Privacy Policy

Privacy Policy for Flowstake.com

Last Updated: July 30th, 2026

This Privacy Policy is part of our Terms and Conditions. Please read both documents carefully before using our Platform.

Plain-English Summary: FlowStake collects your GPS location and activity data to verify athletic performance. We use Supabase for database storage, Stripe for payments, and Mapbox for maps. On iOS you can optionally connect Apple Health so your Watch workouts and step counts count toward challenges — that data is used only for fitness features, never for advertising, and never sold (Section 1.5). We do not sell your data to advertisers. Your GPS tracks are only used for challenge verification, and start/end points are trimmed on any map you share. You can export or delete your data at any time.

1. Information Collection

1.1 Required Information

• Email address
• Wallet address
• KYC documentation
• Activity data
• Location data (during activities)

1.2 GPS and Location Data

When you record an activity, FlowStake collects precise GPS coordinates, altitude, timestamps, and derived metrics (speed, pace, distance) for the duration of your session. This data is used exclusively to:

• Verify that your activity meets the challenge completion criteria
• Detect anomalous data that may indicate fraudulent submission
• Generate route maps shown on your activity detail page

GPS tracks are stored in encrypted form in our database. They are never sold to third parties and are not used for advertising. You may request deletion of your GPS tracks at any time; note that on-chain attestations referencing your activity hash cannot be deleted due to blockchain immutability.

1.3 Optional Information

• Profile picture
• Social connections
• Device specifications
• Fitness preferences
• Performance metrics
• Training history

1.4 Health and Wearable Data

FlowStake collects "consumer health data," including precise GPS location,
heart rate, step counts, cadence, and activity/workout metrics. With your
explicit, separate opt-in consent, we may also import workouts from connected
sources you authorize, such as Apple Health (Apple Watch). We collect this data
only after you grant consent in the app and only to provide activity tracking,
challenge verification, and the features you use. We do not sell your health
data, use it for advertising, or disclose it to other users beyond your chosen
sharing setting (your activities default to friends-only and are shown on the
public feed only if you opt in). You can withdraw consent, change sharing, or
delete this data at any time (see Section 4); deletion is completed within 45
days, except for on-chain attestation hashes that are immutable by design. These
practices are intended to align with the FTC Health Breach Notification Rule and
U.S. state consumer-health-data laws (e.g., the Washington My Health My Data
Act). (This section is informational and pending final legal review.)

1.5 Apple Health (HealthKit) on iOS

The FlowStake iOS app can read from, and write to, Apple Health — but only after
you explicitly grant permission in the iOS Health permission sheet. Apple Health
access is entirely optional: FlowStake's core features work using the app's
own GPS recording, and nothing is read from Apple Health unless you turn it on.

What we read (only the types you authorize): workouts, heart rate, step
count, walking/running distance, active energy burned, and workout routes.

What we write: the activities you record in FlowStake, so your workout
history stays complete in Apple Health. We only write activities you actually
recorded — we never write estimated, synthetic, or inaccurate data.

Why we read it: so activities recorded on your Apple Watch or in other apps
count toward your FlowStake challenges, streaks, and step goals, and so heart
rate and distance appear alongside your activity.

Limits we hold ourselves to. Data obtained from Apple Health is used only
for the health and fitness features described above. Specifically, we do not:

• use it for advertising, marketing, or any advertising-related purpose;
• sell it, or share it with data brokers or advertising networks;
• disclose it to any third party without your separate permission, other than
  the infrastructure providers listed in Section 3.2 who process data on our
  behalf under contract;
• use it to train machine-learning models; or
• use it for any purpose other than health, fitness, or activity verification.

Verification note. Activities imported from Apple Health are treated as
lower-assurance than activities recorded live in FlowStake, because any app can
write to Apple Health. Imported activities are labelled as imported and may not
be eligible for verification tiers that require first-party GPS capture.

How to turn it off, and what happens. You can revoke access at any time in
iOS Settings → Privacy & Security → Health → FlowStake, or by disconnecting
Apple Health in FlowStake's settings. Revoking stops all future reads
immediately. Activities already imported into your FlowStake account remain in
your account until you delete them — delete individual activities, or delete your
whole account (Section 4), which removes them. Revoking access in iOS does not,
by itself, delete data already imported.

2. Data Usage

2.1 Essential Operations

• Activity verification
• Challenge management
• Reward distribution
• Account security
• Service improvements
• Feature optimization

2.2 Blockchain Data

• Public attestations
• Challenge participation
• Token transactions
• Governance votes
• Smart contract interactions
• On-chain verification records

3. Data Protection

3.1 Security Measures

• End-to-end encryption for sensitive data in transit
• Secure key management via environment-isolated secrets
• Regular security audits and penetration testing
• Role-based access controls (Row Level Security in Supabase)
• Vulnerability assessments on a scheduled basis

3.2 Third-Party Service Providers

The following named third parties process your data on our behalf. Each link points to their own privacy policy:

We contractually require all service providers to process your data only on our instructions and to maintain appropriate security standards.

3.3 Financial Data Handling

• Full payment card numbers are never stored by FlowStake; all card data is handled exclusively by Stripe
• Stripe customer IDs and connected account IDs are stored in our database to facilitate future payouts
• Bank account details for payouts are stored by Stripe, not FlowStake
• KYC documents (government ID, proof of address) are processed by our KYC provider and are not accessible to FlowStake staff
• Payout transaction IDs and amounts are recorded in our database for audit and dispute purposes

4. User Rights

4.1 Access and Control

• View your data
• Download your data
• Correct inaccuracies
• Delete your account
• Manage preferences
• Opt out of communications
• Control third-party sharing

4.2 Data Portability

• Export activity data
• Transfer to other services
• Blockchain permanence limitations
• IPFS storage limitations
• Data format specifications

5. Data Sharing

5.1 With Your Consent

• Challenge participants
• Social features
• Public leaderboards
• Profile visibility
• Group memberships
• Friend connections

5.2 Service Providers

• Payment processors
• Cloud services
• Analytics tools
• Security services
• Email delivery services
• Customer support platforms

5.3 Legal Requirements

• Court orders
• Regulatory compliance
• Fraud prevention
• Terms enforcement
• Law enforcement requests
• Legal investigations

6. Cookies and Tracking

6.1 Essential Cookies

• Authentication
• Security
• Preferences
• Session management
• Feature functionality
• Performance optimization

6.2 Analytics

• Usage patterns
• Performance metrics
• Error tracking
• Feature optimization
• User journey analysis
• Conversion tracking

7. International Data Transfers

7.1 Global Operations

• Cross-border processing
• Data protection standards
• Legal safeguards
• Transfer mechanisms
• EU-US data transfers
• Asia-Pacific compliance

7.2 Blockchain Considerations

• Decentralized storage
• Global node distribution
• Immutable records
• Jurisdictional challenges
• Regulatory compliance
• Cross-border transactions

8. Data Retention

8.1 Account Information

• While account is active
• Legal hold periods
• Backup retention
• Anonymized analytics
• Regulatory requirements
• Financial record keeping

8.2 Activity Data

• Blockchain permanence
• IPFS retention
• Challenge records
• Reward history
• Verification data
• Performance metrics

9. Children's Privacy

We do not knowingly collect information from children under 18. If you believe we have collected information from a child, please contact us immediately at privacy@flowstake.com.

10. Changes to Privacy Policy

10.1 Updates

• Periodic reviews
• Material changes notification
• Prior version access
• Effective dates
• Change summaries
• Regulatory updates

10.2 User Notification

• Email alerts
• In-app notifications
• Website announcements
• Consent renewal
• Opt-out options
• Implementation timelines

11. Contact Information

11.1 Privacy Questions

• Email: privacy@flowstake.com
• Form: flowstake.com/privacy
• Mail: 1209 Orange Street, Wilmington, DE 19801
• Response time: Within 48 hours
• Escalation process available
• Complaint procedures available

11.2 Data Protection Officer

• Email: dpo@flowstake.com
• Responsibilities: Oversight, compliance, inquiries
• Availability: Business days, 9am-5pm EST

12. Legal Basis for Processing

12.1 Consent

• Account creation
• Optional features
• Marketing communications
• Cookies and tracking
• Special categories of data
• Third-party integrations

12.2 Contractual Necessity

• Challenge participation
• Reward distribution
• Account management
• Service provision
• Payment processing
• Feature access

12.3 Legitimate Interests

• Security measures
• Service improvements
• Fraud prevention
• Analytics
• Business operations
• Marketing (where applicable)

13. Specific Privacy Features

13.1 Activity Privacy

• Visibility controls
• Location masking
• Challenge-specific sharing
• Leaderboard opt-out
• Data granularity settings
• Temporal limitations

13.2 Wallet Privacy

• Address linking options
• Transaction privacy
• Reward distribution preferences
• Withdrawal controls
• Public key management
• Signature requirements

14. Security Practices

14.1 Technical Measures

• Encryption standards
• Authentication methods
• Infrastructure security
• Vulnerability management
• Intrusion detection
• Data loss prevention

14.2 Organizational Controls

• Access limitations
• Staff training
• Security reviews
• Incident response
• Vendor assessment
• Compliance monitoring

15. Blockchain-Specific Provisions

15.1 On-Chain Data

• Public ledger implications
• Transaction visibility
• Address pseudonymity
• Data permanence
• Block explorer accessibility
• Hash function properties

15.2 Smart Contract Interactions

• Function calls
• Event emissions
• State changes
• Gas considerations
• Contract upgrades
• Parameter adjustments

16. Compliance Framework

16.1 Regulatory Compliance

• GDPR considerations
• CCPA alignment
• Global standards
• Industry best practices
• Self-regulatory frameworks
• Certification programs

16.2 Verification Mechanisms

• Identity verification
• Activity validation
• Challenge completion
• Reward distribution
• KYC/AML procedures
• Fraud detection systems

For questions about our privacy practices, please contact us at privacy@flowstake.com.