Privacy Policy

Privacy Policy for Flowstake.com

Last Updated: November 17th, 2026

This Privacy Policy is part of our Terms and Conditions. Please read both documents carefully before using our Platform.

Plain-English Summary: FlowStake collects your GPS location and activity data to verify athletic performance. We use Supabase for database storage and Mapbox for maps, and Google Analytics to measure how our website and app are used (Section 6.2); if you subscribe to FlowStake Pro on the web, Stripe processes your payment and receives your email address, name and payment details (Section 1.11). On iOS you can optionally connect Apple Health so your Watch workouts, heart rate and step counts count toward your activities — that data is used only for fitness features, never for advertising, and never sold (Section 1.5). If you turn on presence checks, your phone's screen lock confirms it is you during an activity and your face, fingerprint or PIN never leaves your device (Section 1.7b). When you record a group activity with others in the FlowStake mobile app, your phone uses Bluetooth to confirm the people in your group are nearby, only while you are recording (Section 1.7c). If you start or join an open run, people you have not met can join it with its code, your phone witnesses theirs the same way or when you scan each other's code, and a signed-in user can see how the run was handed on and who carried it, with your name only if your profile and that recording are public (Section 1.7d). If you tap a FlowStake checkpoint tag while signed in, we record which checkpoint, when, and your account (Section 1.7e). New activities are visible to your friends unless you change that; if you make an activity public, a preview card with your name, the activity's numbers and a route image with the start and end trimmed may appear when its link is shared, and we count shares you make from the app, never where they go. Photos you add to an activity are shown to the people who can see that activity, and anyone who has a photo's web address can open it (Section 1.6a). We publish cryptographic fingerprints of activity records so verification can be checked independently — a fingerprint reveals nothing about you. If you apply to sponsor a challenge, what you send is read only by FlowStake staff and is never published (Section 1.10). We do not sell your data. You can export or delete your data at any time.

1. Information Collection

1.1 Required Information

• Email address
• Your confirmation that you are 18 or older, which you give when you accept the Terms
• A record of each time you accept the Terms: which version you accepted and a fingerprint of its exact text, when, on which screen, and the IP address and browser or app details of that request (Section 8.5)
• Activity data
• Location data (during activities)

We do not require your date of birth. You can add it in Settings if you choose; if you do, we use it only to confirm you are 18 or older, and the date itself is not shown to anyone. (This paragraph is pending final legal review.)

A wallet address is not required and is collected only if you choose to connect one (Section 13.2) or to sign in with one (Section 13.3). We do not currently collect identity documents. If a future feature requires identity verification, we will update this Policy before you can use that feature.

1.2 GPS and Location Data

When you record an activity, FlowStake collects precise GPS coordinates, altitude, timestamps, and derived metrics (speed, pace, distance) for the duration of your session. This data is used exclusively to:

• Verify that your activity meets the challenge completion criteria
• Detect anomalous data that may indicate fraudulent submission (Section 1.7)
• Generate route maps shown on your activity detail page, and route previews for activities you make public (Section 1.6)

You can record an activity before you have an account. Until you sign in to
save it, the recording stays on your device only: nothing is uploaded, and
discarding it deletes it from the device. When you sign in, the recording is
saved to your account like any other, and the time it started is kept as
described in Section 2.1. (This paragraph is pending final legal review.)

GPS tracks are stored in encrypted form in our database. They are never sold to third parties and are not used for advertising. You may request deletion of your GPS tracks at any time; note that published fingerprints (hashes) of your activity records, and any on-chain attestations you opted into, cannot be deleted because they are designed to be permanent — a fingerprint reveals nothing about the content it describes (Section 1.8).

1.2a Your U.S. State

When you use FlowStake, our web host (Netlify) looks up the U.S. state your internet connection appears to come from, and the app saves that state to your profile. We use it only to decide whether a money feature may be offered where you are. It is not shown to anyone and is not used for anything else. Because it reaches us through the app, we keep it as something you reported, not as proof of where you are: it is stored apart from the state our systems rely on, and no money feature is offered to you until your state has been confirmed by our own systems. Every money feature is off today. (This paragraph is pending final legal review.)

1.3 Optional Information

• Profile picture
• Social connections
• Device specifications
• Fitness preferences
• Performance metrics
• Training history
• A streaming channel handle, if you choose to link one (Section 3.2)
• Privacy zones, if you set any: a name, a centre point and a radius for each (Section 1.6)
• Photos you add to an activity (Section 1.6a)
• Official race-result details you choose to match to an activity (provider, external race and result identifiers, bib if you give it, official start and finish times, official distance, and optional split times) — used only for verification corroboration and verifier calibration (Section 1.7a)

1.4 Health and Wearable Data

FlowStake collects "consumer health data," including precise GPS location,
heart rate, step counts, cadence, and activity/workout metrics. With your
explicit, separate opt-in consent, we may also import workouts from connected
sources you authorize, such as Apple Health (Apple Watch), or read heart rate
from a Bluetooth heart-rate monitor you choose to pair. We collect this data
only after you grant consent in the app and only to provide activity tracking,
challenge verification, and the features you use. We do not sell your health
data, use it for advertising, or disclose it to other users beyond your chosen
sharing setting (your activities default to friends-only and are shown publicly
only if you choose). You can withdraw consent, change sharing, or delete this
data at any time (see Section 4); deletion is completed within 45 days, except
for published fingerprints and on-chain attestation hashes that are immutable by
design. These practices are intended to align with the FTC Health Breach
Notification Rule and U.S. state consumer-health-data laws (e.g., the Washington
My Health My Data Act). (This section is informational and pending final legal review.)

1.4a Perceived Effort (optional)

After you save an activity, FlowStake may ask how hard it felt, on a scale of 1
to 10. Answering is optional, never required to save, and you can change or
clear your answer later from the activity page. We treat it as consumer health
data under Section 1.4. It is:

• Private to you. It is not shown to your friends or the public, is not on
  the feed or any board, and is not included in images or links you share.
• Self-reported. It is never used to verify an activity, to score a
  challenge, or in your Flowstake Score.
• Not shared or sold. It is not sent to any third party other than our
  database provider (Section 3.2).
• Deleted with the activity. Deleting the activity, or your account,
  deletes it (Section 8.2).

(This section is informational and pending final legal review.)

1.4b Paired Wrist Devices and the Wrist Code (optional)

If you pair a FlowStake watch app (for example on an Apple Watch) with the
FlowStake app on your phone, the watch creates a signing key that never leaves
the watch, and we store only the matching public key, the device model
name and its software version, and when the pairing was made, last used, or
removed. During an activity you record, the watch may show a code that changes
every 15 seconds. When your own phone, or another FlowStake athlete's phone,
scans that code, we store the activity it was scanned for, which pairing signed
it, the 15-second window it was shown in, whether it was scanned or typed in,
which athlete scanned it, and the fingerprint of your activity's recording at
that moment. We use these records only to check that the paired device was
with the phone during the activity (Section 1.7). They never contain your
location, your heart rate, or the athlete who scanned it in any public view;
another athlete who scans your code learns nothing about you beyond what they
already see on your wrist. While the watch app is running a workout it reads
heart rate, step count and cadence, elevation, and a coarse (once-a-minute)
position from the watch's own sensors and sends summaries of them to your
phone, where they are stored with your activity under Section 1.4; the watch
never sends continuous motion-sensor recordings, and we never read sleep,
blood oxygen, skin temperature or electrocardiogram data. You can remove a
pairing at any time in Settings; removing it stops all future wrist codes and
deletes the key from the watch, and the records already attached to your
activities are deleted with those activities or with your account (Section 8.2).
(This section is pending final legal review.)

1.5 Apple Health (HealthKit) on iOS

The FlowStake iOS app can read from Apple Health — but only after you
explicitly grant permission in the iOS Health permission sheet. It does not
write anything to Apple Health. Apple Health
access is entirely optional: FlowStake's core features work using the app's
own GPS recording, and nothing is read from Apple Health unless you turn it on.

What we read (only the types you authorize): workouts, heart rate, step
count, walking/running distance, active energy burned, and workout routes. When
you save an activity recorded in FlowStake, we may read heart rate from an
Apple Watch workout that overlapped it, so that heart rate appears alongside
your activity.

Daily step totals. If you turn on Daily step count (Settings → Apple
Health), the app reads one step total per calendar day for the last 30 days
from Apple Health and stores it with your account, refreshing it when you open
the app. Steps you typed into the Health app by hand are left out. We use these
totals only for your step goals, your step-based challenges and the personal
daily target we suggest from your recent days. They are private: only you can
see them; they never appear on the feed, on leaderboards or on your public
profile. Turning Daily step count off deletes every stored total, and deleting
your account deletes them too. (This item is pending final legal review.)

Sync log. Each time the app reads from Apple Health — automatically, when
you tap Import, or for daily steps — it keeps a short technical record with your
account: when it ran, which build of the app ran it, how many workouts or days
it imported, skipped or could not import, and the technical reason when
something failed. The record contains no health data (no workout, heart-rate or
step values). Only you can read it, we use it only to find and fix import
problems, and it is deleted with your account. (This item is pending final
legal review.)

Why we read it: so activities recorded on your Apple Watch or in other apps
count toward your FlowStake challenges, streaks, and step goals, and so heart
rate and distance appear alongside your activity.

Limits we hold ourselves to. Data obtained from Apple Health is used only
for the health and fitness features described above. Specifically, we do not:

• use it for advertising, marketing, or any advertising-related purpose;
• sell it, or share it with data brokers or advertising networks;
• disclose it to any third party without your separate permission, other than
  the infrastructure providers listed in Section 3.2 who process data on our
  behalf under contract;
• use it to train machine-learning models; or
• use it for any purpose other than health, fitness, or activity verification.

Verification note. Activities imported from Apple Health are treated as
lower-assurance than activities recorded live in FlowStake, because any app can
write to Apple Health. Imported activities are labelled as imported and may not
be eligible for verification tiers that require first-party GPS capture.

How to turn it off, and what happens. You can revoke access at any time in
iOS Settings → Privacy & Security → Health → FlowStake, or by disconnecting
Apple Health in FlowStake's settings. Revoking stops all future reads
immediately. Activities already imported into your FlowStake account remain in
your account until you delete them — delete individual activities, or delete your
whole account (Section 4), which removes them. Revoking access in iOS does not,
by itself, delete data already imported.

1.5a Strava (optional connection)

Not offered today. The app does not currently show a way to connect Strava.
This section describes what happens if that connection is offered again.

If you choose to connect a Strava account, FlowStake can import your Strava
activities and send activities you recorded in FlowStake to Strava. Both
directions are optional and happen only when you tap the button.

What we import: for each Strava activity, its name, type, date, distance,
moving time, elevation, start and end point, and — where Strava has them —
average and maximum heart rate. We keep the access token Strava issues so the
import can continue without asking you to sign in again.

How imported activities are treated. Imported Strava activities are
private to you: they never appear on the feed, the public board, the live
map, or anyone else's screen, and they are not counted as verified. They are a
record of your history, shown only to you, and FlowStake never uses them to
train machine-learning models or for advertising.

Disconnecting removes the tokens immediately. Activities already imported
stay in your account until you delete them — individually, or by deleting your
account (Section 4). Strava's own handling of your data is governed by
Strava's privacy policy.

1.6 Sharing, Public Activities, and Link Previews

Each activity has a visibility you control: only you, friends, or
public. New activities default to friends. What each setting means:

• Friends: visible to accepted friends in the app.
• Public: visible to anyone using FlowStake, and eligible for the public
  activity feed and the public stakes board. When a public activity's link is
  shared — in a message, a social post, or anywhere a link preview is generated
  — FlowStake serves a preview card containing your name, handle and profile
  photo as they appear on your public profile (if your profile is hidden, the
  card says "A FlowStake athlete" instead), the activity's title, type, date,
  distance, pace or speed, time and climb in the units you chose, its proof
  tier when it has one, and a route image. The route image always has the
  start and end of your route removed, and neither the card nor the route
  is ever generated for friends-only or private activities. If you turn on
  "hide map" for an activity, the card carries no route image at all.
  Previews never include photos. Any app or service that fetched a preview
  keeps the copy it fetched.
• Sharing from the app: when you share an activity, post, challenge or
  profile from the app — through your phone's share sheet, by saving a card
  image, or by copying a link — we record which item you shared, from which
  screen, by which of those methods, and when. We never record where you sent
  it or to whom. We use this only to understand which sharing features are
  used; it is deleted with your account (Section 8). (This item is pending
  final legal review.)
• Saving to Photos: on iPhone, Save Image and file exports open the phone's
  share sheet. If you choose to save to Photos there, iOS asks for permission
  to add images to your library. FlowStake only adds the file you chose; it
  never reads your photo library to do this.
• Live map: while you are recording an activity you have set to public,
  FlowStake may show that you are currently active on a live map. Your position
  on that map is deliberately coarse — rounded to roughly one kilometre — and
  is refreshed no more often than every ten seconds; your exact position never
  leaves your device for this purpose. You can hide yourself from the live map
  with one tap at any time, and your profile can opt out of it entirely.
• Territory map: once an activity you have set to public has been
  verified, the map cells it crossed count toward a seasonal territory map
  that other signed-in FlowStake users can see. Anyone visiting flowstake.com,
  signed in or not, can also see which cells have been covered this season
  and whether more than one athlete covered each, but never who covered a
  cell or how many times. Cells are hexagons of equal area, about 1.2
  square kilometres each (roughly 1.2 kilometres across), which is never
  smaller than the live map's cell anywhere on Earth — so the territory map
  never shows a route, a start, an end, or anything finer than the live map
  already does. It does show, for the current season, which cells you
  have been through and how many times, and names you as the holder of a
  cell when you have visited it more than anyone else. Only public, verified
  activities count; friends-only and private activities never do. Changing an
  activity to friends-only or private, or deleting it, removes its cells
  immediately. Seasons end, and a new season starts from an empty map. The
  territory map confers standing only — no payment, reward, or ranking used
  for any payment is derived from it. (The signed-out view is pending final
  legal review.)
• Privacy zones: you can mark up to five places, such as your home, as
  privacy zones. For each one we store the name you give it, its centre point,
  its radius, and when you created it. No other user can see your zones.
  Whenever someone else sees one of your saved routes — in the app or in a
  link preview — every point inside your zones is left out, on past
  activities as well as new ones, and the territory map counts only the
  points that remain. A route that stops short of a place can still hint that
  a zone is there, and a link preview that another app has already fetched
  may keep the image it fetched. Zones apply to saved routes, not to what you
  share while recording: they do not change the live map, which is already
  rounded to roughly one kilometre, or the position that the other people in
  a group session you join can see. We still use your full recording to
  verify the activity (Section 1.7). Deleting a zone removes it at once, and
  the points it covered show again to anyone who can see those activities;
  deleting your account deletes all of your zones (Section 8). (This item is
  pending final legal review.)
• Photos: a photo you add to an activity is shown in the app to the people
  who can see that activity, but its web address opens it for anyone who has
  the address, whatever the setting (Section 1.6a).

1.6a Activity Photos

You can add photos to an activity you recorded. Adding them is optional.

• Details removed before upload. A photo file can carry details your
  camera stored in it, such as where and when the photo was taken. Before
  uploading, the app removes them by saving a fresh copy of the image on your
  device. GIF and SVG files are uploaded as they are, and so is any image your
  device cannot open, for example a HEIC photo on a computer without HEIC
  support; whatever details those files hold stay in them.
• Who sees them. A photo is shown with its activity, on the activity page
  and on its card in the feed, to the people who can see that activity under
  the visibility you chose (Section 1.6). Link previews never include photos.
• Your "Challenge me" page. Anyone can open your "Challenge me" page
  (flowstake.com/your-username/challenge-me). It shows a picture from your
  recent public activities, a route whenever one can be shown. Only if you
  turned on "hide map" for all of them does it show a photo instead: the first
  photo of the most recent one that has a photo.
• Share cards. A share card you make for an activity can include its first
  photo. The card is made on your device and goes only where you send it.
• Every photo has a web address. Photos are stored with our database
  provider (Section 3.2). We give a photo's address only to the people who can
  see its activity, but opening the address does not require signing in:
  anyone who has it, for example because someone passed it on, can open the
  photo, whatever the activity's visibility. Changing an activity's visibility
  does not change the addresses of its photos. To put a photo out of reach,
  remove it or delete the activity.
• Used for nothing else. Photos are not used to verify activities, and we
  never send them to IPFS, a blockchain, Strava, or our AI providers.
• Removing and deleting. Removing a photo from an activity deletes the
  photo at the same time. Deleting an activity deletes its photos within 45
  days. Deleting your account deletes all of your photos at once (Section 8).
  A copy that someone has already saved stays with them.

(This section is pending final legal review.)

1.7 Verification and Anti-Cheat Analysis

To verify activity and detect fabricated or vehicle-assisted data, FlowStake
analyses the recorded data of every activity: speed and its consistency with
position, timing regularity, movement patterns, and — where you have provided
them — heart rate and other sensor readings. Where other athletes were recorded
nearby, their anonymous encounter records may raise the confidence of your
verification. This analysis is automated, is applied the same way to every
activity, and produces a verification result and an internal integrity flag.
Integrity flags are advisory: they are reviewed by a person before any
consequence to you, and they are never shown to other users.

1.7a Official Race Result Matching (optional)

If you choose to match an activity to an official race result, we store the
provider name, external race and result identifiers, race name, bib number (if
you provide it), official start and finish times, official distance, whether the
result was chip-timed, optional mat or finish split times, and the link to your
activity and scoring session. We use this only to corroborate verification
(institutional evidence on the shadow score) and to calibrate our verifier. We
do not sell it, do not use it for advertising, and do not change your live
verification tier solely because a match was claimed. You can ask us to delete
a match you submitted; published fingerprints of the underlying activity remain
subject to Section 1.8.

1.7b Presence Checks (optional)

If you turn on presence checks in Settings → Security, your phone's own screen
lock (for example Face ID, Touch ID, or an Android fingerprint or PIN) is used
to confirm that you are the person holding the phone at the start and at the
finish of an activity, and once at a moment during the activity that you cannot
predict. This uses the WebAuthn standard: your device creates a signing key
and keeps it; your face, fingerprint or PIN never leaves your device and is
never sent to us. We store only the matching public key, a counter the device
increments on each use, the kind of device credential (for example whether it
is backed up to your platform account), and, for each check, the time, whether
it was at the start, mid-activity or the finish, whether your device reported
that it verified you, and the activity it belongs to. We use these records only
to corroborate verification (device evidence on the shadow score, Section 1.7)
and never for advertising or any other purpose. Declining or missing a check
never counts against an activity; it simply is not counted for it. You can turn
presence checks off at any time in Settings, and the stored public key and
check records are deleted with your account (Section 8.2).
(This section is pending final legal review.)

1.7c Group Activity Witnessing over Bluetooth

When you record a group activity that you have joined with other athletes, the
FlowStake mobile app uses Bluetooth to confirm that the people in your group
are near you. It runs only while you are recording that group activity and
not paused; at every other moment it is off. While it runs, your phone
broadcasts a code that changes every 15 seconds and listens for the codes of
the other members of the same group. Only members of that group can tell whose
code is whose: to anyone else it is a random number, and it carries no name,
account or device identifier. Your phone does not connect to other devices and
does not listen for anyone outside your group.

Each time your phone hears a group member, we store a record of the group
activity, you and the member heard, the time, the code heard, the signal
strength, and your phone's location at that moment. Members of the same group
activity can see these records, as part of that activity's verification. We use
them only to verify the group activity (co-presence evidence, Section 1.7) and
never for advertising or any other purpose. A record is deleted when the group
activity is deleted or when either athlete's account is deleted (Section 8.2).
You can turn Bluetooth off, or decline the app's Bluetooth permission, at any
time; the group activity is then verified without these records.
(This section is pending final legal review.)

1.7d Open Runs

An open run is a run you start, or join with its code or link, that other
people can join while it is under way. Anyone who has the code can join,
including people you have never met; that is the point of it. You record your
own activity as usual, and it is attached to the run. A run ends when nobody in
it has been recording for 15 minutes. Open runs are public: you cannot start or
join one while your profile is hidden, and if you hide your profile during a
run, other runners stop being given your account identifier at once.

What the run holds. The kind you chose (fun, race or charity), the name you
give it, and for a charity run the charity's name and, if you add one, a link to
the charity's own donation page. Anyone who can see the run sees these. No money
is paid to or through FlowStake in an open run; a donation goes to the charity
on its own page.

Who is running. While you record an open run, the app asks every 30 seconds
or so which account identifiers are recording in the run at that moment. It
receives identifiers only: no names, no locations.

Bluetooth witnessing. In the FlowStake mobile app, witnessing works as
Section 1.7c describes, with one difference: the people your phone listens for
are the runners recording in the same open run at that moment, rather than the
members of a group. The rotating code is derived from a key that belongs to the
run and is given to everyone who joins it. Each time your phone hears another
runner, we store the same record as in Section 1.7c (your activity, you, the
runner heard, the time, the code heard, the signal strength and your phone's
location at that moment) against your own recording. Other runners cannot read
your records. The first time your phone hears a runner, the app shows you their
username.

Scanning a runner's code. While you record an open run, the app can show a
code on your screen. It holds the run's link, your account identifier and a
short code that changes every 15 seconds and comes from the same run key. When
another runner scans it with the FlowStake app, that is a sighting of you by
them, and the scan can also bring them into the run. When you scan another
runner's code, we store the same record as for a Bluetooth sighting, against
your own recording: your activity, you, the runner whose code you scanned, the
time, the code, and your phone's location at that moment; the signal strength
is not part of it. The camera is used only to read the code: the picture never
leaves your phone and is not kept. Anyone who scans your code, with any camera,
can see the run's link and your account identifier; show it only to someone you
are with.

Joins and hand-offs. When two runners' phones have heard each other in both
directions for at least a minute while both were recording, or when each runner
scanned the other's code within two minutes of each other while standing within
50 metres, we write a join to FlowStake's activity ledger. It records the run, the two recordings (by
internal identifiers), the time, how long the two ran together, how many times
each phone heard the other, the kinds of evidence, and the average distance
between the two phones' reported positions, or, for a join made by scanning, the
distance between the two places the codes were scanned. It never contains a location, a
name or a username. The ledger entry is also linked to the account of the
runner who joined. Ledger entries are permanent and are covered by the public
fingerprints in Section 1.8. If a join turns out to be wrong, we add a later
entry that reverses it, saying which join and why; the reversed join no longer
counts anywhere, and neither entry is deleted. We use joins to tell whether a run was handed on
from one runner to the next and how long the unbroken chain is, and the
sightings may also count as co-presence evidence for the verification of your
activity (Section 1.7). We never use them for advertising.

The baton. Each open run has a baton: a record of which runner is carrying
the run at that moment. The runner who starts the run holds it first. The runner
holding it can offer it to another runner who is recording in the same run and
with whom a join shows they met, and it moves only if that runner accepts within
three minutes, and only while that join still stands. If the runner holding
it stops recording, another runner who is recording in the run can pick it up.
For each turn we store the run, the runner, the runner it came from, how it was
passed (start, hand-off or pick-up) and when the turn began and ended. For each
offer we store who offered it to whom, when, and how it ended. While you record
in an open run, the other runners recording in it can see who is carrying the
baton and can see your name, username and photo in the list of runners it can be
handed to. The baton holds no location. It adds no distance, it is not evidence
that anyone ran, and no payment depends on it. If you delete your account, your
offers are deleted and your turns stay in the run's history without you.

What other people can see. Any signed-in FlowStake user can read a run's
chain: its kind, name, charity name and link, when it started and ended, whether
it is still going, how many runners it has had, how many joins and hand-offs,
and its total distance and witnessed distance. For each join they see when it
happened, how long the two ran together, whether it was a hand-off, and each of
the two runners' name, username and photo. A runner is named only if their
profile is not hidden, that recording was public, and the activity saved from it
is public and not private; otherwise the join is shown without them. They also
see the baton's history: for each turn, how it was passed, when it began and
ended, whether a join shows the two runners together, and the runner's name,
username and photo under the same rule. Distance
counts only verified, public activities. A list of runs shows the same counts
and distances without any runner. The run's code, routes and locations are never
shown.

Deleting. Your Bluetooth records and the codes you scanned are deleted as Section 1.7c describes. When
you delete an activity, it leaves the run's names and distances. When you delete
your account, your recordings, your activities and the record that you joined
are deleted, and the link from each ledger join to your account is removed; the
join itself stays in the ledger without saying who you were, pointing at
recordings that no longer exist. A run you started keeps its kind, name and
charity details but no longer says who started it. You can turn Bluetooth off,
or decline the app's Bluetooth permission, at any time; you can still record in
the run, and nobody can be witnessed with you.
(This section is pending final legal review.)

1.7e Checkpoints (pending final legal review)

A checkpoint is a small tag fixed at a place athletes pass. Holding your
phone to it opens a FlowStake link. Nothing is recorded unless you are signed
in when the link opens.

What a visit records. Which checkpoint, the tag's own tap count, the time
on our server, and your account. If your browser or the app has already been
allowed to use your location, we also store your phone's position at that
moment and how far it was from the checkpoint; we do not ask for location to
count a visit. The tag sends a code that changes on every tap, which we use to
confirm the tap is real and has not been used before. The tag itself stores
nothing about you.

What other people can see. A signed-in FlowStake user who opens a
checkpoint's link sees its name, how many visits it has had, how many different
athletes have visited, and its keeper's name, username and photo, unless the
keeper's profile is hidden. They do not see who visited or when. Your own page
shows how many times you have been there. We never show a checkpoint's
coordinates or any visitor's position.

Keeping a checkpoint. If you place a checkpoint, you give it a name and we
record where you are standing at that moment as the checkpoint's position, and
you as its keeper. We ask for your location once, to do that. The position is
used to check visits and is not shown to anyone. Because your username is shown
as the keeper, name the place and not your address, and do not place a tag
somewhere you would not want associated with you.

How we use it. To show you the checkpoints you have visited and to show a
keeper how much their checkpoint is used. A visit may later count as evidence
that you were at that place during an activity (Section 1.7); it does not
today, and we will update this Policy before it does. Nothing is paid for a
visit or for keeping a checkpoint. We never use visits for advertising.

Deleting. If you delete your account, your visits are deleted. A checkpoint
you kept stays in place without your name.

1.8 Public Fingerprints of Activity Records

So that verification can be checked by anyone without trusting FlowStake, we
publish cryptographic fingerprints (hashes) of activity records. Each day we
publish a single fingerprint of that day's records, chained to the previous
day's, on our public ledger page (flowstake.com/ledger) and as a transaction on
Base, a public blockchain, where anyone can read and check it. That transaction
carries only the fingerprint, its date and how many records it covers. For each
day, the ledger pages also list the fingerprint of every record in it, so anyone
can recompute that day's fingerprint; a record belonging to a public activity is
linked to that activity's proof page, and every other record appears only as its
fingerprint. Where
you have opted in, an attestation of your activity may be
recorded on a public blockchain. A fingerprint is a one-way summary: it cannot
be reversed to recover your location, your identity, or anything about the
record. Once published it cannot be withdrawn, which is what makes it useful
as proof. Your underlying activity data remains yours to delete.

1.8a Flowstake Score

From the commitments you make in the app — which ones you completed, which you
did not, whether you came back after a miss, and how steadily you stay active —
FlowStake computes a Flowstake Score. It measures how reliably you follow
through, not how fast or far you go, and it is not the verification result
of any single activity. It is derived only from your own challenge and activity
records inside FlowStake; imported Strava or Apple Health activities do not feed
it. Your exact score is shown only to you. It is never shown to other users
and never published; the most another user could ever see is a coarse band,
and only if you turn that on yourself in your profile. Until you have completed
enough commitments for the score to mean anything, you see your progress toward
it rather than a number.

1.9 Reward Payments

If you take part in the Achievement Reward Program (see its Rules), we collect
from you directly — outside the app — the information needed to pay you: your
legal name; a mailing address, bank transfer details, or the email address or
phone number your bank uses for Zelle; and a completed tax form (Form W-9 or
equivalent), on paper or through a tax-form service that keeps it for us.
Your taxpayer identification number is never entered into the FlowStake app or
its database. We record in our systems only the fact
that your form is on file and where the paper is kept, the amount owed to you for
each verified completion, and each payment we send. We email you a record of
each reward owed and each payment sent, and you can ask us for a copy of your
records at any time. See Section 8.3 for how long they are kept. (This section
is pending final legal review.)

1.10 Sponsor Applications (pending final legal review)

If you apply to sponsor a challenge at flowstake.com/sponsor, you do not need a
FlowStake account.

What you give us. Your company or brand name, your own name and your work
email address. If you choose to add them: your website, the kind of challenge
you have in mind, a rough budget range, a note, and the offer you would like to
see, in your own words: a name for the campaign, what an athlete would have to
do, what each athlete who completes would receive, a reward amount per athlete
and a total budget, when you would like it to run, and where or for whom. We
record when you applied. If you are signed in to FlowStake when you apply, the
application is linked to your account.

How we use it. To read your application, reply to you, and prepare an
agreement if we both decide to go ahead. The amounts you state describe what
you have in mind: nothing is charged, and nothing you write is published. We
check the text automatically for descriptions of dangerous activities and mark
an application that contains one for the person who reads it. We count
applications by email address to limit how many one address can send in a day.
We do not use an application for advertising and do not add you to a mailing
list.

Who sees it. FlowStake staff only. It is never shown to athletes or to the
public, and no other user can read it. When an application arrives, FlowStake's
operator is sent an email notice that contains the company name, and not your
name, your email address or anything else you wrote. Supabase stores the
application and our email provider carries that notice (Section 3.2).

Keeping and deleting. We keep an application until you ask us to delete it
or we no longer need it; it is not deleted automatically. To have it deleted,
or to get a copy, write to privacy@flowstake.com from the address you applied
with. If you applied while signed in and later delete your account, the link to
your account is removed and the application stays until you ask us to delete
it.

1.11 FlowStake Pro Subscription (optional) (pending final legal review)

FlowStake Pro is an optional paid subscription sold on the FlowStake website.
This section applies only if you subscribe.

• What Stripe receives. Stripe, our payment processor, takes the payment.
  When you start a subscription we send Stripe your email address, your name if
  your profile has one, and your FlowStake account identifier. You enter your
  payment details on Stripe's own page, and Stripe also receives your billing
  country and postal code where it needs them for tax. FlowStake never receives
  or stores your card number.
• What we store. Which plan you have, its status, when the current period
  ends, when it is set to cancel, the customer and subscription identifiers
  Stripe assigned, and a record of each charge: the amount, the currency, the
  date and whether it succeeded.
• What it is used for. Only to switch FlowStake Pro features on and off, to
  answer billing questions, and for tax and accounting records. It is never used
  for verification, scoring, challenge eligibility or rewards.
• If you delete your account. We cancel the subscription with Stripe at
  once. We keep the subscription record and its charges, with the link to your
  account removed, for as long as they are needed for billing records, which
  tax and accounting law typically sets at seven years. The record then holds
  Stripe's identifiers, the plan, its status and dates, and the amounts; it
  holds no name, email address or card details. Stripe keeps its own records
  of your payments under its own privacy policy.
• The mobile apps. FlowStake Pro is not sold inside the iOS or Android app
  today. If it is, Apple or Google will take that payment and tell us only the
  status of the subscription.

2. Data Usage

2.1 Essential Operations

• Activity verification and anti-cheat analysis
• Challenge management, including your own Flowstake Score (Section 1.8a)
• Reward payments under a published reward program
• Account security, including limits on how quickly one account can post
  comments, messages, posts, friend requests and Flowstakes. For each of those
  actions we record your account identifier, the kind of action and the
  time, and delete the record after 48 hours (Section 8.7). (This item is
  pending final legal review.)
• Service improvements, including one timestamp per account: when your first
  recording started (Section 1.2), so we can measure how quickly the app
  works for a new athlete. No location is kept with it.
• Feature optimization

2.2 Public Verification Records

• Published daily fingerprints of activity records (Section 1.8)
• Public attestations on a blockchain, only where you have opted in
• Challenge participation records
• If you connect a wallet: the public address you chose to link

3. Data Protection

3.1 Security Measures

• Encryption for data in transit, and encrypted storage at rest by our database provider
• Secret keys held in isolated, access-controlled storage
• Row-level access controls so that database queries can only return the rows a signed-in user is entitled to see
• Automated checks that guard privacy-sensitive data paths, run on every code change
• Scheduled review of access grants and security advisories

3.2 Third-Party Service Providers

The following named third parties process your data on our behalf. Each link points to their own privacy policy:

We contractually require all service providers to process your data only on our instructions and to maintain appropriate security standards. We do not currently use an identity-verification (KYC) provider. (The Google Analytics, OpenStreetMap Foundation, OpenRouter, Anthropic and OpenAI entries are pending final legal review.)

3.3 Financial Data Handling

• FlowStake collects a payment from you only if you choose to subscribe to FlowStake Pro (Section 1.11), and stores no payment card data
• If you receive a reward under the Achievement Reward Program, the bank details, Zelle email address or phone number, or mailing address you give us are used only to send that payment, through FlowStake's bank, and are handled outside the app by FlowStake's operator; your tax form is kept on file outside the app, on paper or by the tax-form service that collected it; your taxpayer identification number is never stored in the FlowStake database (Section 1.9)
• Amounts owed and paid to you are recorded in our database so that you, and we, have an accurate record, and so that we can meet tax-reporting obligations
• If you choose to connect a cryptocurrency wallet, we store only its public address

4. User Rights

4.1 Access and Control

• View your data
• Download your data
• Correct inaccuracies
• Delete your account. When you delete it from the app, the app also clears
  what it kept on that device: your sign-in, saved preferences, and activities
  or proofs waiting to upload. If you signed in with Apple, we also ask Apple
  to revoke FlowStake's access to your Apple ID, which sends Apple the sign-in
  token Apple issued to FlowStake. (This item is pending final legal review.)
• Manage preferences
• Opt out of communications: every email you can switch off has an Unsubscribe link at the bottom. It works in one step and without signing in, and mail apps such as Gmail offer the same thing as an Unsubscribe button. Emails about your account, sign-in and payments still arrive. To choose individual kinds of email, sign in and open Email preferences. (This item is pending final legal review.)
• Control third-party sharing
• Change the visibility of any activity at any time

4.2 Data Portability

• Export activity data (GPX/TCX)
• Transfer to other services
• Limits: published fingerprints and on-chain attestations are permanent by design (Section 1.8)

5. Data Sharing

5.1 With Your Consent

• Challenge participants
• Social features
• Public leaderboards
• Profile visibility
• Group memberships
• Friend connections
• Public activities and their link previews (Section 1.6)

5.2 Service Providers

The named providers in Section 3.2, and no others.

5.3 Legal Requirements

• Court orders
• Regulatory compliance
• Fraud prevention
• Terms enforcement
• Law enforcement requests
• Legal investigations

6. Cookies and Tracking

6.1 Essential Cookies and Storage

• Authentication and session management
• Security
• Preferences (for example units, map style, tracker settings), stored on your device
• Feature functionality

6.2 Analytics

We use Google Analytics (Google LLC) to understand how the website and the app are used, for example which pages are opened and how often. It stores a cookie on your device holding a random identifier, and it receives the details listed for it in Section 3.2. When you arrive from a link, we remove sign-in codes, invite and referral codes, and email addresses from the page address before it is sent. We do not send Google Analytics your GPS tracks, activity data or health data, and we do not use it, or any other tool, for advertising. You can block it with your browser's privacy settings or Google's opt-out add-on (tools.google.com/dlpage/gaoptout). Sentry records technical errors. (This section is pending final legal review.)

7. International Data Transfers

Our infrastructure providers may process data in the United States and other countries. Where data is transferred across borders we rely on our providers' contractual safeguards. Published fingerprints and any on-chain attestations are, by their nature, replicated globally and permanently.

8. Data Retention

8.1 Account Information

Kept while your account is active and deleted within 45 days of account deletion, subject to the exceptions below.

8.2 Activity Data

Kept while your account is active. You may delete individual activities at any time; account deletion removes them all within 45 days. Photos you add to an activity are deleted as Section 1.6a describes: at once when you remove one, within 45 days when you delete its activity, and at once when you delete your account. Published fingerprints and on-chain attestations are permanent (Section 1.8).

8.3 Reward Payment Records

If a reward was owed or paid to you, we retain a minimal record of it — your account identifier, the amounts, the dates, the activity each reward was for, how it was paid, and whether a tax form was on file — for as long as tax law requires, typically seven years, even if you delete your account. In our database that record holds no name, email address or tax identification number; the tax form itself is kept outside our systems for the same period. If you took part in the program but no reward was ever owed to you, your program records are deleted with your account. Everything else about your account is deleted as described above. (This section is pending final legal review.)

8.4 Email Opt-Outs

When you unsubscribe, we keep a coded form of your email address so that we keep honoring your choice. The code is made with a secret key and cannot be turned back into the address; it only lets us recognize the address if we are about to email it again. We keep it even if you delete your account, because deleting it would let those emails start again. It is removed when you turn email back on from Email preferences. Unsubscribe links carry the same kind of code, never your address. (This section is pending final legal review.)

8.5 Terms Acceptance Records

Kept while your account is active, as the record of which version of the Terms you agreed to and when. When you delete your account, the link to your account, your IP address and your browser or app details are removed from these records at once. What remains is an anonymous entry saying that a given version of the Terms was accepted at a given time and on which screen; it no longer says by whom. (This section is pending final legal review.)

8.6 Accounts We Remove

If we remove an account because it broke our Terms, we keep a short record that we did: the account identifier, the reason we recorded, and when. If we also ban the account, we may keep its email address, its username and its account identifier on a ban list, so that they cannot be used to create a new account. Apart from that, a removed account is deleted exactly as described above. Deleting your own account never puts you on a ban list. (This section is pending final legal review.)

8.7 Anti-Abuse Records

The records of how often an account posts, messages, sends friend requests and
gives Flowstakes (Section 2.1) are deleted 48 hours after they are made. (This
section is pending final legal review.)

8.8 Sponsor Applications

A sponsor application (Section 1.10) is kept until the applicant asks us to delete it or we no longer need it. It is not deleted automatically, and it is not deleted when an account it was linked to is deleted; the link to the account is removed. (This section is pending final legal review.)

9. Children's Privacy

We do not knowingly collect information from children under 18. If you believe we have collected information from a child, please contact us immediately at privacy@flowstake.com.

10. Changes to Privacy Policy

Each version of this Policy is dated. We update it whenever we change what we collect, how we use it, who we share it with, or how long we keep it — before the change takes effect, not after. Material changes will be announced in the app and by email. Previous versions are archived and available on request.

11. Contact Information

11.1 Privacy Questions

• Email: privacy@flowstake.com
• Mail: 1209 Orange Street, Wilmington, DE 19801
• Response time: Within 48 hours on business days

11.2 Data Protection Officer

• Email: dpo@flowstake.com
• Responsibilities: Oversight, compliance, inquiries

12. Legal Basis for Processing

12.1 Consent

• Account creation
• Optional features, including Apple Health, Strava, heart-rate monitors, wallet connection, and streaming-channel links
• Marketing communications
• Public sharing of an activity

12.2 Contractual Necessity

• Challenge participation
• Reward payments under a published reward program
• Account management
• Service provision

12.3 Legitimate Interests

• Security measures
• Service improvements
• Fraud prevention and verification integrity
• Aggregate analytics
• Keeping a record of email opt-outs so they are honored (Section 8.4)
• Keeping short-lived records of changes to your profile, activities and challenges (Section 14.3)

13. Specific Privacy Features

13.1 Activity Privacy

• Per-activity visibility: only you, friends, or public; default friends
• Start and end of every shared route removed from previews and shared maps
• "Hide map" option per activity
• Live map position rounded to roughly one kilometre, with one-tap hide and a profile-level opt-out
• Territory map built only from public, verified activities on an equal-area hexagon grid about 1.2 km across, never finer than the live map; cells released the moment an activity stops being public; signed-out visitors see only which cells are covered, never who covered them (Section 1.6)
• Public link previews only for public activities (Section 1.6)
• Up to five privacy zones, left out of every saved route other people see and of the territory map (Section 1.6)
• Photos: details stored in the file, such as where it was taken, removed before upload when your device can open the image; a photo's web address opens it for anyone who has the address, so remove a photo to put it out of reach (Section 1.6a)

13.2 Wallet Privacy

• Connecting a wallet is optional
• We store only the public address you link
• We never ask for, and you must never provide, a private key or seed phrase

13.3 Signing In With a Wallet or a Passkey

You may, if you choose, sign in by proving control of a wallet or a passkey instead of using an email address and password. This is optional; email sign-in remains available and nothing here is required to use FlowStake.

When you sign in this way:

• We ask your wallet to sign a short message. It states the site you are signing in to, the network, a one-time code we issue, and the time. Signing it proves you hold the key. It is not a transaction, it moves no funds, and it grants us no ability to spend anything.
• Your public address becomes part of your account. Where you previously linked an address only to receive a payment, an address you sign in with also identifies your account and is used to authenticate you on each later sign-in. It is recorded on your profile.
• We create an account for you if you do not have one. Because an account needs an address of some kind, we generate a non-routable placeholder derived from your public address. No mail can be sent to it and it is not an email address you own or can receive at.
• The one-time codes are short-lived and single-use. We store the code, the address, the site and the network it was issued for, and when it was used. They expire within minutes and are deleted afterwards.
• A passkey never leaves your device. It is held by your device's secure hardware and unlocked by you. We receive only the resulting proof, never the key.
• Signing in does not move money and is not a payment feature. It tells us who you are. It does not enable staking, charging, or paying, and does not change what FlowStake may collect from you.

Age and Terms acceptance are required for a wallet or passkey account exactly as they are for an email account; you will be asked for both before you can use the Platform.

14. Security Practices

14.1 Technical Measures

• Encryption in transit and at rest
• Role-based and row-level access control
• Isolated secret storage
• Automated guard tests on privacy-sensitive code paths
• Error and alert monitoring

14.2 Organizational Controls

• Access limited to what a role requires
• Security review of changes that touch personal data
• Incident response procedure
• Vendor assessment

14.3 Change Records

When your profile, one of your activities or challenges, or your place in a challenge is created, changed or deleted — by you, by another user, or by FlowStake — we record which record it was, what kind of change it was, the names of the fields that changed (never what they contained), who made the change, and when. For a challenge that is deleted or completed automatically, we also keep its status, its stake amount, how many participants had paid, and whether rewards were paid. Settings → Security shows you your own recent changes, and we use these records to investigate problems and misuse. No other user can see the change records about your information. Each change record is deleted after 180 days. When you delete your account, every change record about you is deleted at once, and your account is removed from the records of changes you made to anyone else's information. (This section is pending final legal review.)

15. Public Records and Blockchain

15.1 Published Fingerprints

See Section 1.8. Fingerprints are public, permanent, and reveal nothing about content.

15.2 If You Opt In to On-Chain Attestation

An attestation records that a verified activity occurred, by fingerprint, on a public blockchain. It is permanent, publicly visible, and pseudonymous — linked to a public address, not to your name. Only the fingerprint is recorded, never your route.

16. Compliance Framework

• GDPR and CCPA considerations
• FTC Health Breach Notification Rule and state consumer-health-data laws (Section 1.4)
• Tax-reporting obligations for reward payments (Section 8.3)
• Industry best practices and self-regulatory frameworks

For questions about our privacy practices, please contact us at privacy@flowstake.com.