Privacy Policy

1. Information we collect

Information you provide

• Account information: email address, password (stored in hashed form by our authentication provider), and, if you sign in with Google, your Google account identifier.
• Profile information: display name, username, avatar image, time zone, and preferred challenge tone.
• Challenge content: challenges and goals you create, check-in photos and notes, reactions, votes, and messages you send within the Service.
• Communications: information you send us, such as support requests.

Information collected automatically

• Usage data such as pages viewed, features used, and timestamps of check-ins, generated by your use of the Service.
• Device and log data such as IP address, browser type, and general diagnostic information collected by our hosting provider for security and reliability purposes.

2. How we use information

• To create and maintain your account and operate challenge features (goals, check-ins, points, streaks, leaderboards, feed, and notifications);
• To send transactional emails, such as challenge invitations and account notices;
• To generate the Service's AI-driven "roast" messages and recaps, which use your challenge activity (and, when you request it, a check-in photo) as input;
• To maintain the security, integrity, and proper functioning of the Service; and
• To comply with legal obligations.

We do not use your information to serve third-party advertising, and we do not sell your personal information.

3. Who we share information with

We share information with the following categories of service providers, solely to operate the Service on our behalf:

• Hosting, authentication, database, and file storage (Supabase) — stores your account, profile, challenge, and check-in data, and check-in photos.
• Application hosting (Vercel) — runs the Service and its scheduled jobs (such as daily reminder emails).
• Transactional email delivery (Resend) — sends account and challenge-related emails on our behalf.
• AI text and image processing (OpenAI) — generates roast messages and recap text; when you request an AI reaction to a specific check-in, the associated photo may be sent for that purpose.

We also share information with the other members of a challenge you join, to the extent necessary for that feature to work — for example, your check-in photos, notes, points, and streak are visible to your fellow challenge members by design.

We may disclose information if required by law, to protect the rights, property, or safety of Outworked or others, or in connection with a merger, acquisition, or sale of assets.

4. Data retention

We retain your information for as long as your account is active, and for a reasonable period afterward to comply with legal obligations, resolve disputes, and enforce our agreements. You can request deletion of your account and associated data as described in Section 6 below.

5. Data security

We use reasonable administrative, technical, and physical safeguards designed to protect your information, including access controls at the database level. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

6. Your rights and choices

You can review and update most of your profile information directly in the app under Profile settings. To request a copy of your data, request deletion of your account, or ask a question about this policy, contact us at support@outworked.app. We will respond within a reasonable time and verify your identity before fulfilling the request.

California residents: Under the California Consumer Privacy Act (as amended), you have the right to know what personal information we collect, request deletion of it, correct inaccurate information, and opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined by the CCPA. You may exercise these rights using the contact information above, and we will not discriminate against you for doing so.

7. Children's privacy

The Service is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact us at support@outworked.app and we will delete it.

8. International users

Our service providers operate infrastructure located in the United States. If you use the Service from outside the United States, your information will be transferred to and processed in the United States.

9. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and, where appropriate, notify you in the app.

10. Contact

Questions about this policy can be sent to support@outworked.app.