Privacy policy

About Journey

Journey records your fitness journey and lets you choose what to share with other members. Contact Journey with Shannon at the email below with privacy questions, requests or complaints.

Information you provide

We store your account ID, display name, username, email or mobile login identifier, password hash and account settings. Depending on the features you use, we also store photos, tags, comments, reports, follows, blocks, invitation relationships, Growth rewards, bodyweight, lift logs and benchmark results. Your optional country is selected by you; the app does not request your GPS location or address book.

Why we use it

We use this information to provide your journal, sign-in, progress tracking, sharing, recommendations, leaderboards, Growth rewards and safety controls. Session and network information is used to secure the service and limit abuse. Support correspondence is used to respond to your request. We do not sell this information or use it for cross-app advertising tracking.

Security request limits

To limit abusive requests, we retain a hashed identifier derived from your network IP address or account ID, a request count and an expiry time. Scheduled cleanup removes these security records after they have been expired for more than a day. We do not use these records to determine your location or identify a device.

Community activity dashboard

We record one activity marker per signed-in account per UTC day and retain these markers for about a month. Authorised moderators can see account names, registration dates, recent active days, overall Growth points, Tree stage and completed referral sign-up counts to understand community use. The dashboard shows unique daily, seven-day and thirty-day users and sign-up trends. It does not expose private journal photos, bodyweight, lift records, Apple Health measurements, login details or individual Growth reward sources. Deleted accounts leave the member list and activity totals; confirmed referral credit already earned by another member can remain. Activity before measurement began or outside the retained period is unavailable.

Optional Apple Health access

On a supported iPhone, you can choose read-only access to bodyweight, daily steps and workout summaries in Apple Health. Access is requested only when you open a Health preview or connect steps. Journey does not write to Apple Health or sync in the background. Workout previews are not uploaded. If you agree to connect steps, Journey stores daily step totals, dates and reading times privately in your account on Cloudflare. A current-day 5,000-step milestone earns 5 Growth, capped to one reward per local date and UTC receipt day; historical readings earn no points. Only the overall Growth total and Tree can appear on your shared profile or cards, never step counts or dates. Step-derived Growth is excluded from email marketing summaries. If you explicitly select bodyweight dates and confirm import, Journey stores those measurements, local dates, source identifiers and source names in your private account. Stable identifiers prevent repeated imports and rewards. Manual weights take priority; imported weights do not earn Growth. Health measurements are excluded from public rankings, share cards, advertising and marketing, including Klaviyo. Remove saved Health imports in Settings or delete your account. Removing imports retains earned Growth and its reward receipt to prevent repeated claims, without retaining removed step counts. Corrected weights remain Health-derived and private. Deleting data in Apple Health does not automatically erase an earlier Journey import. You can revoke access in the Health app. A private account export contains imported records, so protect that file.

Who can see your information

Your journal and fitness records start private. Publishing a photo makes it visible to signed-in members, subject to blocks and moderation. You can make your own post private again. Your profile and avatar can be visible to members through your interactions and discovery settings. Leaderboard participation is optional and shares the selected results and country. A referral can reveal that an invited account joined or qualified for a reward, but does not reveal its private photos or records. Moderators can review reported content and the associated safety information.

The public community globe groups optional countries shared by discoverable members who have joined the leaderboards. A country appears only when at least five eligible members share it, and group sizes use broad ranges rather than exact counts. The globe never receives account identities, precise locations or online activity. It does not infer where you live or where you signed up. Keeping your country private, turning off profile discovery or leaving the leaderboards removes you from the next aggregate refresh, within five minutes.

Sharing outside Journey

Share cards include the information shown in their preview, which may include photos, a public username, Growth total and referral link. Account export is a separate full JSON download, without a card preview: it can contain your private login and recovery details, fitness records, photo references, reports and blocks. Keep that file private or share it only with someone you trust. Your login email or mobile is not used as the public referral code. Other apps and recipients receive files only when you choose to share them. Making a post private, blocking someone or deleting an account cannot recall copies already saved outside Journey.

Service providers

Cloudflare provides the hosted application, database and photo storage. When email delivery is enabled, Klaviyo receives the destination email, an event identifier and the minimal information needed for account verification, password reset, security or moderation notices. This may include a single-use action link, expiry, changed public username or rule category, but never photos, bodyweight, training records, passwords, phone numbers, reporter identities or private moderator notes. If you separately opt into a weekly recap, Klaviyo receives aggregate check-in, streak, Growth, tree-stage and follower counts. News and offers require a separate explicit marketing choice for your verified address. Creating an account never subscribes you automatically. Providers may process information outside your country. Other platforms handle files you independently share under their own policies.

Public website and campaign links

Our public landing page does not load Google Analytics, Google Tag Manager or third-party advertising trackers. Campaign labels from links may be kept in your browser's session storage, and button-click details are held in page memory. This information is not sent to an analytics provider by the landing page. Session storage clears when you end that browser session. Cloudflare processes website requests to deliver and secure the site. Founder photos and records shown on the public landing page are published with the founder's permission; your journal is not used as marketing material automatically.

Storage and security

Records are associated with your account on our servers. Selected photos are resized and re-encoded and their metadata is removed before storage. Sign-in uses protected connections, hashed passwords and revocable sessions. The iPhone app keeps its session credential in the device Keychain; the website uses a session cookie. Appearance preferences and some display settings are stored on your device. No service can promise absolute security.

Your choices and retention

We retain your saved records while your account exists, unless you remove them. Settings lets you edit account details, control discovery and leaderboards, manage blocks, export records and delete your account. Account deletion removes your account and its photos and personal records; failed photo-storage deletions are queued for cleanup. Previously used usernames and invitation codes remain reserved without an account owner to prevent impersonation or reattribution. Growth already earned by another member can remain in that member’s ledger. If you delete an individual photo or lift but keep your account, minimal Growth activity claims and previous lift bests remain to prevent repeated rewards for the same activity. Provider operational logs and any copies you shared elsewhere have separate retention. Contact us for help with access, correction, deletion or a privacy complaint; we may need to verify account ownership.

Reports, decisions and review requests

Reports include your account, the reported item, your selected reason, optional details and submission time. Requests to review a moderation action include your account, the action, your message and submission time. Moderators review the reported target and limited safety context, including account age, previous upheld removals and suspension status. Reporting does not open a member’s private journal or measurement history. Reporter usernames are visible only to authorised moderators. Reporters receive a neutral review outcome; they do not see penalties, moderator identities or private notes. Affected members receive a notice with the rule category and can request one review of each moderation action. A separate moderator decides when one is available. Moderation actions are recorded in an append-only safety audit log, which moderators cannot edit or delete.

Email preferences and delivery records

Security, account and moderation emails are essential service messages for verified recovery addresses when delivery is enabled. Verification is an explicit challenge sent to the address you choose before it becomes trusted. Weekly recaps and news/offers are separate optional choices, both off by default and editable in Settings. Signed recap unsubscribe links affect only that preference. Delivery is retried using a temporary outbox. Recipients and action links are erased after acceptance, expiry or final failure; sent rows are deleted after 30 days, and deletion-confirmation rows immediately after acceptance. A one-way event identifier remains to prevent duplicate sends. Already accepted or delivered mail cannot be recalled; provider records have separate retention.

Account email availability

Settings shows whether email verification and password reset delivery are enabled. Mobile verification and SMS recovery are not currently supported. We never ask you to email your password or a reset code.

Changes

This page describes the current service. We will update it when our practices change. The revision date is shown above.