Privacy Policy

1. What we collect

We collect only what a challenge needs to run, and we would rather hold less of it than more.

• Account details: your email address, display name and profile photo if you set one.
• Fitness data: daily step totals for the days a challenge covers, and the tracker you chose for that challenge.
• Challenge activity: which challenges you joined, which days you met, rest days used, and whether a participation settled met or missed.
• Payment details: a payment method saved with our payment processor, along with the last four digits and card brand so you can tell your cards apart. We never see or store your full card number.
• Location, for solo promise challenges only: a single position fix at the moment you tap "I am here", compared against the place you chose. We do not track you in the background and we do not keep a location history.
• Usage data: which screens you open and which actions you take - joining a challenge, checking in, connecting a tracker - so we can see where the product confuses people. It never includes your step counts.
• Technical data: device model, operating system version, app version and crash reports, so we can fix what breaks.

2. What we do not collect

Your tracker knows a great deal more about you than we ask for. We do not read heart rate, sleep, workouts, weight, menstrual or reproductive health data, blood glucose, or any other health metric. We do not read your contacts, your photos or your calendar. We do not run background location.

3. Why we use it

Every piece of data above exists for one of four reasons:

• To score a challenge: comparing your daily steps against your goal is the entire product.
• To charge correctly: settling a challenge means charging the players who missed, once, for the amount they chose.
• To keep your account working: signing you in, syncing between your devices, and letting you delete everything.
• To fix faults: crash reports and sync failures, which is how a missed day caused by a bug gets found.
• To improve the app: which screens get used and which get abandoned, counted in aggregate rather than read one person at a time.

We do not use your data to build an advertising profile, and we do not sell it. There is no version of this product where selling your step history makes sense.

4. Health and fitness data

Step data reaches us in one of two ways. From your phone, through Health Connect on Android or Apple Health on iOS, after you grant permission there. Or from your Google account, through Google Health - which is where a Fitbit or a Pixel Watch puts its steps - after you complete Google's own consent screen.

From Health Connect on Android we ask for one permission and no others: read steps (android.permission.health.READ_STEPS). We never ask to write data, and never for heart rate, sleep, exercise, location or any other Health Connect data type. We use it for two things only: when you join a step challenge, we show you your daily steps for last week (Monday to Sunday), so you can see what your tracker records before you commit - and, where a challenge sets goals per player, we work out your goals from that week; and while a challenge you joined is running, we read your daily step total for each of its days and upload those totals to our server to score the challenge. We read Health Connect only while Earnest is open on your screen - when you open the app and when you tap Update now - and never in the background. The permission sheet in Health Connect links to a screen in the app that explains this.

Earnest's use of information received from Health Connect adheres to the Health Connect Permissions policy, including the Limited Use requirements. Step data from Health Connect is never sold, never used for advertising, never shared with data brokers or other third parties, and never used to train machine learning or artificial intelligence models.

From Google Health we ask for one permission and no others: "See your Google Health activity and fitness data", the scope named googlehealth.activity_and_fitness.readonly. We use it for one thing - reading the daily step totals for the days a challenge you joined covers. We do not read the other things that permission would allow, and we do not read days outside a challenge window.

Earnest's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Google user data is never sold. It is never used for advertising or to build an advertising profile, never shared with data brokers, and never used to train machine learning or artificial intelligence models. Nobody at Earnest reads it to satisfy their curiosity; it is processed automatically to score a challenge, and looked at by a person only where you have asked us to investigate something or the law requires it.

You grant the permission per service and can withdraw it at any time: disconnect the tracker in Earnest, or remove Earnest under Data & privacy in your Google account. Either one revokes our access with Google and deletes the tokens we were holding. Withdrawing it stops new steps arriving; a challenge already running will stop scoring, so disconnect between challenges rather than during one.

5. Payments

Card details are handled by our payment processor and never touch our servers. When you add a card, the processor stores it and gives us a token; we keep the token, the card brand and the last four digits.

Joining a challenge moves no money. If a challenge settles and you missed your goals, the amount you chose when you joined is charged once to that saved card. If you kept your goals, nothing is taken and there is nothing to refund.

We keep a record of charges that actually happened. Those records are part of a payment and we are required to retain them, so they survive account deletion.

6. Who else sees your data

We share the minimum needed to run the service, with providers who are contractually bound to use it only on our instructions:

• Our payment processor, to save a card and settle a charge. It receives no health data.
• Our server host, which provides the machine your account, challenge and step data sits on. It stores that data on our behalf and uses it for nothing of its own.
• Our analytics and crash reporting provider, which receives usage events and crash reports - so a fault that costs somebody a day can be traced, and a screen nobody can get past can be found. It receives no health data.

That list is exhaustive for Google user data - the step totals we read from Google Health and the tokens that let us read them. Of the three, only our server host holds any of it, because the data sits on its machine. We transfer no Google user data to our payment processor, to our analytics provider, to advertisers, to data brokers, or to anyone else, and we do not sell it. Where we would ever need to share it for a new reason, we would ask you first.

Other players in a challenge see your display name, your profile photo, and whether you met each day - that is what a shared challenge is. They never see your email address, your card, your location or your raw step counts.

We will disclose data if the law requires it, and we will tell you when we are allowed to.

7. How we protect it

Health data, and the credentials that reach it, get the strongest handling we have:

• Everything is encrypted in transit. The app reaches our API over HTTPS and our API reaches Google over HTTPS. There is no plaintext leg.
• The tokens that let us read your Google Health data live on our server and nowhere else. The app never receives one - Google returns the browser to our server, which makes the exchange and keeps the result. A stolen or lost phone gives up no access to your health data.
• The database is not reachable from the internet. It publishes no ports and answers only the API, over a private network inside the machine, and that machine's firewall accepts nothing but web traffic and SSH.
• We store daily step totals for the days a challenge covers, and nothing finer. There is no minute-by-minute history to lose.
• Health data never reaches our analytics or crash reporting provider, and it is never written to our application logs.
• Access to the production machine and its database is limited to the people who run Earnest, over SSH, and is for keeping the service up rather than reading anybody's data.
• Disconnecting a tracker or deleting your account revokes our grant with Google and deletes both the tokens and the step history we held.

No system is perfect, and we would rather tell you what we actually do than claim a certification we do not hold. If you find a weakness, write to us at the address at the bottom of this page and we will treat it as urgent.

8. This website

This page and the rest of this website set no cookies, which is why you have not been asked to dismiss a banner. We count how many times a page was viewed, which store badge was pressed, which of the questions on the home page were opened, and the site of the link you arrived from - the site, never the full address you came from.

All of that is measured without a cookie and without anything written to your browser, so we cannot tell that a visitor today is the same person who came yesterday. That is a real limit on what we can learn and we accept it: a marketing page is not worth putting a consent dialog in front of every reader.

If your browser sends Do Not Track or Global Privacy Control, the site measures nothing at all and does not even fetch the code that would.

9. How long we keep it

Step data is kept for the challenge it belongs to, and for a short window afterwards so a settlement can be checked or appealed. Account details live as long as your account does. Charge records are kept for as long as tax and payment rules require, which is typically seven years.

10. Your choices

You can, at any time:

• See and edit your profile in Account settings.
• Disconnect a tracker, which stops any further health data reaching us.
• Remove a saved card, provided no challenge you joined is still running.
• Delete your account from Account settings. This removes your profile, your step history and your challenge participations. Records of charges that already happened are kept, as described above.
• Ask for a copy of your data, or ask us to correct it, by writing to us.

Depending on where you live you may also have rights to object to processing or to lodge a complaint with a data protection authority. Write to us first and we will try to sort it out.

11. Children

Earnest is not for people under 18. We do not knowingly collect data from children, and if we learn we have, we delete it.

12. Changes to this policy

If we change what we collect or why, we update this page and change the date at the top. Material changes are announced in the app before they take effect.

13. Contact us

Questions about your data, or a request to see or delete it: privacy@earneststakes.app. We answer every one.