Privacy Policy

What we collect

• Account details — your name and email address. Your password is stored only as a secure, one-way hash; we never keep it in readable form.
• Profile photo — optional; shown next to your name on the leaderboard.
• Activity data — the step counts and walk sessions you record (steps, duration, distance, and pace), plus any badges you earn.
• Motion sensor readings — while you are recording a walk, the app reads your phone's motion/step sensor on your device to count steps. The raw sensor data is not uploaded — only the resulting step count is saved.

What we do NOT collect

• No precise location or GPS tracking.
• No contacts, photos library, microphone, or camera access.
• No health or medical records beyond the step counts you record.
• No advertising identifiers, and no third-party advertising or analytics trackers.

How we use your information

Only to run the step-a-thon: to sign you in, show leaderboards and team standings, award badges, check recorded steps for realistic activity (integrity), and let event administrators manage the event. We do not sell your data or use it for advertising.

Device permissions

The app requests one sensitive permission: Motion & Fitness (iOS) / Physical Activity (Android). It is used solely to count your steps while you record a walk, and only while you are using the feature. You can decline or revoke it in your device settings; step recording simply won't work without it.

Who can see your data

• Within your event — your name, photo, and step totals appear on leaderboards visible to other participants and to the administrators of your event.
• Service providers — we host the app on Vercel and store data in a Supabase (PostgreSQL) database. They process data on our behalf under their own security and privacy commitments.
• We do not share your data with anyone else.

How we protect it

All traffic is encrypted in transit (HTTPS/TLS). Passwords are hashed with a per-user salt. Access is role-based, and each organization's data is isolated from every other. See our commitment to security in the app's security overview.

Data retention

We keep your information while your account is active. When you delete your account, your personal details, recorded steps, walks, and badges are permanently removed.

Your choices and rights

• Access & update — view and change your name, photo, and password in your profile.
• Delete — permanently delete your account and all associated data at any time from Profile → Delete account, right inside the app.
• To make any request by email, contact us at hi@thethoughtbulb.com.

Children

The app is intended for participants in organized step-a-thon events and is not directed at children under 13. If your event includes minors, it should be administered in line with the organizer's own consent and privacy requirements.

Changes to this policy

If we change this policy we will update the effective date above and, where appropriate, notify you in the app.

Contact

Questions or requests: hi@thethoughtbulb.com (The Thought Bulb).