Privacy Policy
In short
- We keep what the game needs: your email, nickname, activities, timers and candy. Nothing about your body, your health records or your contacts.
- Your location is used only if you turn it on, for Cardio distance or to check in at a pod event, and only a total ("5.2 km") or a "there" leaves your phone. Never your route or where you are.
- Your progress numbers (steps, distance, pages, drawing grades) are private, except your result in a pod event you join.
- Your activity names and your rewards are private. Nobody else sees them, and they never go into error reports.
- Proof photos are taken inside the app, kept private and deleted after 7 days. An AI looks at them only if you say yes.
- Your data is stored in the United States. We list every company that handles it below.
- No ads, no tracking and no selling your data. You can save a copy of your data or delete your account from Profile at any time.
1. Who we are
Sweekly ("we") decides how your data is used and is responsible for it. Its servers and your data are in the United States.
Contact: support@sweekly.app. We answer within 30 days, usually much sooner.
2. What we collect and why
| What | Why | Where it comes from |
|---|---|---|
| Your email address | To sign you in with a one-time code, Apple or Google, and to reach you about your account | You, or Apple or Google when you use them (we ask them for your email only) |
| Nickname, built-in avatar, time zone, day start, language, reminder settings | To run your account and show your place in pods and leagues | You |
| Your answers to the sign-up questions (18 or older, the Terms and this policy, storage in the US) and the time you gave them | To prove what you agreed to | You |
| Your activities, goals, timers, collects, streaks, freezes, rewards and purchases | To play the game: count candies, chocolates and streaks | You and the app |
| Your candy ledger and balance, chocolates and white chocolate (your league score) | To keep score; the server works them out, never the app | Worked out by our server |
| Friends, pods, pod challenges, cheers (an emoji and an optional message of up to 60 characters) | To play with friends | You and your friends |
| Pod events: the title, description, activity, day and times, and the place (a pin on a map, a radius and a name) the creator picked; who joined; the ranking | To run events in your pod | The pod member who created it, and the people who join |
| Reports and blocks | To keep people safe | You and other players |
| Walk and Cardio proof: how many minutes the phone counted you walking, running or still during your timer | To check the activity happened | Your phone's motion sensor. Never your route or the raw sensor data |
| Walk and Cardio progress: the step total of each session and, on iPhone, the phone's distance estimate from those steps | To show your progress, and your result in a pod event you join | Your phone's step counter, only if Steps is on (Profile). Only the totals of each session, never step-by-step data |
| Cardio distance and moving time from your location | To show your progress, and your result in a pod event you join | Your phone's location while a Cardio timer runs, only if you turn on Track distance. Worked out on your phone; only the total distance and time are sent, never your route or positions |
| Event check-in: whether you were at a pod event's place when you started | To rank you in an event that has a place | Your phone compares its location with the event's place once, when you start. Only "there" is sent, never your position or distance |
| Reading, Writing and Drawing proof: check photos taken in the app, the hand sign or number asked, and the result | To check the activity happened | Your camera, inside the app only. We remove location and other hidden data from the photo on your phone before it is sent |
| Reading, Writing and Drawing progress: the page number read on a photo, the pages written (an estimate) and a drawing's grade from 0 to 100 | To show your progress, and your result in a pod event you join | The AI that checks your photos, only if you agreed to photo checks by AI |
| A push token for your phone | To send the notifications you turned on | Your phone |
| Error reports: the app version, the phone model and system, what went wrong | To fix crashes | The app. Never your activity names, rewards, messages or other text you typed |
| A record of each change you send (an ID, the type of change and a fingerprint) | So a change sent twice counts once, and to stop abuse | The app |
We do not collect weight, body or medical information, data from health apps, your route or where you are, your contacts or photos from your library. When you use "Use my location" to pick an event's place, your position only moves the map on your phone. We do not use analytics or advertising tools.
3. Our legal reasons
- To give you the service you signed up for (a contract with you): your account, the game, friends, pods and leagues.
- Your consent: storing your data in the United States; photo checks by AI, with page numbers and grades; step counts; location for Cardio distance and event check-ins; notifications. You can withdraw a consent at any time (section 8); this does not undo what was done before.
- Our legitimate interest in keeping Sweekly safe and working: error reports, abuse limits, reports and blocks, cheat checks. You can object (section 8).
- The law: when we must keep or give data to an authority.
4. What other people see
- Anyone who taps your name in a league or a pod: your nickname, avatar, Global league tier and your streaks on ready-made activities.
- Players in your league race: also your white chocolate total for the week.
- Your pod-mates: the pod name, your streak, days this week and whether you did each pod activity today, your cheers to them, the weekly recap (minutes and days), the events you create or join, and, for an event you join, your result in its ranking (for example your distance).
- Nobody sees your candy, your rewards, your own (custom) activities, your history, your proof photos, your email or your progress numbers (steps, distance, pages, grades), except your result in an event you join.
- When you share your week, only your own numbers leave the app, and only where you send them.
- If you block someone, you each see the other as "Hidden player".
5. Who handles your data for us
These companies process data only on our instructions, to run Sweekly. We do not sell or rent your data to anyone.
| Company | What it does | What it receives | Where |
|---|---|---|---|
| Supabase, Inc. | Database, sign-in, file storage, server functions | Everything in section 2 | United States (Virginia) |
| Functional Software, Inc. (Sentry) | Error reports | Error reports (section 2), never your account ID or email | United States |
| Resend, Inc. | Sends sign-in code emails | Your email address | United States |
| Cloudflare, Inc. | Our web address, the web app, and an encrypted copy of our backups | Your internet address when you visit; the encrypted backup | Worldwide network; backups in the United States |
| Expo (650 Industries, Inc.) | App updates and sending push notifications | Your push token and the notification text | United States |
| Apple and Google | Sign in with Apple or Google; delivering push notifications; the maps and place search for pod events (Apple Maps on iPhone, Google Maps on Android) | Your sign-in; your push token and the notification text; the map area you look at and the place you search for, never your account | United States |
| Anthropic, PBC | Photo checks by AI, only if you say yes | Each check photo, the sign asked and the activity's name. It sends back the result and, if asked, a page number, a page estimate or a grade. Never your name, email or nickname | United States |
Anthropic, PBC may keep a photo for up to 30 days for its own safety checks, and may not use it to train its AI. If its safety checks flag a photo as breaking its rules, it may keep it for up to 2 years.
If you live outside the United States. Your data goes to the United States when you use the app, over an encrypted connection, to the companies above, for the purposes above and for the times in section 6. You agree to this at sign-up. If you say no, you cannot use Sweekly, because the database is there. For people in the EU and the UK, we rely on these companies' standard contractual clauses or their certification under the EU-US Data Privacy Framework.
6. How long we keep it
| What | How long |
|---|---|
| Your account and game data | Until you delete your account |
| Proof photos | 7 days, or at once when you turn photo checks off. The result (passed or not) stays with your account |
| Cheer messages | 30 days. A reported message: 90 days, then deleted |
| Progress numbers (steps, distance, pages, grades) | Until you delete your account (they are part of your game data) |
| Pod events, their place and ranking | 90 days after the event, then deleted |
| Your route on a Cardio run | Never stored: your phone drops it when you collect or cancel |
| Notifications in the bell, unanswered friend requests | 30 days |
| A friend-code search | 24 hours |
| Access-code tries | 1 day |
| Reports you make or receive | Up to 1 year, to deal with repeated problems |
| Error reports | Up to 90 days at Sentry |
| Backups | 30 days, then they age out |
When you delete your account, everything you own is removed at once, candy ledger included. If something fails, it is done within 24 hours. Copies in backups disappear within 30 days, and if we ever restore a backup we delete your account again before the app reopens. Reports other people made about you stay up to 1 year. In pods you then show as "Former member", with past recap numbers and no name.
7. How we protect it
Every table is locked so that each person reaches only their own rows. Connections are encrypted. Photos sit in a private store. The server, not the app, decides candy. Only the owner can reach the production systems, with two-factor sign-in. If a breach puts your data at risk, we tell you and the authorities that the law requires within 72 hours of learning of it.
8. Your rights
You can, at any time:
- See and save your data: Profile → Account → Export my data (one file with everything you own).
- Correct it: change your nickname, avatar, email and settings in Profile.
- Delete it: Profile → Account → Delete my account. Or follow sweekly.app/delete.
- Withdraw a consent: turn photo checks, steps, location or notifications off in Profile (or location in your phone's settings). To withdraw storage in the US, delete your account.
- Object or ask us to limit how we use your data, or ask anything else: write to support@sweekly.app from your account's email.
You can also complain to the data protection authority where you live: in the EU, your country's authority (in France, the CNIL); in the UK, the ICO.
9. Age
Sweekly is for people 18 or older. If we learn that someone younger has an account, we delete it.
10. On the web
The web app keeps your sign-in and settings in your browser's storage. We use no advertising or tracking cookies.
11. Changes
When this policy changes in a way that matters, the app shows it to you and asks again before you continue. The version and date are at the top.