove the account’s saved preferences; incomplete cleanup is reported separately. A device installation identifier remains on the device.

Compatible native versions can schedule local reminders after you explicitly enable them and grant permission. You can disable them. Remote push notifications are currently disabled.

Fictional demo changes remain in memory and reset when reloaded.

Providers and international processing

We use:

• Supabase for authentication, database services and photo storage. The primary project is in Singapore.
• Cloudflare for hosting, website delivery, security and forwarding support emails through its global services.
• Resend for authentication emails, with stored email data processed in the United States.
• Google Gmail to receive, store and answer forwarded support messages.
• Apple when you choose Sign in with Apple.

Providers and their subprocessors may process information in additional countries. Their applicable terms and processing agreements govern their handling of information, including contractual transfer safeguards where applicable.

Further information is available in the Supabase processing agreement, Cloudflare processing agreement, Resend processing agreement and Google transfer information. Contact us for information about safeguards relevant to your data.

The app does not collect video, GPS location or health-sensor data. Cloudflare Web Analytics is not enabled on jointhechallenge.app. Operational and security logs are separate from analytics.

Retention and account deletion

Accounts are not deleted merely because they are inactive. Account data remains until you delete your account or the service is discontinued. Associated challenge, invitation and save records generally remain for the account or challenge lifetime.

Use Profile → Delete my account and complete the displayed confirmation steps. Deletion removes your live authentication account and linked personal records. Shared challenges may transfer to another member. Other members’ records remain, and shared results may change.

Profile photos remain until replaced or removed. Physical deletion may involve background cleanup.

Separate photo-cleanup records currently remain indefinitely, including after account deletion. These contain retired file paths and cleanup timestamps and are used to prevent or reconcile delayed uploads.

Other retention periods are:

• Ordinary support correspondence: 12 months after closure.
• Privacy-request correspondence and minimal request records: 24 months after closure.
• Identity-verification documents: deleted promptly after verification unless still necessary.
• Supabase Free-plan API/database log history: one day.
• Resend email and log data: 30 days, with seven-day backups.

Providers may retain additional infrastructure, security or backup records for service continuity, security and legal requirements under their applicable retention policies. These copies may outlast deletion from live systems.

Your rights

Depending on applicable law, you may request access, correction, deletion, a copy of your information, restriction of processing or objection to processing. You may withdraw consent where processing relies on consent.

Contact support@jointhechallenge.app. We may verify your identity and will respond within applicable legal deadlines.

You may complain to the relevant data-protection authority. EEA users may complain to an authority in their country of habitual residence, workplace or the place of an alleged infringement.

Children

Challengers is a general-audience exercise app, rather than a service specifically marketed to children. It currently has no minimum-age restriction and does not collect dates of birth or use an age-verification service.

Parents or guardians with questions or requests concerning a child’s information should contact support@jointhechallenge.app.

Changes

We will publish changes here with an updated effective date and provide additional notice or obtain consent where required by law.