Privacy Policy
Company: [Legal entity name].
1. What we collect
- Account: name, username, email, and date of birth (to enforce our 18+ requirement).
- Activity & health data: workouts and metrics (distance, steps, duration, heart rate, GPS) read from Apple Health, Android Health Connect, and/or Strava when you connect them.
- Payment data: handled by Stripe. We store references (a payment-method token and a customer id) — we do not store your full card number.
- Corporate affiliation: if you join via an employer, your organization and (optionally) team.
- Device & usage: app/device info, log data, and diagnostics.
2. How we use it
- Run challenges and verify goal completion from sensor data.
- Process settlements (charge only on failure) and route donations.
- Detect and prevent spoofing/fraud (data provenance and signal-plausibility checks).
- Provide corporate program reporting (see §4).
- Support, security, legal compliance, and product improvement.
3. Health data — special care
Your health and activity data is used solely to verify your goals and safeguard integrity. We do not sell it, and we do not use Apple Health / Health Connect data for advertising or share it except as needed to operate the Service or with your consent, consistent with Apple's and Google's platform requirements.
4. How we share it
- Stripe — payment processing and off-session charges.
- Charitable-disbursement provider (e.g., Every.org / Pledge.to) — to route forfeited pledges and corporate matches to your chosen charity (the provider is donor of record).
- Infrastructure providers (e.g., Supabase) — hosting, database, storage, authentication.
- Strava — via OAuth, when you connect it, as a verification signal.
- Employers (corporate users): aggregated participation and impact metrics per your employer's program; message content only as required by the employer's stated policy and applicable law.
- Legal: when required by law or to protect rights and safety.
5. Retention
We keep personal data while your account is active and as needed for legal, tax, accounting, and fraud-prevention purposes. Money and donation records are retained for compliance even after account closure; account deletion is performed by anonymizing personal data rather than destroying financial records.
6. Your choices and rights
You may request access, correction, deletion, or a copy of your data, and you can disconnect a wearable at any time. Contact fitstakes@srkapp.app. [Add state-specific rights — counsel.]
7. Security
We use administrative, technical, and organizational safeguards. Secrets and card data never live in the mobile app. No system is perfectly secure.
8. Children
The Service is for adults 18+. We do not knowingly collect data from anyone under 18.
9. Changes
We may update this Policy; material changes will be notified. Questions: fitstakes@srkapp.app.