Privacy Policy

Last updated: 1 October 2026

This policy explains how ChallengersX (“ChallengersX”, “we”, “us”) collects, uses, shares and protects personal information when you use the ChallengersX iPhone app (the “app”) and our website, challengersx.com.au. ChallengersX is based in Australia and handles personal information in line with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Information we collect

Your account

• Your email address and password. Your password is stored only in hashed form by our authentication provider.
• Your display name and date of birth. We use your date of birth to confirm you are old enough to use ChallengersX and to show your age on your challenge card.
• The date you accepted these terms and this policy.
• Your profile photo (avatar), if you add one. You choose it from your photo library.

Your profile and discovery settings

This covers the sports you choose, your challenge card (the terms and friendly stakes you offer), whether you are discoverable to nearby players, and your discovery radius.

Your challenge activity

• The challenges and groups you create, join or are invited to.
• Your goals and targets. Some goals, such as body weight, body-fat percentage or muscle mass, involve body measurements.
• The sessions you log. Depending on the challenge, a session can include body weight, waist measurement, distances and times, exercises, weights and reps, and notes.
• Your scores, streaks and results.
• Stakes you agree to and whether they were settled.
• Likes and passes on other players’ cards.
• Friends and friend requests.
• The chat messages you send in a challenge.

Proof photos and videos

You can attach a photo or video from your photo library as proof. The app only accesses the items you pick; it never uses the camera or microphone. We re-encode photos when they are uploaded, which removes embedded metadata such as GPS location. Videos are stored as uploaded and may contain metadata your device recorded.

Approximate location

We collect this only if you allow it. See section 3.

Apple Health workouts

We collect these only if you allow it and choose to import them. See section 4.

Notifications

If you allow notifications, we store your device’s Apple push notification token so we can send you alerts about your challenges, friends and matches.

Subscriptions

If you subscribe to Premium, we store your subscription status, plan and billing dates. In the iPhone app you pay Apple through the App Store; on our website you pay on our payment provider’s secure checkout page. ChallengersX never sees or stores your card details.

Support and the waitlist

• If you email us, we keep your email address and the messages we exchange.
• If you join the waitlist on our website, we store your name, email address, the sport you choose (optional) and your browser’s user-agent string.

Technical information

When your device connects to our services, our hosting providers automatically record technical information such as your IP address, request times and error logs. We use it to keep the service secure and working.

Body measurements and workout data can be health information, which is sensitive information under the Privacy Act. We only collect it when you choose to provide it, and we only use it to run your challenges.

2. How we use your information

• To create and secure your account, including confirming your email and resetting your password.
• To run challenges: matching you with rivals, scoring, streaks, stats and leaderboards, and showing your activity to the people you compete with.
• To show you nearby players and open challenges, if you are discoverable.
• To send notifications and service emails, such as challenge invitations and results.
• To manage Premium subscriptions and usage limits.
• To respond to support requests and reports.
• To enforce our Terms of Service, moderate content and keep ChallengersX safe.
• If you joined the waitlist, to tell you when ChallengersX launches.

We do not sell your personal information. We do not use it for advertising or share it with advertisers or data brokers, and we do not track you across other apps or websites.

3. Location

ChallengersX asks for location access only while you are using the app. It never uses background location. It takes a single low-accuracy reading at three points:

• when you finish setting up your profile;
• when you open Discover and we don’t yet have your location;
• when your saved location is more than 7 days old.

Your device sends that reading to our server, which rounds it to about 1 km (two decimal places of latitude and longitude) before storing it. Your exact position is never stored.

We use your approximate location to show you nearby players and open challenges within your discovery radius. Inside the app, other people see only an approximate distance (for example, “~3 km away”), never a map position.

You can turn location off at any time in iOS Settings, or switch off “discoverable” so that you no longer appear to nearby players. Your last approximate location stays on your account until it is next updated or you delete your account.

4. Apple Health

• ChallengersX asks for read-only access to your workouts in Apple Health. It never writes to Apple Health and never reads any other Health data.
• Once you have granted access, the app looks at recent workouts on your device when you open the import screen, or when you open the app. It then offers any new workouts to you. Nothing leaves your device unless you choose to import a workout.
• For each workout you import, we store the activity type, start and end time, duration, active energy, distance and Apple’s workout identifier. The last one stops the same workout being imported twice. The workout becomes a session in the challenges you choose, where the other participants can see it.
• Apple Health data is never used for advertising or marketing, never sold, and never shared with third parties except the hosting provider that stores it for us. We never use it for data mining, and we do not store it in iCloud.
• You can revoke access at any time in the Health app or in iOS Settings. Workouts you’ve already imported stay in your challenges until you delete your account.

5. What other ChallengersX users can see

• Anyone with an account can find you by display name and see your display name and avatar. Avatars are stored at a public web address.
• If you are discoverable, nearby players can see your challenge card: display name, avatar, age, sports, approximate distance, and your card’s terms and stakes. The same details are shown to Premium members you have liked, and your display name, avatar and distance appear on any open challenge you post.
• People you share a challenge with (including people invited to it), your friends, and people you have a pending friend request with can see your display name and avatar.
• Other participants in a challenge can see what you post in it: the sessions you log (including any body measurements and imported workout details), proof photos and videos, chat messages, goals, scores and stakes. Anyone with a group’s invite code can join that group challenge.
• Other signed-in users can see your stake record: how many friendly stakes you have lost, settled or left overdue.

These rules are enforced in our database. Proof photos and videos are stored privately and shared through links that expire after an hour.

6. Service providers and overseas disclosure

We use trusted service providers to run ChallengersX. They may only handle your information to provide their service to us.

• Supabase: our database, sign-in, file storage and server functions. Your account and app data are hosted in Sydney, Australia (AWS ap-southeast-2).
• Resend: sends our emails (account confirmation, password reset, challenge invitations, waitlist and support replies) and receives email sent to our support address.
• Google Workspace: hosts our email domain and the support inbox.
• Apple: delivers push notifications (Apple Push Notification service) and provides Apple Health on your device.
• Apple: Premium bought in the iPhone app is sold and billed by Apple through the App Store. Apple tells us about those purchases (renewals, cancellations and refunds) so we know whether your subscription is active, and we keep a record of them against your account.
• Chargebee and Stripe: manage subscriptions and process payments. When you create an account, we create a billing record for you at Chargebee containing your email address and account ID, so you can upgrade later. Payments are made on Chargebee’s hosted checkout and processed by Stripe.
• Cloudflare: hosts our website, and its Turnstile service protects the waitlist form from bots. Turnstile processes your IP address and browser information to do this.
• Google Fonts: our website loads its fonts from Google, which receives your IP address when it does.

Your core account and challenge data is stored in Australia. Some of the providers above (Resend, Google, Apple, Chargebee, Stripe and Cloudflare) store or process information in other countries, including the United States. When we disclose personal information overseas, we take reasonable steps, through our agreements with these providers, to make sure they handle it consistently with the Australian Privacy Principles.

We may also disclose information if the law requires it, or where it is reasonably necessary to protect someone’s safety or to investigate a serious breach of our terms.

7. Security

Information is encrypted in transit (HTTPS). Access is controlled in the database, so each person can only reach the data they are allowed to see. If you turn on Face ID lock, iOS handles Face ID entirely on your device; we never receive biometric data. No system is completely secure. If a data breach is likely to cause you serious harm, we will notify you and the Office of the Australian Information Commissioner, as the Notifiable Data Breaches scheme requires.

8. Retention and deleting your account

We keep your information while your account is active.

You can delete your account at any time in the app: go to the Profile tab, scroll to Danger zone and tap Delete my account. Deletion is immediate and permanent. It:

• deletes your account, profile, avatar, challenge participation, sessions, chat messages, proof photos and videos, likes and passes, friendships, push tokens and subscription record;
• cancels any active web subscription and deletes your billing record at Chargebee.

Deleting your account does not cancel an App Store subscription, because Apple bills it. Cancel it in your App Store account settings.

Challenges you created that other people took part in stay available to them, but are no longer linked to your account. A challenge title that was generated from display names may still include yours.

Some information is kept separately:

• records of notifications and emails we have sent, and our email provider’s delivery logs, may be kept for a period after deletion;
• support emails and waitlist sign-ups are kept until you ask us to delete them;
• backups are overwritten on our providers’ normal cycle.

To have any of this removed, email us.

To get a copy of your data, tap Export my data on the Profile tab. The export includes your profile, challenges, sessions, messages, friendships and media records. For anything the export doesn’t include, such as your email address or your photo and video files, email us.

9. Your rights

You can ask to access or correct the personal information we hold about you. You can change your display name and avatar in the app at any time. For anything else, email support@challengersx.com.au. We will respond within 30 days.

If you have a privacy complaint, contact us first and we will try to resolve it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

10. Age requirement

ChallengersX is only for people aged 16 and over. We ask for your date of birth when you sign up and do not let anyone under 16 create an account. If we learn that we hold information about someone under 16, we will delete it. If you believe a child is using ChallengersX, please contact us.

11. Changes to this policy

We may update this policy as ChallengersX changes. We will post the new version here and update the “Last updated” date. If a change is significant, we will also let you know in the app or by email.

12. Contact us

For questions, requests or complaints about privacy, email support@challengersx.com.au.