Skip to content
Home

Privacy Policy

Last updated: October 22, 2026

1. Introduction

FitClash ("we", "our", "us") runs fitclash.app. This policy explains what data we collect, why, who else handles it, how long we keep it, and how you can delete it.

2. Data We Collect

Your account

You can sign up with an email and password, or sign in with Google.

  • Email sign-up: your email, display name and password. We store passwords only as a one-way hash (Argon2), never in readable form.
  • Google sign-in: your name, email address, Google account ID and profile picture. Each time you sign in with Google we refresh these from Google. We never see your Google password.
  • Email checks: a 6-digit verification code (valid for 15 minutes) and, if you ask for one, a password reset link (valid for 1 hour). Both are removed once used.
  • Settings: your weight unit (lb or kg), whether you have Pro, and whether you are a FitClash admin.

If you join without an account

You can submit scores without signing up. We store:

  • The display name you type
  • Your scores and any comment you add
  • A random device token kept in your browser's local storage. It lets you edit or delete your own scores and challenges from that browser. If you sign up later, we can move that content to your account.

What you create

  • Challenges (WODs), battles, training sessions, and the scores and comments posted on them
  • Athlete names a battle organiser adds to a battle
  • Personal records you log
  • Your mascot's look (body, face, hair, colours, outfit)

Mascot from a photo

If you build your mascot from a photo, the photo is processed on your device and never uploaded to FitClash. To do this, your browser downloads a face-detection model from jsDelivr and Google's file storage, which see an ordinary download request.

AI assistant

When you chat with the assistant, your messages, your display name and the FitClash data it looks up to answer (such as your scores, battles, sessions and stats) are sent to Anthropic, which runs the Claude model that writes the replies. We don't store the conversation. We keep only a count of how many messages you sent each day, to apply the daily limit. The chat stays in your browser tab until you close it.

Daily challenges and the workout generator also use Anthropic. They don't include any personal data.

Payments

Stripe handles Pro subscriptions. You pay on Stripe's page, and we give Stripe your email to set up your customer record. We store your Stripe customer ID, whether you have Pro, when it renews or ends, and whether it is set to cancel. We never see or store card numbers.

$CLASH and video verification (limited access)

If you take part in $CLASH rewards, we also collect:

  • Workout videos. Stored privately on Cloudflare R2. Up to 5 randomly chosen FitClash users, acting as reviewers, watch a video to verify the attempt, through links that stop working after 10 minutes. With each video we keep the workout, the score you claim, and the recording date and length from the file. We don't read location data from it. You must confirm you are 16 or older to upload.
  • Test videos. If you agree, a video can be kept as an anonymised test video for training and checking reviewers.
  • Reviews. Votes and verdicts from reviewers, and any appeal you write.
  • Your wallet. The wallet address you link to your account. Rewards claimed on the Base blockchain are public, and no one, including us, can delete them.
  • Referrals. Who referred whom, the referral code, and a hashed (scrambled) IP address from sign-up to spot fake referrals. A referral link sets a cookie for 30 days.
  • Reviewer invites. If an admin invites you to review, the invite may include your email address.

IP addresses and logs

  • We use your IP address to limit how many requests one connection can make. This happens in memory and isn't saved.
  • When you sign in, we store a hashed version of your IP address for 30 days to detect abuse of referral rewards.
  • Our server logs record requests, such as which page or API address was called. A log line includes your IP address when a request is blocked for abuse.
  • Our server sends error reports to Sentry. These don't include your cookies or password, but an error message can occasionally contain an IP or email address.

Usage Analytics

We count visits and a few actions (creating a challenge, submitting a score, sharing a link, signing up) with Umami, a privacy-focused analytics tool. It sets no cookies, doesn't store your IP address, and doesn't follow you across other websites. It records the page, referring site, browser, device type and country, and we only see aggregate totals. We never send it your name, email, display name, scores or tokens, and page addresses are recorded without their query strings.

3. How We Use Your Data

  • To run FitClash: show leaderboards, save your challenges, battles and records, and keep you signed in
  • To send the verification codes and password reset links you ask for
  • To answer your AI assistant messages
  • To process Pro subscriptions
  • To verify workout videos and pay out $CLASH rewards
  • To find and fix errors, and to stop spam and abuse

We do not sell your personal data, and we do not share it for advertising.

4. Health and Fitness Information

Your scores, workout results, personal records and videos can reveal information about your fitness and body. We use them only to run FitClash. Scores you post on a challenge are visible to anyone with its link. You can delete them at any time.

5. Who Handles Your Data

We use these services to run FitClash. Each gets only what it needs for its job:

  • Railway hosts our app and database.
  • Cloudflare sits in front of the site, stores workout videos (R2) and runs the bot check on sign-up (Turnstile), which sees your IP address.
  • Google signs you in if you choose Google sign-in.
  • Anthropic generates AI assistant replies and daily challenges.
  • Stripe handles Pro payments.
  • SendGrid sends verification and password reset emails. These are the only emails we send.
  • Umami counts visits, without cookies or personal data.
  • Sentry receives error reports from our server.
  • Base, a public blockchain, records claimed $CLASH rewards.

6. Cookies & Local Storage

  • Session cookie: keeps you signed in for up to 30 days (HTTP-only, secure, same-site).
  • Google sign-in cookies: two short-lived cookies that protect the sign-in step and expire after 10 minutes.
  • Referral cookie: remembers a $CLASH referral code for 30 days.
  • Local storage: device tokens, your recent activity, your display name and a few preferences, kept in your browser.

We don't use advertising or tracking cookies. Our analytics (Umami) is cookieless.

7. Do Not Track and Global Privacy Control

We don't track you across other websites, show ads, or sell or share your data, so there is nothing to opt out of. The site works the same whether or not your browser sends a Do Not Track or Global Privacy Control signal, because it already does what those signals ask.

8. How Long We Keep Data

  • Account data: until you delete your account.
  • Anonymous scores and challenges: until you, or the challenge's creator, delete them.
  • Sign-in sessions: 30 days.
  • Hashed sign-in IP addresses: 30 days.
  • Workout videos: deleted 30 days after the final verdict. Uploads that were never submitted are deleted 2 days after the attempt expires. Videos you agreed to share as anonymised test videos are kept with no fixed end date; email us to have one removed.
  • Server logs and backups: kept for a limited period, then deleted.
  • Payment records: Stripe keeps these as tax and accounting law requires.

What deleting your account removes

Deleting your account permanently removes:

  • Your profile and sign-in
  • Your scores and personal records
  • Workout videos you uploaded
  • Challenges and battles you created, including other people's scores on them

An active Pro subscription is cancelled. Wallet links and rewards already recorded on the blockchain stay public, and Stripe keeps its payment records for tax purposes.

9. Security

All traffic uses encrypted connections (HTTPS). Passwords are hashed, and the session cookie can't be read by scripts on the page. No system is perfectly secure, but we work to protect your data and keep access to it limited.

10. Your Rights

You can:

11. Children's Privacy

FitClash is not directed at children under 13. We do not knowingly collect personal data from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this policy. When we do, we change the "Last updated" date at the top of this page. If you keep using FitClash after a change, the new version applies.

13. Contact

For privacy questions, data requests or account deletion, email [email protected].