Privacy Policy

Effective September 19, 2026

ProofDays ("we", "the app") is a habit and fitness-challenge tracker. This policy explains what we collect, why, and what control you have.

What we collect

• Account: when you sign in with Apple, Google, or email, we store a user ID, your display name if you share it, and your email address for magic-link sign-in.
• Challenge data: the exercises, targets, durations, daily check-ins, counts, and notes you enter.
• Photos: before, after, and progress photos you take in the app. They are stored privately and are visible only to you unless you explicitly publish a proof card.
• Proof cards: when you tap "Create public link", the rendered card image is submitted for safety review. Once approved, the card and its stats become viewable by anyone with the link. Contact us to request removal of a public card. Abandoning a challenge does not automatically remove its public card.
• Partner and group data: if you accept an invite or join a group, the people in that pairing or group can see your display name, daily check-in status, streak, and days completed for that challenge. They never see your photos.
• Safety: we store private reports, the reported shared content, block relationships and moderation decisions to investigate abuse and enforce our community guidelines. Only authorized moderators can read reports. Private daily notes and device-only photos are not included in report snapshots. Shared challenge images, video links and public card images are reviewed before being made available to others.
• Device token: if you enable notifications, we store your Apple push token to deliver partner check-in alerts.
• Subscription status: whether you have an active ProofDays Plus subscription, received from Apple. We never see your payment details.
• Usage analytics: privacy-preserving usage events collected with TelemetryDeck (for example "challenge created", "card shared") without your name, email, photos, notes, or challenge text, used to understand which features work.

What we don't do

• We don't sell your data.
• We use your photos to show them to you, render cards you request review images you choose to share through ProofDays for safety, and provide AI comparison when you explicitly agree.
• We don't run ads or share data with ad networks.

Where data lives

Data is stored with Supabase (Postgres and object storage) in Frankfurt, Germany, protected by row-level security so each user can only access their own records and what partners or group members are permitted to see.

Optional AI photo comparison

Only after you agree, we send resized before and after photos to OpenAI to describe visible differences. We do not send daily photos, your account name or email. The written analysis is saved privately in your account and is not included in shared cards. OpenAI API content is not used for training by default; safety logs may be retained for up to 30 days, subject to OpenAI’s data policies. Deleting your account removes the saved analysis. Anonymous request counts remain for budget control. AI can make mistakes and does not measure health or physical progress.

Safety records

Blocking hides signed-in social content between the accounts. Public links remain accessible without signing in, so blocking cannot make an already public card private. Reports and moderation records may be retained after account deletion to investigate abuse; account references are removed, but submitted report text and shared-content snapshots may still contain personal information. Contact us to request review or deletion of these records.

Your rights

To request deletion of a challenge, its photos, or your entire account and data, email privacy@proofdays.com from your account email; we complete deletion within 30 days. You may also request an export of your data.

Children

ProofDays is not directed at children under 13 and we do not knowingly collect data from them.

Changes

We'll update this page and the effective date when the policy changes. Material changes will be announced in the app.

Questions: privacy@proofdays.com. ProofDays was previously called ProofRep; the @proofrep.com addresses printed in older versions of the app still reach us.