Privacy Policy

1. Information We Collect

We collect information directly from you, automatically from your device, and from third-party services you choose to use.

Account and Profile Information

• Authentication information from Apple, Google, or Supabase Auth, such as your email address and provider identifier.
• Profile details you choose to provide, such as display name, handle, avatar, bio, gender, height, or weight.
• A private date of birth used to determine Duel eligibility and a minor (13–17) or adult (18+) safety cohort. We do not show your date of birth or precise age to other users.
• A public app user ID and generated handle provisioned for your authenticated account.
• Referral and invite information, such as invite codes you share or referral codes captured from invite and download links.

Habit, Session, and Progress Information

• Habit preferences, goals, reminders, enabled habits, streaks, badges, natural-unit results, and leaderboard stats.
• Session records, including start and end time, status, duration, goal progress, interruption counts, and proof status.
• Run summaries such as distance, pace, moving time, GPS accuracy counts, motion counts, and related verification signals.
• Focus timer summaries, including focus duration, interruptions, and focus theme if you choose one.
• Pose exercise summaries, including rep count, confidence, form score, and quality flags.
• Private Daily Capture records, including one photo per local day, optional mood, and capture time.
• Duel mode, queue, proposal, match, verification, outcome, rating, separate Ghost statistics, challenge history, and supporting performance statistics.
• Privacy-safe Ghost replay timelines containing elapsed offsets and progress values. These timelines do not contain wall-clock timestamps, camera frames, pose landmarks, GPS coordinates, or route geometry.

Location, Camera, Motion, Photos, and Recordings

• Location is used during run sessions to calculate distance, pace, movement, and route-related proof. On iPhone, an active run may continue tracking while the screen is locked and stops when you finish or discard the run.
• Camera access is used for pose-assisted exercise tracking, adult Live Duel video for supported activities, private Daily Capture photos, and avatars.
• Motion signals may be used to improve run proof accuracy.
• Daily Capture photos are stored locally first and in private owner-only cloud storage for cross-device restoration. Other photos, videos, thumbnails, and screen recordings may be stored locally when you create proof media or share assets.
• Nearby discovery uses foreground location only after you opt in. The server immediately rounds submitted coordinates for matching and discovery, stores only the rounded point with a freshness timestamp, and shows other users a broad distance band rather than coordinates or a map position.
• Adult Live Duel video is camera-only and required for Focus and pose activities after a one-time disclosure. Live Run and every Ghost Duel have no opponent video. Live video is ephemeral, uses a match-scoped encrypted room, is not recorded or retained by Peak Journey, and never enables microphone audio.

Peak Journey is designed to keep core habit data local first. Local SQLite storage is the source of truth for habit data on your device. When you sign in or use synced features, selected habit records, proof summaries, natural-unit results, and leaderboard data may sync to Supabase. Private Daily Capture photos also sync to an owner-only storage bucket. Public web shares use summary metadata and do not expose Daily Capture photos, full proof media, raw GPS points, local file URIs, private habit history, private storage paths, or internal proof payloads.

Friends, Messages, Reports, and Safety

• Friend requests, friendships, blocks, challenge invitations, mutual-friend counts, and conversation membership.
• Friends-only direct messages, limited to text. Messages cannot include links, attachments, precise location, read receipts, or typing indicators in the initial version.
• Reports, including a category, optional note, referenced match or message, and a bounded evidence snapshot needed for safety review.
• Moderation decisions, delivery state, rate-limit events, suspension state, and audit timestamps used to protect users and the Service.

We do not upload or retain raw pose frames, raw GPS routes for Duel matching, or live Duel video. Reporting an active match immediately hides video; blocking revokes the pairing, friendship, pending challenges, and conversation access.

Website, Device, and Analytics Information

• Device and app information such as platform, app version, session ID, and non-sensitive usage events.
• Push notification tokens and notification preferences when you enable reminders or the daily review.
• Website analytics and performance information from tools such as Vercel Analytics, Speed Insights, and PostHog when configured.
• Crash, diagnostic, and security information needed to maintain the service.

Our analytics contract is intentionally narrow. We do not intentionally capture emails, phone numbers, raw names, notes, captions, invite codes, handles, message content, media, route points, GPS coordinates, precise age, photo metadata, or proof media payloads in analytics. Web PostHog autocapture and automatic pageview tracking are disabled so public share URLs are not collected automatically.

Legacy Purchases and App Stores

Peak Journey 1.1.0 and later does not offer a consumer subscription or in-app purchase. Older iOS versions offered Apple subscriptions supported by RevenueCat before the 1.1.0 subscription sunset. Apple and RevenueCat may retain historical product, entitlement, transaction, renewal, cancellation, and refund metadata according to their policies and legal obligations. We may use that legacy metadata only for records, purchase support, disputes, fraud prevention, refunds, and legal compliance. We do not receive your full payment card number.

Communications and Support

If you contact us, respond to a survey, or request support, we collect the information you choose to provide and the contact details needed to respond.

If you join our Discord community or contact us through another third-party service, that service's privacy practices apply to information you provide there.

2. How We Use Information

• Provide, operate, personalize, and improve Peak Journey.
• Track habits, calculate streaks, badges, summaries, and per-habit leaderboard placement.
• Verify habit sessions through GPS, timer, motion, camera, and pose signals where you enable those features.
• Store and restore private Daily Capture photos across your signed-in devices.
• Match eligible users for Duels by habit, age cohort, skill, broad location, blocks, app compatibility, and wait time.
• Calculate per-habit Duel ratings, adjudicate verified outcomes, support friend challenges, and prevent result farming or cheating.
• Provide nearby discovery, friends-only messages, reports, blocks, moderation, and other safety controls.
• Sync signed-in habit records and recover progress across devices.
• Create public proof pages, recap pages, invite links, and download links when you choose to share or invite someone.
• Capture invite and referral attribution so invite links can connect accounts as intended.
• Send reminders, push notifications, service messages, and support responses.
• Support historical App Store purchases, refunds, disputes, fraud prevention, and account security.
• Analyze product performance using privacy-limited analytics.
• Comply with legal obligations and enforce our Terms of Use and Community Guidelines.

3. How We Share Information

We may share information in the following ways:

• With service providers that host, store, analyze, secure, moderate, support, or process our services, including Supabase, LiveKit, PostHog, Vercel, Apple, Google, moderation providers, and push notification providers.
• With other users and the public when you appear on public leaderboard surfaces or create public or unlisted share pages.
• With third-party apps, community services, or support services when you choose to share content or contact us outside Peak Journey.
• With Apple and RevenueCat for records, refunds, disputes, fraud prevention, and support relating to historical iOS purchases made before the free 1.1.0 release.
• With authorities, courts, or other parties when required by law or needed to protect rights, safety, security, or the integrity of the service.
• In connection with a business transaction such as a merger, acquisition, financing, reorganization, or sale of assets.
• With your consent or at your direction.

We do not sell personal information for money. Some privacy laws define "sale", "sharing", or "targeted advertising" broadly. If we later enable advertising cookies or cross-context behavioral advertising, we will provide choices where required.

4. Public Sharing and Leaderboards

Peak Journey is built around visible momentum, but sharing is still your choice. Public proof pages, recap pages, invite pages, and leaderboard rows may show your display name, handle, avatar, habit name, proof status, result amounts, streak, rank, or other summary details. Do not include information in your profile, handle, avatar, photos, videos, or shared content that you do not want others to see.

Competition leaderboards and safe opponent profiles may show your handle, avatar, per-habit rating, provisional status, win-loss-draw record, verified Duel totals, personal best, Duel average, approximate distance band, and mutual-friend count. They never show your birth date, exact age, precise coordinate, or route.

Public share links may be unlisted, meaning they are available to anyone with the link even if they are not shown in normal site navigation. If you send a Peak Journey share to another app, that app's privacy practices apply to the copy, image, video, link, or metadata you share there.

5. Health, Fitness, and Sensitive Information

Habit data, activity information, photos, body measurements, mood, weight, and location may be considered sensitive information or consumer health data under some laws. We use this information to provide the habit tracking, verification, progress, sharing, and support features you request.

• Categories may include habit goals, session history, run summaries, movement signals, pose summaries, private Daily Capture photos and mood, weight, profile details, proof status, streaks, natural-unit results, and related progress information.
• Sources include information you provide, information your device collects when you enable a feature, and service providers that help us operate Peak Journey.
• We may disclose this information to service providers, analytics providers, public share viewers, leaderboard viewers, third-party apps you choose to share with, and legal or safety recipients described in this Policy.
• We do not sell consumer health data. We do not currently request Apple HealthKit or Google Health Connect repository data. If we add those integrations later, we will describe that use and request any permissions required.

6. Your Choices

• You can choose which habits to enable, whether to sign in, whether to share, and whether to allow device permissions.
• You can keep nearby discovery off, withdraw location consent, keep Duel camera off, decline viewing another user, leave a queue, and block or report another user.
• You can disable location, camera, motion, photo, or notification permissions in your device settings. Some features may stop working without those permissions.
• If you made a legacy iOS purchase, you can check or cancel it in Apple subscription settings and request refunds through Apple.
• You can initiate account deletion in the app from Profile settings. We process account deletion requests within 30 days, and you can also request access, correction, portability, restriction, objection, or withdrawal of consent where applicable by contacting us.
• You can ask us not to send promotional messages. We may still send service, security, legal, or transaction messages.

7. Retention

We keep information for as long as needed to provide Peak Journey, maintain your account, support local-first sync, comply with legal obligations, resolve disputes, prevent fraud, and enforce our agreements. Local data remains on your device unless you delete it, reset progress, uninstall the app, or use app features that remove it. Synced account and leaderboard records may remain in our systems until deleted under our normal retention and backup practices or in response to a verified request. A same-day Daily Capture retake replaces the prior capture and queues the superseded local and cloud files for deletion after the replacement is safely persisted. Historical captures are retained until account deletion in this release.

Ordinary direct messages are retained while the friendship and conversation exist. When a message is deleted, limited abuse-prevention metadata may be retained for up to 90 days. Evidence snapshots attached to a report may be retained for up to 180 days. Live Duel video is not recorded or retained. These periods may be shortened or extended when required by law, a preservation request, an active safety investigation, or final legal review.

8. Security

We use reasonable technical and organizational safeguards designed to protect personal information. Native Supabase sessions are stored using secure platform storage where supported. No system can be guaranteed completely secure, and you are responsible for protecting access to your device, app store account, and sign-in providers.

9. Children

Peak Journey is not intended for children under 13. If you are under the age required to consent to digital services in your location, you may use Peak Journey only with appropriate parent or guardian involvement. If we learn that we collected personal information from a child in a way that violates applicable law, we will take appropriate steps to delete it.

Ghost Duel may be available from age 13, subject to regional eligibility requirements. Live Duel and remote participant video are available only to adults age 18 or older. Minor and adult users remain separated across Duel opponents, profiles, friendships, challenges, history, and messaging. Live Duel appears automatically when an eligible user turns 18 without requiring a new date-of-birth entry.

10. International Transfers

We and our service providers may process information in the United States and other countries. These countries may have privacy laws that differ from those where you live. Where required, we use appropriate safeguards for international transfers.

11. Additional Rights by Region

Depending on where you live, you may have additional rights under laws such as U.S. state privacy laws, Canadian privacy laws, the GDPR, or UK privacy law. These rights may include the right to know, access, correct, delete, port, restrict, object to, or appeal certain decisions about your personal information. You may also have rights related to sensitive or consumer health data.

To exercise rights, contact support@peakjourney.app. We may need to verify your request before acting on it. Authorized agents may submit requests where allowed by law, but we may require proof of authority.

12. Changes to This Policy

We may update this Privacy Policy as Peak Journey changes. The effective date above shows when this version took effect. If we make material changes, we will provide notice through the app, website, email, or another reasonable method.

13. Contact Us

Questions, requests about privacy, and general support questions can be sent to support@peakjourney.app.