Privacy Policy · Challr

This policy explains what personal data the Challr app (“the app”) collects, why, and what you can do about it.

Who we are

The app is made by Challr Labs, a team based in Azerbaijan. In this policy, “we” and “us” mean Challr Labs. You can contact us at support@challrapp.com.

Summary

The app collects the personal data listed below, for the reasons given.
We do not track you across apps and websites owned by other companies.
We do not sell your personal data.
We do not share your personal data with other companies for their own use.

Data we collect

Your name, from your Apple or Google account (you can change it) (Contact Info). Collected by the app and Supabase. It is used to make the app work. It is linked to your identity.
Email address, from your Apple or Google account (Contact Info). Collected by the app and Supabase. It is used to make the app work. It is linked to your identity.
User ID, the random ID of your Challr account (Identifiers). Collected by the app, Supabase, PostHog, Firebase Crashlytics (Google) and Superwall. It is used to make the app work and to understand how the app is used. It is linked to your identity.
Your Google account ID, when you sign in with Google (Identifiers). Collected by Google Sign-In (Google). It is used to make the app work. It is linked to your identity. Giving it is up to you.
Push notification token, with your notification settings, device model, language and time zone (Identifiers). Collected by the app and Supabase. It is used to make the app work. It is linked to your identity. Giving it is up to you.
Push token and app version, used to deliver notifications on Android (Identifiers). Collected by Firebase Cloud Messaging (Google). It is used to make the app work. It is linked to your identity. Giving it is up to you.
An install or device ID (never the advertising ID) (Identifiers). Collected by Firebase Crashlytics (Google), Google Maps SDK (Google), AppsFlyer and Superwall. It is used to make the app work and to understand how the app is used. It is linked to your identity.
Approximate location (region or city), worked out from your IP address (Location). Collected by AppsFlyer, Superwall and Google Sign-In (Google). It is used to make the app work and to understand how the app is used. It is linked to your identity.
Precise location: one pin, only when a challenge asks for a location proof and you send it (Location). Collected by the app and Supabase. It is used to make the app work. It is linked to your identity. Giving it is up to you.
Photos and videos you send as proof (private: only you and the person who challenged you can open them) (User Content). Collected by the app and Supabase. It is used to make the app work. It is linked to your identity. Giving it is up to you.
Profile photo and pictures you add to a challenge (anyone with their link can open them) (User Content). Collected by the app and Supabase. It is used to make the app work. It is linked to your identity. Giving it is up to you.
Voice notes you record as proof (User Content). Collected by the app and Supabase. It is used to make the app work. It is linked to your identity. Giving it is up to you.
What you write: challenges, rewards, messages, text proofs, dare links and their ideas, and feedback about the app (User Content). Collected by the app and Supabase. It is used to make the app work. It is linked to your identity.
Who you connect with in Challr, and anyone you remove, block or report (Other Data). Collected by the app and Supabase. It is used to make the app work. It is linked to your identity.
Your Challr Pro subscription purchase (Purchases). Collected by Google Play Billing (Google) and StoreKit (Apple), Superwall and PostHog. It is used to make the app work and to understand how the app is used. It is linked to your identity.
Promo codes you enter, and the access they give you (Purchases). Collected by the app, Supabase and PostHog. It is used to make the app work and to understand how the app is used. It is linked to your identity. Giving it is up to you.
How you use the app: screens you open, key actions and app opens, with your device model, system version and IP address (Usage Data). Collected by PostHog. It is used to understand how the app is used. It is linked to your identity.
App installs and opens, used to open an invite after install and to spot fraud (Usage Data). Collected by AppsFlyer. It is used to make the app work and to understand how the app is used. It is not linked to your identity.
Paywall views, with your device model and system version (Usage Data). Collected by Superwall. It is used to make the app work. It is linked to your identity.
Crash reports and app sessions: what the app was doing when it crashed, when a session starts, your device model and system and app version (Diagnostics). Collected by Firebase Crashlytics (Google). It is used to make the app work and to understand how the app is used. It is linked to your identity.
Launch time and battery level, used to spot fraud (Diagnostics). Collected by AppsFlyer. It is used to make the app work. It is not linked to your identity.
Map details on Android: device details, IP address, map crashes, and how the map was moved or zoomed (Diagnostics). Collected by Google Maps SDK (Google). It is used to make the app work and to understand how the app is used. It is not linked to your identity. Giving it is up to you.
Emails you send to support, with the device details the app adds: app and system version, device model, network type, region, VPN or proxy on (User Content). Collected by the app. It is used to make the app work. It is linked to your identity. Giving it is up to you.
If you send a dare from a dare link on the web (no account): the dare, your IP address and a browser fingerprint, kept to block abuse (Other Data). Collected by challrapp.com dare pages (our website) and Supabase. It is used to make the app work. It is not linked to your identity. Giving it is up to you.

Data that stays on your device

Saving to your photo library: When you tap Save, the app adds the story image or video you made to your photo library. On iPhone it asks only for permission to add, not to read. This data is not sent to us or to anyone else.
Unsent challenge drafts and your recent searches: Kept on your phone. A draft leaves it only when you send the challenge. This data is not sent to us or to anyone else.

Services we use

Supabase: Our backend: accounts, the database, file storage and the live challenge threads. It receives: your name, from your Apple or Google account (you can change it), email address, from your Apple or Google account, user ID, the random ID of your Challr account, push notification token, with your notification settings, device model, language and time zone, precise location: one pin, only when a challenge asks for a location proof and you send it, photos and videos you send as proof (private: only you and the person who challenged you can open them), profile photo and pictures you add to a challenge (anyone with their link can open them), voice notes you record as proof, what you write: challenges, rewards, messages, text proofs, dare links and their ideas, and feedback about the app, who you connect with in Challr, and anyone you remove, block or report, promo codes you enter, and the access they give you and if you send a dare from a dare link on the web (no account): the dare, your IP address and a browser fingerprint, kept to block abuse. Its privacy policy.
Sign in with Apple (Apple): Sign-in with your Apple ID. Apple gives the app your name and email address. It gets no personal data from the app. Its privacy policy.
Google Sign-In (Google): Sign-in with your Google account. Google gives the app your name and email address. It receives: your Google account ID, when you sign in with Google and approximate location (region or city), worked out from your IP address. Its privacy policy.
Superwall: The paywall and Challr Pro subscriptions. It receives: user ID, the random ID of your Challr account, an install or device ID (never the advertising ID), approximate location (region or city), worked out from your IP address, your Challr Pro subscription purchase and paywall views, with your device model and system version. Its privacy policy.
Google Play Billing (Google) and StoreKit (Apple): Takes the payment for a Challr Pro subscription in Google Play or the App Store. It receives: your Challr Pro subscription purchase.
PostHog: Product analytics: which screens and actions are used. It receives: user ID, the random ID of your Challr account, your Challr Pro subscription purchase, promo codes you enter, and the access they give you and how you use the app: screens you open, key actions and app opens, with your device model, system version and IP address.
Firebase Crashlytics (Google): Crash reports. It receives: user ID, the random ID of your Challr account, an install or device ID (never the advertising ID) and crash reports and app sessions: what the app was doing when it crashed, when a session starts, your device model and system and app version. Its privacy policy.
Firebase Cloud Messaging (Google): Delivers push notifications on Android. A notification's text can carry the other person's name and the challenge's title and reward. It receives: push token and app version, used to deliver notifications on Android. Its privacy policy.
Apple Push Notification service (Apple): Delivers push notifications on iPhone. A notification's text can carry the other person's name and the challenge's title and reward. It gets no personal data from the app. Its privacy policy.
AppsFlyer: Opens the invited challenge after someone installs from an invite link. No ad attribution, no in-app events, advertising ID off. It receives: an install or device ID (never the advertising ID), approximate location (region or city), worked out from your IP address, app installs and opens, used to open an invite after install and to spot fraud and launch time and battery level, used to spot fraud. Its privacy policy.
Google Maps SDK (Google): Draws a location proof's pin on a map in the Android app. It receives: an install or device ID (never the advertising ID) and map details on Android: device details, IP address, map crashes, and how the map was moved or zoomed. Its privacy policy.
Google Play In-App Review (Google) and the App Store rating prompt (Apple): Lets you rate the app without leaving it. What you type goes to the store as a store review. It gets no personal data from the app. Its privacy policy.
challrapp.com dare pages (our website): The web page behind a dare link, where people without an account send a dare. It receives: if you send a dare from a dare link on the web (no account): the dare, your IP address and a browser fingerprint, kept to block abuse.

Tracking and ads

The app does not track you across apps and websites owned by other companies.

The app does not show ads from other companies.

Your account and deleting your data

You can delete your account and its data in the app: Profile › Delete account.

You can also ask us to delete your data by emailing support@challrapp.com.

How long we keep data

We keep your data until you delete your account.

Security

Data the app sends is encrypted in transit (HTTPS).

Children

The app is not meant for children under 16. If you believe a child under 16 has given us personal data, contact us at support@challrapp.com and we will delete it.

Your rights

Depending on where you live, you may have rights over your personal data, such as the right to see it, correct it, delete it, get a copy of it, or object to how it is used. To use these rights, email support@challrapp.com. You can also complain to the data protection authority where you live.

Changes to this policy

If we change this policy, we will post the new version on this page and change the date at the top.

Contact

Challr Labs: support@challrapp.com