This policy explains what Mekina Software LLC (“we”, “us”) collects when you use the Challengrs app (“Challengrs”, “the app”), why, who else receives it, and the choices you have. It covers Challengrs 2.0.1 and later. Earlier releases can have different data practices.
Questions: privacy@mekina.io.
The short version
- You need an account to use Challengrs. We keep your email address, your name and the profile you set up.
- Your check-ins are photos. Your squad sees them. We use them to run challenges, and we don’t sell them or show them to advertisers.
- Photos are checked on your phone, by models that run on the device, before anything is uploaded.
- Free accounts see ads from Google AdMob. Google receives device and ad data to show and measure those ads. Pro and Squad Pass members see no ads.
- We use service providers for sign-in, hosting, notifications and purchases. Each is named below. Optional product analytics and our MetricKit upload are disabled in 2.0.1.
- You can delete your account in the app at any time: Profile → Settings → Delete account.
- Challengrs is for people 18 and over.
1. What we collect
Information you give us
- Account. Your email address, and your name if your sign-in provider shares it. You can sign in with Apple, with Google, or with a one-time code sent to your email. If you use Sign in with Apple and hide your email, we receive Apple’s relay address instead.
- Profile. Your display name, an optional profile photo, your accent color, your time zone, and your confirmation that you are 18 or older, with the time you gave it.
- Onboarding answers. Why you’re here, how many days a week you plan to train, when you usually train, and whether you want reminders. We use these to set up your first challenge and reminders.
- Squads and challenges. The squads you create or join, their names and photos, the challenges you set up (name, weekly goal, length, start date, privacy), and the invites you send and accept.
- Fitness information. Your check-in photos, exercise dates, workout classifications, training goals, and the points, streaks and levels the app works out from them. Fitness information can be consumer health data under applicable law. We use it to provide the workout challenges and sharing you request. We do not send it to advertisers. See our Consumer Health Data Privacy Policy.
- Safety actions. Reports you make (what you reported, the reason, and an optional note) and the people you block.
- Support. Anything you send us by email.
Information collected automatically
- Advertising usage. Google receives ad interactions and diagnostics for free accounts as described in section 5. In 2.0.1, we do not send screen views, check-in events, onboarding answers or other product analytics to PostHog.
- Diagnostics. Google receives diagnostics associated with its ad software. Our own MetricKit reports are not uploaded in 2.0.1.
- Device and app. Device model, operating system and app version, language, and your IP address, from which a rough location (country or region) may be inferred.
- Identifiers. An account ID we assign you, a notification token if you allow notifications, and, for free accounts, the advertising data described in section 5.
- Purchases. Which subscription you have, when it started and renews, and its store transaction IDs. Apple handles payment; we never see your card details.
What we don’t collect
We don’t collect precise location, contacts, clinical records, heart-rate readings, or access to your whole photo library. We do collect the fitness information described above. We do not use HealthKit. When you choose a photo from your library, iOS hands the app only that photo. When you save your Player Card or Season Reel, the app can add to your library but can’t read it.
2. How we handle photos
- On-device checks. When you take or choose a check-in photo, the app checks it on your phone before uploading. An image classifier decides whether it shows a workout. A safety check (Apple’s Sensitive Content Analysis when you’ve turned it on in iOS, plus a model bundled with the app) looks for nudity. Neither check sends the photo anywhere.
- Flagged photos. A photo the safety check flags is never uploaded. We record only that a flagged attempt happened, and when.
- Who sees your photos. Members of the squad you checked in to see your check-in photos. Your profile photo appears to people in your squads. A squad’s name and photo appear to anyone with an invite to it.
- Reports. A reported photo disappears for the person who reported it straight away, and for everyone once two people report it. We review reports and remove content or accounts that break our Terms.
3. How we use information
- To run the app: your account, squads, challenges, check-ins, scoring, leaderboards, levels, invites and nudges.
- To keep people safe: to screen photos, filter names, handle reports and blocks, and enforce our Terms.
- To send notifications you’ve allowed: squad invites, nudges from squadmates, and your daily reminder (which your phone schedules itself).
- To provide subscriptions: to unlock Pro and the Squad Pass, and to restore them.
- To deliver and measure ads using the device and advertising information described in section 5. Workout records and photos are not used for advertising.
- To answer you when you contact us, and to meet legal obligations.
If you are in the European Economic Area, the United Kingdom or Switzerland, our legal bases are: performing our contract with you (running the app and your subscriptions), our legitimate interests (safety and security, balanced against your rights), your consent (personalized advertising, and notifications, which you can withdraw at any time), and legal obligations.
4. Who receives information
We don’t sell your personal information for money. We share it only as follows.
Other Challengrs users
Your display name, profile photo, level, check-ins and photos, points and streaks are visible to the members of your squads. Reports are anonymous: the person you report isn’t told who reported them.
Service providers
These companies process data for us under contracts that limit how they may use it:
| Provider | What it does | What it receives |
|---|---|---|
| Clerk (Clerk, Inc., USA) | Sign-in and account security | Email address, name, profile photo, sign-in method, device and IP details at sign-in |
| Convex (Convex, Inc., USA) | Database, file storage and server functions | Everything in section 1 that the app saves: profile, squads, challenges, check-ins and photos, reports and blocks |
| RevenueCat (RevenueCat, Inc., USA) | Subscriptions and purchase records | Account ID, purchase and subscription history, device and app details. Version 2.0.1 no longer sends an email subscriber attribute. |
| PostHog (PostHog, Inc.) | Historical analytics from earlier versions only | No new analytics or diagnostic data from 2.0.1. We request deletion of historical linked records when you delete your account. |
| OneSignal (OneSignal, Inc., USA) | Push notifications | Account ID, notification token, device and app details, notification delivery |
| Google AdMob and the Google User Messaging Platform (Google LLC, USA) | Ads and ad consent for free accounts | See section 5 |
| Apple | App distribution, payments and Sign in with Apple | As set out in Apple’s privacy policy |
Legal and safety
We may disclose information when the law requires it, to protect someone’s safety, to investigate abuse of the app, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply to your information.
5. Advertising
Free accounts see ads from Google AdMob on the Home screen, marked “Sponsored”. Pro and Squad Pass members see none, and for them the app never starts Google’s ad software.
- What Google receives. To show, cap, measure and protect ads, Google’s software collects device and ad data: the IDFV and, if you allow tracking, the IDFA (Apple’s advertising identifier); IP address and a rough location derived from it; device model and settings; ad interactions; and ad performance and diagnostic data. Google uses this under its own privacy policy: https://policies.google.com/privacy.
- Tracking permission. The first time an ad appears, iOS asks whether Challengrs may track you. If you allow it, ads can be personalized. If you don’t, or you change your mind later in iOS Settings → Privacy & Security → Tracking, the app asks Google only for non-personalized ads and Google doesn’t receive the IDFA.
- Consent where the law requires it. In the EEA, the UK and Switzerland, and anywhere else the law requires it, Google’s consent form asks for your choices before any ad loads. You can change them in the app under Profile → Settings → Ad privacy choices.
- Other controls. Each ad’s menu lets you report it or remove ads with Pro.
Under some US state laws, letting an ad network use device identifiers for personalized ads may count as “sharing” or “targeted advertising”. Declining tracking, choosing non-personalized ads in Ad privacy choices, or emailing us opts you out.
6. How long we keep information
We keep your information while you have an account. When you delete your account (section 7):
- Your sign-in with Clerk is deleted.
- Your email address, name, profile photo and settings are erased from our database, along with your check-in photos, onboarding answers, notifications, subscription records and squad memberships.
- Squads you were the only member of are deleted. In other squads you administered, the longest-standing member becomes admin.
- Your workout history, classifications, check-ins, weekly progress and recorded challenge results are removed in background batches. They no longer contribute your results to leaderboards. We keep a minimal deleted-account marker to prevent an old session from recreating your account.
Deleting your account automatically queues deletion requests to Clerk, RevenueCat, OneSignal and our former analytics provider PostHog. Failed requests remain pending and are retried. Provider acceptance is not a promise of instant erasure; some providers process requests asynchronously. You do not need to send a second email to start those requests. We remove provider identifiers from the queue after a request is accepted. We may keep limited moderation and deletion records to investigate abuse, protect security or meet legal obligations. We review these records for continued necessity. Backup copies follow the applicable provider deletion process and any legally required retention. Google and Apple may retain data for their own legal and service purposes. We do not send Google your Challengrs account identifier, so we cannot identify its records using that identifier. Apple keeps your purchase history, and account deletion does not cancel subscriptions. Cancel them in your Apple Account settings.
7. Your choices and rights
- Delete your account: Profile → Settings → Delete account. Access ends immediately. Database cleanup and provider requests continue in the background. Deletion cannot be undone.
- Edit your profile: Profile → Settings.
- Notifications: turn them off in iOS Settings, or turn off the daily reminder in Profile → Settings.
- Tracking and ads: see section 5.
- Block someone: from their name in your squad. Blocked people can’t tell; you stop seeing their photos, nudges and invites. Manage blocks in Profile → Settings → Privacy & safety.
Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information; to object to or restrict how we use it; to opt out of targeted advertising, sale or sharing; and to withdraw consent. To use any of these rights, email privacy@mekina.io from the address on your account. We may need to confirm your identity using information already associated with your account. We respond within the period required by the law that applies, generally one month for GDPR requests and 45 days for requests under applicable US state laws, subject to lawful extensions. If we deny a request, you may appeal by emailing the same address with the subject “Privacy appeal”. We explain our decision and how to contact the appropriate regulator. We won’t treat you differently for using your rights. If you’re in the EEA or UK, you can also complain to your local data protection authority.
8. Children
Challengrs is only for people 18 and over, and everyone confirms their age when they sign up. We don’t knowingly collect information from anyone under 18. If you think someone under 18 is using the app, email us and we’ll delete the account.
9. Security and where your data is stored
Data travels to and from our providers encrypted (HTTPS). The app stores sign-in tokens in the iOS Keychain. Our providers store data in the United States. If you use Challengrs from outside the US, your information is transferred there; where the law requires it, we rely on standard contractual clauses or an equivalent safeguard. No system is perfectly secure, so we can’t guarantee that data will never be accessed without permission.
10. Changes to this policy
When we change this policy we’ll update the date at the top. If a change is significant, we’ll let you know before it takes effect.
11. Contact
Mekina Software LLC 18611 Eddy St Northridge, CA 91324 United States
Privacy: privacy@mekina.io Support: contact@mekina.io
Using Challengrs 2.0.0? Its policy is here.
Using Challengrs 1.x? Its policy is here.