ChallengeFinds
ChallengeFinds Privacy Policy
Last updated: 13 October 2026
ChallengeFinds is a free-to-download iPhone and Android app for following 30-day bodyweight fitness challenges, with an optional paid membership, published by SIA "Happy 360". This policy explains what data the app handles, why, and what your rights are. We have tried to keep it in plain English. In this policy, "we", "us", and "our" mean SIA "Happy 360".
The short version:
- You can browse the app without an account. Starting a challenge needs a free account, so that your free window, progress and membership belong to you and not to one phone.
- If you create an account, we store your email address and your challenge progress (including mood ratings and notes) on our server so it can be backed up and restored on a new phone.
- No ads and no tracking. The app contains no advertising SDKs and does not track you across other apps or websites. Product analytics and crash reports are off unless you say yes. If you allow them, they carry no name, email or notes, and you can switch them off any time in Settings (§2.7).
- Payments go through Apple or Google. If you buy a membership, Apple (on iPhone) or Google (on Android) handles the payment; we never see your card details. We receive only your subscription status (which plan, when it renews or ended) via our subscription service, RevenueCat.
- You can delete your account and all server data yourself, inside the app, at any time.
1. Who is responsible for your data (data controller)
Controller: SIA "Happy 360" Registered office: Dzintaru iela 8-3, Mārupe, Mārupes novads, LV-2167, Latvia Company registration: 40203774674, registered in Latvia (VAT LV40203774674) Email: privacy@challengefinds.com
If you have any question about this policy or your data, contact us at the email above.
2. What data we handle, and why
2.1 If you use the app without an account
Signed out, you can browse the challenge catalog and read exercise instructions. The only network requests a signed-out app makes are anonymous reads of the public challenge catalog (challenge names, descriptions, exercise instructions, images) from our server. These requests do not identify you, though our hosting provider's infrastructure logs (see §2.3) apply. Reminder settings stay on your device.
2.2 If you create an account (needed to start a challenge)
An account is what makes your free window, your progress and your membership yours rather than one phone's: it lets us back your progress up to the cloud, restore it on another phone, and recognise your membership. Once you sign in, we store on our server:
| Category | Data | Where it lives |
|---|---|---|
| Account | Email address; internal account ID (a random UUID); sign-in method (Apple, Google or email); account created / last sign-in timestamps | Authentication system + profiles table |
| Challenge activity | Which challenges you started/completed/abandoned and when | active_challenges table |
| Daily logs | Per-day completion, mood rating (1–5), optional free-text note | challenge_day_logs table |
| Exercise progress | Per-exercise running totals per day (reps/seconds) | challenge_progress table |
Notes are free text; please be aware that anything you type there (including health details) is synced to your account if you are signed in.
Sign in with Apple: we receive only the email address Apple provides (which may be Apple's private relay address if you choose "Hide My Email") — we request no name or other scope. Sign in with Google (Android): we receive the email address of your Google Account and Google's identifier for the account; we request no other scope. Google's sign-in token can also carry your name and profile picture. The app does not use or show them, but our authentication system may keep them with your account until you delete it. Email: we use your email address to send you a one-time sign-in link, or to sign you in with a password if you set one.
Authentication tokens are stored in your device's Keychain (iPhone) or in encrypted storage protected by the Android Keystore (Android), restricted to that device.
2.3 Technical data
Like almost every internet service, our hosting provider (Supabase, see §4) automatically records short-lived technical logs of API requests — IP address, timestamps, and request metadata — for security, abuse prevention, and debugging. We do not use these logs to profile you.
2.4 What we do NOT collect
- No location data, contacts, photos, microphone, or camera access.
- No health data from HealthKit or any other Apple health API, and none from Health Connect or any other Android health API.
- No advertising identifiers (IDFA on iPhone, the advertising ID on Android); the app never requests App Tracking Transparency permission on iPhone, and does not request the advertising ID on Android, because it does no tracking.
- No advertising SDKs and no cross-app tracking. The app contains two third-party SDKs: RevenueCat's subscription library (§2.6) and PostHog's analytics and crash-reporting library (§2.7). Neither is used for advertising.
- No card, bank, or billing details — Apple (iPhone) or Google (Android) processes every payment (§2.6).
2.5 Notifications
Daily reminders and the re-engagement nudge are local notifications scheduled entirely on your device. No push-notification server is involved, no device push token is created (on iPhone or on Android), and nothing about your reminders leaves your phone. You control them in the app's Settings and in your phone's system settings (iOS Settings or Android Settings).
2.6 Membership purchases
The app offers an optional auto-renewing membership (see the Terms of Use §15). Purchases are made through Apple's App Store on iPhone and through Google Play on Android:
- Apple processes the payment and holds your payment details and purchase records under Apple's own privacy policy. We never receive your card or bank information.
- Google processes the payment for purchases made on Android through Google Play, and holds your payment details and purchase records under Google's own privacy policy. We never receive your card or bank information.
- RevenueCat (§4), our subscription-management provider, receives from Apple or Google the details needed to tell the app whether your membership is active: the product you bought, purchase and renewal/expiry dates, the App Store transaction identifiers or Google Play order and purchase-token identifiers, and Apple's anonymised original-transaction ID. RevenueCat's SDK inside the app sends it a random app-user ID and basic device information (device model, OS version, app version, locale) so purchases can be recognised on that device. It does not collect your name, email, or any fitness data.
- On our server we store a mirror of your membership status — active or not, which plan, renewal/expiry date, and the RevenueCat app-user ID — and which store (App Store or Google Play) it came from, against your account ID (
entitlementstable). This is what lets the app unlock membership features. A membership bought before you sign in is known to RevenueCat under a random identifier and is attached to your account when you sign in. - The free first-challenge window is tracked by the date of your account's first challenge start (
account_trialtable).
These records are deleted when you delete your account (§7). Apple, Google and RevenueCat keep their own transaction records for as long as their policies and tax/accounting law require.
2.7 Usage analytics and crash reports
To understand where people get stuck and to find and fix crashes, the app can send anonymous usage data and crash reports to our analytics provider, PostHog (§4). This is off by default. Nothing is sent, and the analytics library does not create its identifier on your phone, until you choose "Allow".
- What is sent: simple events such as "onboarding step viewed", "paywall viewed", "purchase started / completed / cancelled", "challenge started", "day completed" and "challenge completed", each with only fixed labels (for example which challenge, its difficulty, the day number, or whether a plan was monthly or annual); app open / close and first-install events; crash reports and non-fatal error reports (technical stack trace, error code, app and OS version, meaning iOS or Android); and basic device context (device model, OS version, app version, language, time zone, screen size, Wi-Fi or cellular).
- Who it belongs to: a random identifier that the app creates on your phone only after you allow this. It is not your account ID, your email, your Apple ID, your Google account, your RevenueCat ID or your advertising identifier, it is never connected to your account, and it is reset if you delete the app. We switch off PostHog's person profiles and its IP-based location lookup, and we configure the project not to store IP addresses.
- What is never sent: your name, email address, notes, mood ratings or mood notes, reps and seconds, reminder times, or anything you type. No advertising identifier is used, and the app does not ask for App Tracking Transparency permission on iPhone or the advertising ID on Android.
- Where: PostHog's EU cloud, hosted in Frankfurt, Germany (§4, §5).
- Your choice: the app asks you once, with "Allow" and "Not now". Either answer is final until you change it: we do not ask again. You can switch it on or off at any time in Settings → Privacy → Share anonymous usage data. Switching it off stops events and crash reports from being sent from that moment. Crash reports are covered by the same choice.
3. Lawful bases (GDPR / UK GDPR)
| Processing | Lawful basis |
|---|---|
| Creating your account, authenticating you, syncing and storing your challenge progress, mood, and notes | Contract (Art. 6(1)(b)) — this is the service you asked for when you created an account |
| Sending magic-link sign-in emails | Contract (Art. 6(1)(b)) |
| Recording whether your membership is active, and the date your free first challenge started, so the app can unlock what you have paid for | Contract (Art. 6(1)(b)) |
| Security / infrastructure logs (IP addresses, request logs) | Legitimate interests (Art. 6(1)(f)) — keeping the service secure and working |
| Anonymous usage analytics and crash reports (§2.7) | Consent (Art. 6(1)(a)) — you choose "Allow" in the app or switch it on in Settings. You can withdraw consent at any time by switching it off in Settings → Privacy; withdrawing does not affect what was sent before |
| Responding to your support or rights requests | Legal obligation (Art. 6(1)(c)) and legitimate interests |
We do not process special-category data on purpose. Mood ratings and workout logs are wellness data, not medical records; free-text notes are under your control. We do not analyse them for any purpose — they exist solely so you can read them back.
4. Who processes data for us (sub-processors)
| Provider | Role | Location |
|---|---|---|
| Supabase (Supabase Inc.) | Database, authentication, and API hosting for accounts and synced progress. Our project runs in the EU (AWS eu-central-1, Frankfurt, Germany) | EU data hosting; Supabase Inc. is a US company acting under its Data Processing Addendum with EU Standard Contractual Clauses |
| PostHog (PostHog Inc.) | Product analytics and crash reporting (§2.7): receives the anonymous events and crash reports described there. Our project runs on PostHog Cloud EU, in Frankfurt, Germany | EU data hosting; PostHog Inc. is a US company acting under its Data Processing Addendum with EU Standard Contractual Clauses |
| Apple | "Sign in with Apple" identity provider (only if you choose it) | Apple processes the sign-in under its own terms |
| Google (Google LLC / Google Ireland Limited) | "Sign in with Google" identity provider on Android (only if you choose it) | Google processes the sign-in under its own terms and privacy policy |
| Resend (Resend, Inc.) | Delivery of sign-in emails (magic links, password resets). Our sending region is the EU (Ireland) | EU sending region; Resend, Inc. is a US company acting under its Data Processing Addendum with EU Standard Contractual Clauses |
| RevenueCat (RevenueCat, Inc.) | Subscription management: receives purchase and renewal information from Apple and Google, tells the app whether your membership is active, and notifies our server of membership changes (§2.6) | RevenueCat, Inc. is a US company; data is processed in the United States under its Data Processing Addendum with EU Standard Contractual Clauses |
| Apple | Payment processing for memberships (App Store), as the merchant of record | Apple processes purchases under its own terms and privacy policy |
| Payment processing for memberships bought on Android (Google Play), as the merchant of record | Google processes purchases under its own terms and privacy policy |
We do not sell or share your data with anyone else. We disclose data only if required by law.
5. International transfers
Your synced data is stored in the European Union (Frankfurt, Germany), and sign-in emails are sent from the European Union (Ireland). Anonymous analytics and crash reports are stored in the European Union (Frankfurt, Germany) by PostHog. Membership status is processed by RevenueCat in the United States. Where a provider (Supabase Inc., Resend Inc., RevenueCat Inc., Apple, Google) is established outside the EU/UK, transfers rely on that provider's safeguards — EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as applicable.
6. How long we keep data (retention)
- Account, progress and membership-status data: kept for as long as your account exists. Deleted immediately and permanently when you delete your account (§7). We keep no backups of deleted accounts beyond our hosting provider's standard short-term infrastructure backups, which roll off automatically within 7 days. Deleting your account does not cancel an App Store or Google Play subscription (Terms §15.3) and does not erase Apple's, Google's or RevenueCat's own transaction records.
- Analytics and crash reports: kept for up to 12 months, then deleted automatically.
- Local device data: under your control; removed when you delete the app.
- Infrastructure logs: retained briefly per Supabase's standard log retention, then discarded.
7. Your rights and how to use them
Under the GDPR / UK GDPR you have the right to access, rectify, erase, restrict, object, and port your data, and to complain to a supervisory authority.
Delete everything: in the app (iPhone or Android), go to Settings → Delete account… This permanently deletes your account and all synced data from our servers (progress, logs, notes, everything), with no waiting period, and the app removes your challenge progress from this phone as well. Reminder settings stay on the phone until you delete the app. If you can no longer use the app, you can ask us to delete the account by email; the steps are at https://challengefinds.com/delete-account/.
Export your data: we can provide a complete machine-readable (JSON) copy of everything stored about your account. Email the contact in §1 and we will send your export within 30 days.
Everything else (access, correction, objection): email the contact in §1. We respond within one month.
Complaints: you may lodge a complaint with your local data protection authority. The supervisory authority for SIA "Happy 360" is Datu valsts inspekcija (the State Data Inspectorate), Latvia.
Analytics data: anonymous usage events and crash reports (§2.7) are not connected to your account or email, so we cannot look up or delete the events of one particular person. You can withdraw your consent and stop further collection with the switch in Settings → Privacy, and deleting the app resets the random identifier.
Data that only ever lived on your device (reminder settings, anything from before you signed in) is under your direct control and goes when you delete the app.
8. Children
ChallengeFinds is a general-audience fitness app and is not directed at children. You must be at least 16 to create an account. We do not knowingly collect data from children below that age; if you believe a child has created an account, contact us and we will delete it.
9. Security
Synced data travels over HTTPS only. Server-side access is protected by per-user row-level security — each account can read and write only its own rows. Session tokens are kept in the iOS Keychain (iPhone) or in encrypted storage protected by the Android Keystore (Android) on your device. Admin access to the backend is limited to authorised SIA "Happy 360" personnel.
10. Changes to this policy
If we change this policy in a way that matters, we will update the date above and note the change in the app or on this page before it takes effect.