Last updated: April 22, 2026 · Effective date: April 22, 2026
This Privacy Policy describes how CHALLENGRS LLC, a Delaware limited liability company ("Challengrs," "we," "us," or "our"), collects, uses, discloses, and safeguards your personal information when you use the Challengrs mobile application, our website at challengrs.app, and related services (collectively, the "Services").
By using the Services, you agree to the terms of this Privacy Policy. If you do not agree, please do not use the Services.
The short version. Challengrs is a commitment-contract platform. You stake money on your own goals; we do not operate any game of chance. We collect the minimum data needed to run the Services. We never sell your data. We never use third-party tracking SDKs. We never use analytics or advertising networks. You can delete your account at any time from within the app.
Challengrs is operated by CHALLENGRS LLC, a limited liability company organized under the laws of the State of Delaware (file number 10578660) with a principal place of business at 116 Shady Brook Cir Unit 301, Saint Simons Island, GA 31522, United States.
For privacy questions, contact us at support@challengrs.app.
The Services are available only to individuals who are at least 18 years of age. When you create an account, you must affirmatively confirm that you are 18 or older by checking a box during sign-up. By doing so, you represent and warrant that you are at least 18 years old.
If we become aware that a user is under 18, we will promptly terminate the account and delete associated personal information. If you believe a minor has created an account, please contact support@challengrs.app.
| Category | When | Purpose |
|---|---|---|
| Email address | Account creation | Authentication, password reset, important account notices |
| Username | Account creation | Identifier visible to other participants |
| Password (hashed) | Account creation | Authentication; we never see your plaintext password (handled by Supabase Auth) |
| Age attestation (18+) | Account creation | Eligibility verification (stored as a boolean flag; we do not collect date of birth) |
| Profile photo (optional) | Edit profile | Display in-app to other users |
| Bio (optional) | Edit profile | Display in-app to other users |
| Challenge content | Creating or joining challenges | Challenge title, description, rules, personal goal, stake amount |
| Proof photos | Uploading proof during a challenge | Verification and accountability to other participants |
| Proof metadata (timestamp, approximate GPS coordinates, location name) | Each proof upload | Verify authenticity; visible to participants in that challenge |
| Proof caption (optional) | Proof upload | User-supplied description |
| Redo request reason / late proof photo | Requesting a redo | Peer vote on whether to grant a redo |
When you make a deposit or withdrawal, payment data (card number, CVV, expiration, bank account) is collected and processed directly by Stripe. We never see, store, or have access to your full card number or bank credentials. We receive only a payment token, the transaction amount, a Stripe payment ID, and status. Your wallet balance, deposits, stake holds, winnings, and losses are stored in our database but are visible only to you.
If you voluntarily connect a third-party account, we receive information from that provider:
activity:read_all, we receive your athlete ID, activity type (Run, Ride, Swim, Walk, Hike, Workout), and activity metrics (distance, duration, elapsed time, speed, elevation, calories, and heart rate if you share it) when a matching activity occurs. We store these with your proof upload and — for active challenges — in our database. We also temporarily log inbound Strava webhook events for idempotency and troubleshooting.read:user, we receive your GitHub profile and commit activity when used for coding challenges.You can disconnect any third-party integration at any time from the Profile screen. Disconnection stops future data flow; data previously received remains associated with your prior challenge participations and is deleted when you delete your account.
We use personal information to:
We share personal information only in the circumstances described below. We do not sell your personal information.
The platform is inherently social. Your username, profile photo, bio, challenges you participate in, proof photos, proof metadata (timestamp, approximate location, caption), and reactions are visible to other users in ways described in §7.
We use a small number of trusted vendors to run the Services. They act on our behalf under contract and may process your data only for the purposes described.
| Vendor | Purpose | Data they receive |
|---|---|---|
| Supabase (Supabase, Inc.) | Database, authentication, file storage, edge functions | Account data, challenge data, proof photos, server logs. Powered by AWS in the United States. |
| Stripe (Stripe, Inc.) | Payment processing, Stripe Connect payouts | Payment details, amount, transaction ID, your name/email for verification. PCI DSS Level 1 certified. |
| OneSignal (OneSignal, Inc.) | Server-to-server push notification delivery | Your user ID, push token, device model, OS, notification payload (title, body, challenge ID). |
| Strava, Inc. | Fitness activity sync (only when you connect) | OAuth token, scope-limited activity requests. See Strava's Privacy Policy. |
| GitHub, Inc. | Code-challenge activity sync (only when you connect) | OAuth token, scope-limited profile requests. See GitHub's Privacy Statement. |
| Google Workspace (Google LLC) | Hosting our support email | Email you send us. |
| Apple, Inc. | App distribution and HealthKit framework (on-device) | Limited data as disclosed in Apple's Privacy Policy. HealthKit data stays on your device. |
We may disclose information if required by law, subpoena, court order, or other valid legal process, or to protect the rights, property, or safety of Challengrs, our users, or the public.
If Challengrs is involved in a merger, acquisition, financing, or sale of assets, personal information may be transferred as part of that transaction. We will notify you of any change of control that affects how your information is handled.
We may create and use aggregated or de-identified information (data that cannot reasonably identify you) for product analysis, research, or public communications. Such data is not subject to this Policy.
The Services may contain links to external websites (e.g., Strava, GitHub, Instagram for story sharing). We are not responsible for the privacy practices of third parties. We encourage you to review their policies before interacting with them.
Understanding visibility is important. Here's exactly what others can see:
Proof photo URLs. Proof photos are stored in a Supabase Storage bucket and served via public URLs that are difficult to guess. Someone with the exact URL could view the image without being logged in. We use this approach to keep the app fast and simple, but it means proof photos should not contain information you would not share with challenge participants. We do not index proof photos, and we do not publish your URLs anywhere outside the app.
Photo metadata (EXIF). When the iOS app re-encodes your photo for upload (JPEG compression), iOS strips embedded EXIF metadata such as GPS coordinates, camera model, and original capture timestamps. The location shown alongside your proof upload comes from a separate one-time location request at the moment you tap upload (if you grant location permission), not from the photo file itself. You can deny or disable location permission for Challengrs at any time in iOS Settings without affecting other app functionality.
We do not engage in "tracking" as defined by Apple's App Tracking Transparency framework. Specifically:
Because we do not track you, the Services do not display the App Tracking Transparency prompt. Nothing prevents you from disabling IDFA at the iOS level; it has no effect on the Services.
We use technical and organizational measures designed to protect your information:
No system is perfectly secure. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.
| Data category | Retention period |
|---|---|
| Account profile (email, username, bio, avatar) | Until you delete your account, plus up to 30 days for backup rotation |
| Challenge records (titles, goals, rules, participation) | Until deleted by the creator or by account deletion |
| Proof photos and metadata | Until you delete your account, the challenge creator deletes the challenge, or we decide to remove content per our Terms of Service |
| Transaction records (deposits, stakes, payouts) | Up to 7 years for tax and financial-record compliance (e.g., IRS Form 1099 obligations) |
| OAuth tokens (Strava, GitHub) | Until you disconnect the integration, delete your account, or the token expires / is revoked |
| Server logs (IP, request metadata) | Up to 90 days |
| Strava webhook event log | Up to 90 days for idempotency |
| De-identified analytics | Indefinitely (no longer linked to you) |
Regardless of where you live, you can:
You can delete your account at any time from within the app (Profile → Settings → Delete Account). Account deletion is irreversible and performs the following:
Requests sent to support@challengrs.app are honored within 30 days.
Depending on where you live, you may have specific privacy rights under state law. This section applies to residents of California, Colorado, Connecticut, Oregon, Texas, Utah, Virginia, and other states with comparable laws.
Email support@challengrs.app with your request. We may need to verify your identity before responding; typically we confirm by asking you to reply from the email address associated with your account. You may use an authorized agent, provided we can verify the agent's authority.
We do not sell personal information, and we do not share it for cross-context behavioral advertising. Because we do not engage in these activities, we do not display a "Do Not Sell or Share" link. In the past 12 months, we have not sold or shared personal information for these purposes.
In the past 12 months we have collected categories A (identifiers), D (commercial information - limited to transaction records), F (internet/app activity - limited to in-app events), G (geolocation - limited to proof upload GPS), K (inferences - none), and L (user-generated content - proof photos, captions). We have disclosed categories A, D, F, and L to the service providers listed in §5(b) for business purposes.
If you are in the European Economic Area, the United Kingdom, or Switzerland, the following applies.
Controller. CHALLENGRS LLC is the controller of your personal information processed through the Services.
Legal bases for processing. We process personal information based on (a) performance of a contract (operating the Services for you), (b) our legitimate interests in operating, securing, and improving the Services where not overridden by your rights, (c) compliance with legal obligations, and (d) your consent where required (e.g., push notifications, optional integrations).
Your rights. You have the right to access, rectify, erase, restrict processing of, object to processing of, and port your personal data. You may withdraw consent at any time where processing is based on consent. To exercise any of these rights, email support@challengrs.app.
Right to lodge a complaint. You have the right to lodge a complaint with your local data protection authority.
International transfers. Our servers are in the United States. If you access the Services from outside the US, your personal information will be transferred to and processed in the US. We rely on Standard Contractual Clauses (or equivalent) with our processors where applicable.
The Services are not intended for users under 18. We do not knowingly collect personal information from anyone under 18. If you believe we may have collected information from a minor, contact us immediately at support@challengrs.app and we will promptly delete it.
Challengrs is operated from the United States. If you access the Services from another country, you understand that your personal information will be transferred to, processed, and stored in the United States, where laws differ from those of your jurisdiction. By using the Services, you consent to such transfer.
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last updated" date at the top will reflect the most recent revision. Material changes will be communicated through the app, via email, or by prominent notice before the changes take effect. Your continued use of the Services after the effective date constitutes acceptance of the updated Policy.
For any question or request regarding this Privacy Policy or our data practices, please contact:
CHALLENGRS LLC
Attn: Privacy
116 Shady Brook Cir Unit 301
Saint Simons Island, GA 31522
support@challengrs.app