Privacy policy
Your league sees it. Nobody else does.
What Pike collects, why, who can see it, where it is stored and how to get rid of it. Written to match what the app actually does, under the GDPR and the Austrian Data Protection Act (DSG).
1. Who is responsible
The controller for pike90.app and the Pike app is Daniel Granzer, Vienna, Austria, reachable at info@pike90.app. Pike is a hobby project run by one person; there is no data protection officer, because none is required.
2. The short version
- The marketing site sets no cookies and runs no analytics. The app runs no analytics either. There is no advertising and nothing is sold or shared with anyone for their own purposes.
- Everything you log in the app is visible to the members of your league and to nobody else. There are no public profiles, no discovery and no search.
- Some of what you log is health data: body weight, waist, strength and ramp tests, pulse counts, neck-down photos and the alcohol ledger. You choose to enter it, and you can delete it.
- Three companies process data on Pike's behalf: Clerk for sign-in, Convex for the database and file storage, and the hosting provider that serves the pages. Push notifications additionally pass through your browser vendor's push service.
- Delete your account yourself under Me, or write to info@pike90.app to see, correct or delete your data. Requests are answered within a month, deletion usually within days.
3. The marketing site (pike90.app)
The site is a set of static pages. It sets no cookies, uses no local storage, loads no third-party scripts and embeds no fonts or images from other servers.
When you open a page, the hosting provider (Vercel Inc. (USA)) receives your IP address, the page you asked for, the time, and the browser and device identifiers your browser sends with every request. The provider keeps such access logs for a short time for operating the service and defending against attacks. Legal basis: legitimate interest in running a secure website (Art. 6 (1) (f) GDPR).
4. Signing in (Clerk)
Accounts are handled by Clerk (Clerk, Inc., San Francisco, USA). Clerk stores your email address, your name, an optional avatar and your sign-in credentials or the identity from a social login if you use one. For security, Clerk also records sign-in events with IP address, device and browser details, and sets the cookies it needs to keep you signed in.
Pike itself stores only your Clerk user id, your display name and the avatar URL, refreshed each time you sign in.
Legal basis: performance of the contract, i.e. giving you an account (Art. 6 (1) (b) GDPR). Clerk's own privacy notice is at clerk.com/legal/privacy.
5. What the app stores about you
The data below lives on Convex (Convex, Inc., San Francisco, USA) on a deployment in the EU (AWS eu-west-1). Photos and clips are stored as private files that can only be read through short-lived links the app hands out to people who are allowed to see them.
| Account | Clerk id, display name, avatar URL. |
|---|---|
| Settings | Weight unit, rest timer, progression steps, rep range, personal training days, time zone (read from your device), your gladiator's look. |
| Training log | Sessions of any kind with date, duration, RPE, load, distance, notes, the exercises and every set with weight and reps; routines; per-exercise bests and history; lifetime totals; optional body weight on a session. |
| League | Which leagues you are in and your role, the track and path you picked, your recomp goal and training days, and the invite code of leagues you create. |
| Tests and measurements | Body weight and waist at baseline, mid-season and final; strength tests with load and reps; ramp tests with survival time and optional pulse counts. |
| Photos | Up to three neck-down photos per phase (front, side, back). Private to you until the vault opens on the final day. |
| Workouts and proof | Each league workout with kind, date, duration, RPE, load, notes and one proof photo or short clip; who approved or flagged it; emoji reactions. |
| Quests | Which weekly side quests you completed, with an optional proof photo. |
| The ledger | Nights you log with drinks (type, volume, alcohol content, calories, quantity), other entries, an optional note and photo, and whether you hid the night. Emoji reactions from your league. |
| Push | The push endpoint and keys your browser issues, per device, only if you turn notifications on. |
| Votes | Ballots you cast in a vault vote, keyed to your account. |
Images you upload are downscaled in your browser before upload, which also strips camera metadata such as location. Videos are uploaded as they are, up to 25 MB.
Legal basis for the training log, settings, league and workout data: performance of the contract (Art. 6 (1) (b) GDPR). Body weight, waist, strength and ramp tests, pulse, photos and the ledger are health data under Art. 9 GDPR. Pike processes them only because you enter them yourself and thereby give explicit consent (Art. 9 (2) (a) GDPR). You can withdraw that consent at any time by deleting the entries, leaving the league or deleting your account under Me; a league needs the measurements and photos to score the recomposition quadrant, so leaving them out means those points are not awarded.
6. Who can see what
- Your league: every member of a league sees the board, the feed with your workouts and proofs, your measurements and test results as scores, your ledger nights unless hidden, your gladiator and your reactions. The commissioner sees the same and can additionally verify, dispute and remove workouts. Nothing in the league is visible to anyone outside it.
- Your own log: sessions, routines, records and settings are yours and are shown to nobody else, except the parts you submit to a league as a workout.
- Photos: baseline, Day-45 and Day-90 photos are private to you until the commissioner opens the vault on the final day. After that, pairs of your Day-1 and Day-90 silhouettes appear in the blind vote labelled with a letter, never with your name.
- The vault link: when the vault is open, anyone holding the link can view the lettered silhouette pairs and cast a ballot. The commissioner decides whom to send it to and can seal the vault at any time, after which the link only shows that voting has closed.
- Hidden nights: a hidden ledger night is not shown to the league, but it still counts toward the Temperance bonus and the hungover state, because the score would otherwise be gameable.
7. Push notifications
Notifications are off until you turn them on in Me, per device. Your browser then creates a subscription with a push service run by your browser vendor (Google for Chrome and Android, Apple for Safari and iOS, Mozilla for Firefox). Pike stores the endpoint and keys and sends the notification text (slumps, the Monday quest, a streak nudge, the Sunday review, the end of the season) through that service, encrypted to your device.
Legal basis: consent (Art. 6 (1) (a) GDPR). Turn notifications off in Me, or revoke the permission in your browser, and the subscription is deleted. Subscriptions the push service reports as dead are deleted automatically.
8. The public vote, without an account
Someone who opens a vault link without signing in gets a random id stored in their browser so their ballot can be revisited and changed. Pike stores that id and the picks made with it. No name, email or IP address is attached. The id can be removed by clearing the site's data in the browser.
Legal basis: legitimate interest in running the vote once per device (Art. 6 (1) (f) GDPR).
9. Cookies and storage on your device
The marketing site sets nothing. The app uses only what it needs to work, so no consent banner is shown (§ 165 (3) TKG 2021):
- Clerk session cookies that keep you signed in. Strictly necessary.
- Local storage for your theme choice, the league you last opened, the anonymous voter id, and sets you logged while offline so they can be replayed when you are back online.
- A service worker cache of the app's own files so the app opens without a connection. It never caches your data.
10. Processors and transfers
Pike runs on services from these companies, each bound by a data processing agreement and acting only on Pike's instructions:
| Clerk, Inc. (USA) | Sign-in, accounts and sessions. |
|---|---|
| Convex, Inc. (USA) | Database, file storage, scheduled jobs and push dispatch. Data stored in the EU (AWS eu-west-1). |
| Vercel Inc. (USA) | Serves the pages of the site and the app; access logs. |
| Google, Apple, Mozilla | Push services, only for the notification text and only if you turned notifications on. |
Where these companies process data in the United States, the transfer rests on their certification under the EU-US Data Privacy Framework and, in addition, on the EU standard contractual clauses in the processing agreements (Art. 45 and 46 GDPR).
Nobody else receives your data. It is not sold, not used for advertising, and not passed to anyone for their own purposes.
11. How long it is kept
- Account, settings, training log and gladiator: as long as your account exists.
- League data, proofs and photos: for the life of the league, so the season's board and history stay readable to its members. Leaving a league deletes your measurements, tests, photos, workouts and proofs in it at once; the last member to leave deletes the league.
- Ledger nights: until you delete them or your account.
- Push subscriptions: until you turn notifications off, or until the push service reports the subscription as gone.
- Anonymous ballots: for the life of the league.
- Hosting access logs: a short period set by the hosting provider, typically days.
To delete your account and everything under it, open Me and choose Delete account. Your data on Convex, every uploaded file and your Clerk account are removed immediately. If you would rather not do it yourself, write to info@pike90.app from the email address you signed up with and it is done within 30 days, usually within a few days.
12. Your rights
Under the GDPR you can ask for access to your data and a copy of it, have it corrected or deleted, have its processing restricted, object to processing based on legitimate interest, take your data with you in a machine-readable form, and withdraw any consent you gave, without affecting what happened before.
Send requests to info@pike90.app. Pike answers within a month. If you think your data is handled unlawfully, you can complain to the supervisory authority: Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at, dsb.gv.at.
13. Security
Every connection uses TLS. Every function that reads or writes data checks that the caller is signed in and a member of the league in question. Photos and clips are private storage objects reachable only through short-lived signed links. The operator has access to the production database and storage to run the service, and uses it only for that.
14. Age
The app is meant for adults. You must be at least 18 to create an account, mainly because the ledger tracks alcohol. Pike does not knowingly store data of anyone younger; if you know of such an account, write in and it will be removed.
15. Changes
This policy is updated when the app changes what it does with data. The current version is always at pike90.app/privacy and inside the app under Me. Material changes are announced in the app. Last updated 6 September 2026.
Last updated 6 September 2026