Privacy policy

Draft: still being reviewed before launch.

Effective date: [EFFECTIVE DATE]

This policy explains what personal information Chalk collects, why, who we share it with, and the choices you have. It covers the Chalk web app and installable app (the "service").

1. Who we are

Chalk is operated by [COMPANY LEGAL NAME] ("Chalk", "we", "us"), at [ADDRESS]. Contact us about privacy at [CONTACT EMAIL].

2. The short version

• We collect what a gym tracker needs: your email, your profile, and what you log.
• Workouts, bodyweight and nutrition entries can reveal things about your health. We treat them with care.
• You choose who sees your workouts. Private accounts stay private.
• You never upload photos or videos. Your avatar is a generated monogram.
• Stripe handles your payment. We never see or store your card number.
• We use no advertising trackers and we do not sell your information.
• You can download or delete everything from your profile.

3. What we collect

Account. Your email address. Sign-in is by email link or passkey. We keep a passkey's public key, not a password. Sessions keep no IP address or browser details.

Profile. Your username, and optionally a display name and bio. Your account setting (public or private). Units, time zone, and your onboarding answers (goal, experience, weekly workout goal).

Training. Workouts with exercises, sets, weights, reps, times and notes. An optional gym tag and tags for training partners. Routines and custom exercises. Personal records, which we compute from your workouts.

Health-adjacent data. Your workouts, bodyweight log, and nutrition entries (calories, macros and targets). Some places treat this as sensitive or health data. We use it only to run the service for you, and we do not use it for advertising.

Planning. Planner entries, daily habits and check-offs.

Social. Follows, follow requests, blocks, kudos and comments. Clubs you join, challenges you take part in, and badges you earn. Notifications we show you.

Reports. Reports other members file about people, workouts and comments, and the actions we take on them.

Push notifications. If you turn them on, your browser's push endpoint and keys.

Subscription. Your plan, status and renewal dates, copied from Stripe. Payment details stay with Stripe.

Referral. If you arrived through a creator's link, we keep which creator referred you.

Device storage. See section 9.

4. How we use it

• To run your account and sign you in.
• To show your workouts, progress and records to you, and to others as your settings allow.
• To run clubs, challenges, leaderboards and notifications.
• To take payment, give access, and manage your subscription.
• To pay creators for referrals.
• To keep the service safe: handling reports, removing content and suspending accounts. We log admin actions.

5. Who can see your content

• Account setting. A public account can be found and followed. A private account's workouts are seen by approved followers only.
• Per-workout visibility. For each workout you choose everyone, followers, or only me.
• Share pages. Pages such as /w/:id and /p/:username show only public workouts of public accounts, to anyone with the link. They leave out notes and comments. Private accounts never appear on them.
• Story cards. If you choose to share a story card, whoever you share it with can see it.
• Blocking. If you block someone, you are hidden from each other.
• Clubs. Club leaderboards respect visibility settings.
• Challenges. Challenge leaderboards show each participant's progress totals. These totals include all your workouts within the challenge dates, including private ones. We tell you this when you join. Only the totals are shown, not the workouts.

6. Who we share it with

We use these service providers. They handle data for us under their own terms.

• Cloudflare. Hosting, our database, sending sign-in emails, and Turnstile bot protection.
• Stripe. Payments and the customer portal. Stripe has its own privacy policy.
• Rewardful. Affiliate tracking. See section 8.
• Browser push services run by Apple, Google, Mozilla and Microsoft. They carry encrypted notification payloads to your device, and they learn that your device has an endpoint with us.
• jsDelivr. Exercise images load from its content network, from the public-domain free-exercise-db library. Your browser contacts jsDelivr when it loads them.

We may also share information if the law requires it, to protect people's safety, or in a sale or merger of the business. We do not sell personal information.

7. Payments and the free trial

We use Stripe Checkout. Stripe collects and holds your card details. We receive your plan, status and renewal dates.

The free trial is available once per email address, ever. To enforce this, we keep a hash of your email (a pseudonymous fingerprint of the address, not the address itself). We keep the hash even after you delete your account, so that deleting and re-registering cannot give a second trial.

Verified creators and some other members may get free access. We record that status on their account.

8. Creators and affiliate links

Creators can earn commissions on subscribers they refer. When affiliate tracking is switched on, we use Rewardful, a third party, to track this: Rewardful sets a cookie and receives a referral ID, and we add the referral ID to your Stripe customer record. Separately, if you arrive through a creator's link, we remember who brought you and follow them for you when you join. Creators may be paid when you subscribe through their link.

9. Cookies and device storage

• Session cookie. Keeps you signed in. Needed for the service.
• Last sign-in method cookie. Remembers whether you used email or a passkey, so we show it first.
• Rewardful cookie. Tracks affiliate referrals, when affiliate tracking is switched on.
• Offline cache. Your device stores a copy of your data in IndexedDB so the app works offline.
• Offline outbox. Workouts you log offline wait on your device until they sync.
• Preferences. Your theme, whether you dismissed the install prompt, a remembered creator link (via), and your onboarding answers until you finish onboarding.
• App files. The app keeps its own pages and files on your device so it opens offline.
• Bot protection. Cloudflare Turnstile, on the sign-in page, may set its own cookies to tell people from bots.

We use no advertising trackers. We do not respond to Do Not Track signals differently, because we do not track you across other sites.

10. Notifications and email

We show notifications in the app. We send push notifications only if you turn them on, and you can turn them off in your browser or the app. We email you sign-in links. We send no marketing emails today. If that changes, we will ask first where the law requires.

11. How long we keep it

We keep your data while your account is open. When you delete your account, we delete your data immediately. Two things remain:

• The trial hash described in section 7.
• Admin audit log entries about moderation actions. They keep an internal account number but no name, email or content.

Your Stripe customer record (your email and payment history) stays with Stripe, which keeps it for tax and accounting as its own policy and the law require.

Stripe and our other providers may keep records as their own policies and the law require. Backups roll off on a short cycle of [BACKUP RETENTION PERIOD].

12. Your choices and rights

• Download. Export all your data as JSON from your profile.
• Edit or delete. Change or delete your content at any time.
• Delete your account. Do it from your profile.
• Privacy setting. Switch between public and private, and set each workout's visibility.
• Cancel. Stop your subscription in the Stripe customer portal, reached from your profile.

Depending on where you live, you may have more rights, such as to access, correct, delete, restrict or object, to withdraw consent, or to complain to a regulator. Email [CONTACT EMAIL] and we will respond within the time the law requires. We will not treat you worse for using your rights.

13. Where data is processed

Our providers may process data in countries other than yours, including the United States. Where the law requires it, we rely on approved safeguards for transfers. [TRANSFER MECHANISM, FOR COUNSEL]

14. Security

Data is encrypted in transit. We limit who can access it, and we check authorization on every request. No system is perfectly secure. If a breach affects you, we will tell you as the law requires.

15. Children

Chalk is not for anyone under [MINIMUM AGE]. We do not knowingly collect information from them. If you think a child has an account, email [CONTACT EMAIL] and we will delete it.

16. Changes

We may update this policy. We will post the new version here with a new effective date. For material changes, we will tell you in the app or by email.

17. Contact

[COMPANY LEGAL NAME], [ADDRESS]. [CONTACT EMAIL]. Governing law: [GOVERNING LAW / JURISDICTION].