Privacy Policy

Gauntlet Challenge

Version 1.0 — Effective 20 July 2026

Policy version	1.0
Effective date	20 July 2026
Applies to	The Gauntlet Challenge mobile app and website (gauntletchallenge.com)
Canonical source	The website and in-app versions display this same version and effective date.

1. Who we are

Gauntlet Challenge is operated by Gauntlet Challenge Ltd (company no. 17273370), 5 Brayford Square, London E1 0SG. We are the data controller for the information described here. For anything about your data, contact privacy@gauntletchallenge.com.

We are registered with the Information Commissioner’s Office (ICO), the UK’s data-protection regulator — registration reference ZC198845. You can check our entry on the ICO’s public register of fee payers at ico.org.uk.

2. Our approach to your data, in one paragraph

Gauntlet Challenge is built to share activity with a small, trusted group — not to broadcast, rank, or track you. Most of what you post disappears automatically after about 24 hours. We never sell your data. We never pass anything about you to sponsors. We do not build advertising profiles of you. We do not run facial recognition on your photos. We collect the least we can to make the app work, and we tell you plainly what that is below.

3. What we collect, and why

Information you give us when you sign up and use the app:

Your first name — used to show who posted or commented within a challenge. It is how you appear to the people you share with.
A short fitness-identity description (up to 20 characters, e.g. ‘slow runner’) — a self-description you write and can change any time.
A profile image (optional) — you can set one, but you don’t have to; the app works fully without it and shows a simple coloured initial instead. If you add one, we store and display it only — to show who you are within your challenges. We do NOT run any facial recognition, face detection, or other biometric processing on it, ever.
Your month and year of birth — collected once, only to confirm you are 18 or over. It is never shown to anyone, and never used for anything else. It is stored separately from the rest of your profile.
Your email and sign-in identifier (via Google, Apple, or email) — to create and secure your account.

Your device’s time zone — so that Daily Challenges appear at the right time for wherever you are. We read it from your device; we don’t ask you to enter it.

Information created as you use the app:

Your activity updates, comments and reactions — shared only with the participants of the specific challenge they belong to. These normally disappear automatically after about 24 hours.
Your saved completions — your own private record of what you’ve done. Private by default; you can delete any of them at any time.
Subscription and gift-purchase information — handled through Apple, Google and our billing provider, to run your membership or a membership you gift.
Limited technical and usage data — to keep the app working and understand whether features are useful (see section 6).

4. What we do NOT do

We do not sell your data — to anyone, ever.
We do not pass anything about you to sponsors. Sponsorship is tied to the type of activity or the part of the app you’re in — never to you. This is built into our systems, not just a promise we could quietly change.
We do not build an advertising profile of you.
We do not run facial recognition or any biometric processing on profile images.
We do not import your data from other fitness apps or trackers.
We do not rank, score, or compare you against anyone.

5. Who can see what you share

Everything you post belongs to a specific challenge, and only that challenge’s accepted participants can see it. There is no public feed and no friends-wide feed. Within a challenge, content is either ‘shared’ (visible to that challenge’s participants) or ‘private’ (just you).

Sharing outside the app: you can choose to export your OWN content (for example, to Instagram or WhatsApp). That is always your deliberate choice, one item at a time. When you do, the exported copy leaves the app and we no longer control it. You can never export someone else’s content. Please make sure you have other people’s agreement before sharing anything that shows them.

6. Analytics — how we measure the app

We use privacy-respecting analytics (PostHog, hosted in the EU) in two separate streams that we never join together:

A usage stream that tells us whether features work — tied to a random ID, not to your name, age, or any personal detail. It answers ‘did this account come back’, never ‘did this particular person come back’.
An aggregate view (planned for later, not at launch) that would only ever show grouped totals, never anything that identifies an individual.

Because the two are never joined, we cannot — and do not — build a profile of you from analytics.

7. How long we keep things

Activity updates and comments: about 24 hours, then deleted automatically.
Reported content: if something is reported, we keep it for a limited period to review it fairly and handle any dispute, then delete it. In rare cases where the law requires it (for example, a legal claim or a request from the police), we keep specific content longer until the matter is resolved, then delete it.
Your profile image, first name and description, saved completions, and account: until you change them or delete your account.
Your month and year of birth: kept as a record that we checked your age.
If your membership ends and you don’t continue: we keep your account — your name, your connections, and your saved completions — for 6 months, so that if you come back, the people and the record you built are still there. (Your day-to-day activity posts will already have disappeared on their usual 24-hour cycle.) If you haven’t returned within 6 months, we delete the account and its data automatically. You can also delete it yourself at any time, sooner.

If you take part in a challenge with others: you and the people in that challenge can choose to connect. We work this out from the challenge you’re both in — we do not create or keep a separate record of who you met. What you posted in the challenge still disappears on its usual 24-hour cycle.

8. Where your data is held

Your data is stored in the United Kingdom (London) with our database provider. Some of our service providers (listed in section 9) may process limited data outside the UK; where they do, we rely on approved safeguards such as the UK’s International Data Transfer Agreement. Our database provider is part of a US-headquartered group; this does not change where your data is stored (the UK), and we hold it under a data-processing agreement and keep the amount of data we hold to a minimum.

9. Who we share data with (our service providers)

We use a small set of trusted providers to run the app: Supabase (database, EU), PostHog (analytics, EU), RevenueCat and Apple/Google (payments), Nuntly (email, EU), Sentry (error monitoring), and Zammad (support). Each handles your data only on our instructions under a data-processing agreement. We never give them permission to use your data for their own purposes.

10. Your rights

You can ask to see your data, correct it, delete it, get a copy to take elsewhere, or object to certain uses. You can delete your account at any time from Settings, which removes your data — except anything we are required by law to keep. Where the law allows us to tell you what we have kept and why, we will. To exercise any right, contact privacy@gauntletchallenge.com. You can also complain to the Information Commissioner’s Office (ico.org.uk), though we’d appreciate the chance to put things right first.

11. Age

Gauntlet Challenge is for people aged 18 and over. When you sign up we ask for your month and year of birth, only to confirm you are 18 or over — it is never shown to anyone and never used for anything else. If what you enter shows you are under 18, you cannot create an account, we do not keep what you entered, and you cannot simply re-enter a different date to get around this.

12. Changes to this policy

We may update this policy from time to time — for example, if we add a feature or change how something works. When we do, we will change the version number and effective date at the top. If a change is significant, we will tell you in the app before it takes effect, so you have a chance to read it. Smaller wording or clarification changes may be made with an updated date. The current version always applies; you can view it any time in the app and on our website.

13. How to contact us

For anything about your data or this policy, email privacy@gauntletchallenge.com. We aim to respond within the timeframes the law sets (usually within one month).