Legal

Privacy

This describes what the tracker records and where it goes. It is written from the code, so it stays accurate as the app changes.

• What a session records

  Step count, distance in metres, duration, cadence, stride, and the start and end time. Each session is stored against your account along with whether it passed the plausibility checks and, if not, which ones it failed.

• Location

  GPS is read while a session is running and used to measure distance. Coordinates are turned into a running total in the browser and are never sent anywhere. Only the resulting distance leaves your device.

• Motion

  The accelerometer is read while a session is running to count steps. Raw sensor samples stay in memory on your device and are never transmitted or stored.

• Your account

  Sign in is handled by Privy, which holds your email address and the wallet created for you. This app stores your Privy user id, your email address and your wallet address so sessions can be attributed and rewards can be sent.

• Where it is stored

  In a Supabase Postgres database. Row level security is on for every table with no policies, so the public key can read nothing. All access goes through server routes that verify your Privy token first.

• Analytics

  None. There is no analytics script, no tag manager and no third party tracker on any page of this site.

TODO: name the controller, give a contact address for data requests, and decide how long sessions are kept and how an account is deleted. Those cannot be written until the entity behind the project exists. Everything above already reflects what the code does today.