Privacy policy

About Journey

Journey records your fitness journey and lets you choose what to share with other members. Contact Journey with Shannon at the email below with privacy questions, requests or complaints.

Information you provide

We store your account ID, display name, username, email or mobile login identifier, password hash and account settings. Depending on the features you use, we also store photos, tags, comments, reports, follows, blocks, invitation relationships, Growth rewards, bodyweight, lift logs, exercise libraries, workout plans, saved routines and benchmark results. Your optional country is selected by you; the app does not request your GPS location or address book.

Why we use it

We use this information to provide your journal, sign-in, progress tracking, sharing, recommendations, leaderboards, Growth rewards and safety controls. Session and network information is used to secure the service and limit abuse. Support correspondence is used to respond to your request. We do not sell this information or use it for cross-app advertising tracking.

Public photo comparison

The website photo-comparison teaser processes your chosen photos on your device, without uploading them or sending them to analytics. Preparing a comparison re-encodes the image pixels and removes source EXIF metadata. If you choose Save before signing in, a temporary draft is stored in this browser so you can return after creating an account. The draft expires after 30 minutes and is removed when you return, save, clear the comparison, or next open the tool after expiry. Closing the browser may delay removal of expired local data until the tool is opened again; you can also clear it in your browser settings. Signing up does not add these photos to your account journal. Downloaded images remain on your device until you remove them.

Security request limits

To limit abusive requests, we retain a hashed identifier derived from your network IP address or account ID, a request count and an expiry time. Scheduled cleanup removes these security records after they have been expired for more than a day. We do not use these records to determine your location or identify a device.

Community activity dashboard

We record one activity marker per signed-in account per UTC day and retain these markers for about a month. Authorised moderators can see account names, registration dates, recent active days, overall Growth points, Tree stage and completed referral sign-up counts to understand community use. The dashboard shows unique daily, seven-day and thirty-day users and sign-up trends. It does not expose private journal photos, bodyweight, lift records, Apple Health measurements, login details or individual Growth reward sources. Deleted accounts leave the member list and activity totals; confirmed referral credit already earned by another member can remain. Activity before measurement began or outside the retained period is unavailable.

Optional Apple Health access

On a supported iPhone, you can choose read-only access to bodyweight, daily steps and workout summaries in Apple Health. Access is requested only when you open a Health preview or connect steps. Journey does not write to Apple Health or sync in the background. Workout previews are not uploaded. If you agree to connect steps, Journey stores daily step totals, dates and reading times privately in your account on Cloudflare. A current-day 5,000-step milestone earns 5 Growth, capped to one reward per local date and UTC receipt day; historical readings earn no points. Only the overall Growth total and Tree can appear on your shared profile or cards, never step counts or dates. Step-derived Growth is excluded from email marketing summaries. If you explicitly select bodyweight dates and confirm import, Journey stores those measurements, local dates, source identifiers and source names in your private account. Stable identifiers prevent repeated imports and rewards. Manual weights take priority; imported weights do not earn Growth. Health measurements are excluded from public rankings, share cards, advertising and marketing, including Klaviyo. Remove saved Health imports in Settings or delete your account. Removing imports retains earned Growth and its reward receipt to prevent repeated claims, without retaining removed step counts. Corrected weights remain Health-derived and private. Deleting data in Apple Health does not automatically erase an earlier Journey import. You can revoke access in the Health app. A private account export contains imported records, so protect that file.

Optional watch logging

If you use Journey on Apple Watch or Wear OS, recent private workouts, saved routines, exercise definitions and your weight unit can be copied to your watch so you can log actual sets there. Apple Watch syncs through its paired iPhone without receiving your Journey sign-in credential. Wear OS requires you to approve a pairing code in Journey Settings. Its separate device credential can read your workout library and save workouts; it cannot access your photos, profile, account emails or Health imports. Watch logging does not request additional Apple Health, Health Connect or location permissions.

Wear OS connections

For Wear OS connections, we store the device name and platform, connection and approval times, expiry, last recorded sync and revocation time. Only one-way hashes of the pairing code and device credential are stored on our servers. Pairing codes expire after ten minutes; approved device access expires after ninety days unless revoked sooner. Additional watch request limits use hashed network, account or connection identifiers, counts and expiry times. Expired watch request-limit records are cleaned up during later pairing requests.

Offline workout copies

Both watch apps keep private local copies and unsynced edits for offline use. Apple Watch and its iPhone sync queue use device-protected files excluded from backup. Wear OS stores its credential, cached workouts and retry queue together in encrypted storage excluded from backup. A workout remains queued locally until Journey confirms it was saved; a conflicting change is kept for your attention rather than overwriting a newer record.

Disconnecting a watch

Signing out or changing accounts on the iPhone sends a request to clear its Apple Watch copies. Signing out on your phone does not disconnect a separately linked Wear OS watch; remove that connection in Settings or choose Unlink on the watch. Revocation or account deletion stops further Wear OS server access, but cannot instantly erase copies on an offline watch. The watch must reconnect to receive the change, or you can remove its local app data. Unlinking Wear OS clears its local copies, including unsynced edits. Your account export includes connection metadata, never pairing codes or device credentials.

Who can see your information

Your journal and fitness records start private. Publishing a photo makes it visible to signed-in members, subject to blocks and moderation. You can make your own post private again. Your profile and avatar can be visible to members through your interactions and discovery settings. Leaderboard participation is optional and shares the selected results and country. A referral can reveal that an invited account joined or qualified for a reward, but does not reveal its private photos or records. Moderators can review reported content and the associated safety information.

The public community globe groups optional countries shared by discoverable members who have joined the leaderboards. A country appears only when at least five eligible members share it, and group sizes use broad ranges rather than exact counts. The globe never receives account identities, precise locations or online activity. It does not infer where you live or where you signed up. Keeping your country private, turning off profile discovery or leaving the leaderboards removes you from the next aggregate refresh, within five minutes.

Sharing outside Journey

Share cards include the information shown in their preview, which may include photos, a public username, Growth total and referral link. Account export is a separate full JSON download, without a card preview: it can contain your private login and recovery details, fitness records, photo references, reports and blocks. Keep that file private or share it only with someone you trust. Your login email or mobile is not used as the public referral code. Other apps and recipients receive files only when you choose to share them. Making a post private, blocking someone or deleting an account cannot recall copies already saved outside Journey.

Service providers

Cloudflare provides the hosted application, database and photo storage. When email delivery is enabled, Klaviyo receives the destination email, an event identifier and the minimal information needed for account verification, password reset, security or moderation notices. This may include a single-use action link, expiry, changed public username or rule category, but never photos, bodyweight, training records, passwords, phone numbers, reporter identities or private moderator notes. If you separately opt into a weekly recap, Klaviyo receives aggregate check-in, streak, Growth, tree-stage and follower counts. News and offers require a separate explicit marketing choice for your verified address. Creating an account never subscribes you automatically. Providers may process information outside your country. Other platforms handle files you independently share under their own policies.

Public website and campaign links

Our public landing page loads Google Tag Manager in an isolated frame. We pass only fixed interaction labels, such as which signup button was clicked, the headline version, photo-tool use, FAQ openings and scroll or video milestones. We do not pass account details, form entries, photos, measurements, campaign values or private links. The frame cannot access your Journey cookies, local photo drafts or journal. Analytics and advertising storage are disabled. Google receives the usual network information when its code loads, including your IP address.

Campaign labels may be kept in this browser's session storage and carried into Journey's web signup links. They are not forwarded to the metrics frame. Session storage clears when that browser session ends. Cloudflare processes website requests to deliver and secure the site. Founder photos and records shown on the public landing page are published with the founder's permission; your journal is not used as marketing material automatically.

Storage and security

Records are associated with your account on our servers. Selected photos are resized and re-encoded and their metadata is removed before storage. Sign-in uses protected connections, hashed passwords and revocable sessions. The iPhone app keeps its session credential in the device Keychain; the website uses a session cookie. Appearance preferences and some display settings are stored on your device. No service can promise absolute security.

Your choices and retention

We retain your saved records while your account exists, unless you remove them. Settings lets you edit account details, control discovery and leaderboards, manage blocks, export records and delete your account. Account deletion removes your account and its photos and personal records; failed photo-storage deletions are queued for cleanup. Previously used usernames and invitation codes remain reserved without an account owner to prevent impersonation or reattribution. Growth already earned by another member can remain in that member’s ledger. If you delete an individual photo or lift but keep your account, minimal Growth activity claims and previous lift bests remain to prevent repeated rewards for the same activity. Provider operational logs and any copies you shared elsewhere have separate retention. Contact us for help with access, correction, deletion or a privacy complaint; we may need to verify account ownership.

Reports, decisions and review requests

Reports include your account, the reported item, your selected reason, optional details and submission time. Requests to review a moderation action include your account, the action, your message and submission time. Moderators review the reported target and limited safety context, including account age, previous upheld removals and suspension status. Reporting does not open a member’s private journal or measurement history. Reporter usernames are visible only to authorised moderators. Reporters receive a neutral review outcome; they do not see penalties, moderator identities or private notes. Affected members receive a notice with the rule category and can request one review of each moderation action. A separate moderator decides when one is available. Moderation actions are recorded in an append-only safety audit log, which moderators cannot edit or delete.

Email preferences and delivery records

Security, account and moderation emails are essential service messages for verified recovery addresses when delivery is enabled. Verification is an explicit challenge sent to the address you choose before it becomes trusted. Weekly recaps and news/offers are separate optional choices, both off by default and editable in Settings. Signed recap unsubscribe links affect only that preference. Delivery is retried using a temporary outbox. Recipients and action links are erased after acceptance, expiry or final failure; sent rows are deleted after 30 days, and deletion-confirmation rows immediately after acceptance. A one-way event identifier remains to prevent duplicate sends. Already accepted or delivered mail cannot be recalled; provider records have separate retention.

Account email availability

Settings shows whether email verification and password reset delivery are enabled. Mobile verification and SMS recovery are not currently supported. We never ask you to email your password or a reset code.

Changes

This page describes the current service. We will update it when our practices change. The revision date is shown above.