Privacy Policy.
Last updated: September 14, 2026
1. Who we are
streak. is a daily discipline tracking application developed and operated by Julius Petrik, a sole trader (živnostník) registered in the Slovak Republic, IČO: 09412859 ("we", "us", or "our"). We are the data controller for all personal data processed through the streak. mobile application and the gostreak.app website.
For any privacy-related enquiries, contact us at support@gostreak.app.
2. Data we collect
We collect only what is necessary to provide the service. The categories of data we process are:
Account data
- Email address
- Password hash (stored by Supabase — we never see your plaintext password)
- Display name (optional)
- OAuth tokens when you use Sign in with Apple or Sign in with Google (we store only the opaque user identifier, not your Apple/Google password)
- Country (a two-letter country code derived from your device's region setting at first launch — used for regional availability of rewards and aggregate statistics; never precise location, and we do not use GPS)
Activity data
- Challenges you create: name, emoji, type, frequency, duration
- Check-in records: which challenge, on which date, via timer or manual tap
- Focus session records: start time, planned duration, actual duration, completion status
- Optional notes attached to check-ins (max 280 characters)
- Community challenge participation: which challenges you join, your progress and streak within them, comments and likes you post
- Streak state: current and longest streak, streak freezes held and used, streak repairs
- SPARK ledger: every earning and spending of the in-app SPARK currency (amount, reason, timestamp) and redemptions in the rewards shop
- Badges you have earned
- Coach chat: the messages you send to the in-app AI coach and the replies you receive
Health & activity data — only if you connect a health platform; see Section 3.
Device and usage data
- Device model and operating system version
- App version
- Push notification token (for sending reminders)
- Product analytics events (screens visited, features used) processed via PostHog under a pseudonymous identifier — used only to improve the product, never for advertising
Payment data
Subscriptions are purchased through Apple's App Store or Google Play. Payment is processed entirely by Apple or Google — we never see or store your card number or payment details. We receive subscription status and entitlement information (which plan is active, renewal and expiry dates) through RevenueCat, referenced by a pseudonymous app user ID.
Prize challenges & winners
If you win a challenge with a prize, we process the data needed to deliver it (for a physical prize, the delivery details you provide). We publish your display name as a winner only with your consent, given after winning; without consent the result is announced without identifying you.
3. Health & activity data
You can optionally connect streak. to Apple Health (iOS), Health Connect (Android) or Strava to verify sport activity. If you do:
- We read workout records (activity type, start and end time, duration, distance where present, and the identifier of the app that recorded the workout) and daily step counts. We read nothing else — no heart rate, no clinical records, no location.
- Access is read-only and controlled by the permissions you grant in the health platform. You can revoke it at any time in your device's health settings; revoking stops all further reading.
- Verified workouts are stored in your account solely to confirm activity-based check-ins and award the corresponding SPARK.
- Health data is never sold, never shared with advertisers, and never used for advertising or marketing. Any benefit based on it (such as SPARK for a verified run) is provided by us within the app, not by any third party.
- Health data is processed on the basis of your explicit consent (GDPR Art. 9(2)(a)), which you give by granting the health-platform permission and can withdraw at any time as described above.
- Strava. If you connect Strava, we receive your activities (sport, start time, duration, distance, and the activity identifier) through Strava's API, under the permissions you grant on Strava's authorization page — including private activities if you allow it, used only to verify. Access is read-only: streak. never writes to Strava. Access tokens are stored on our server, never on your device. Activity data from Strava is kept for at most 7 days; after that only the fact that a verified activity took place, its day and what it earned remain. Strava data is shown only to you, is never combined across users and never used with AI features, and is deleted when you disconnect (in the app or at strava.com/settings/apps) or delete your account. Strava's own privacy policy applies to your Strava account.
4. Why we collect it
| Purpose | Lawful basis (GDPR) |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Delivering the challenge tracking, streak, focus timer, SPARK, and rewards features | Performance of a contract (Art. 6(1)(b)) |
| Managing your subscription entitlement (via RevenueCat) | Performance of a contract (Art. 6(1)(b)) |
| Verifying sport activity through your health platform | Explicit consent (Art. 9(2)(a)) — opt-in only |
| Sending push notifications (reminders, streak milestones) | Consent (Art. 6(1)(a)) — opt-in only |
| Generating AI insights, summaries, and coach replies | Performance of a contract (Art. 6(1)(b)) |
| Running prize challenges, contacting and (with consent) announcing winners | Performance of a contract (Art. 6(1)(b)); consent (Art. 6(1)(a)) for publishing the winner's name |
| Sending marketing emails — newsletter, product news, offers on streak. Pro | Legitimate interest (Art. 6(1)(f)) in telling the people who use streak. about streak.'s own features, plans and events: the address is the one you registered with, you are told at sign-up, and every message carries a one-click unsubscribe. For people who have bought from us this is also covered by the existing-customer rule in Act No. 452/2021 Coll. Where consent (Art. 6(1)(a)) is required instead it is asked separately, never pre-ticked, and withdrawable at any time — accepting the Terms is not that consent. |
| Analysing product usage to improve the app (PostHog) | Legitimate interest (Art. 6(1)(f)) |
| Diagnosing crashes and errors in the app (Sentry) | Legitimate interest (Art. 6(1)(f)) |
| Preventing abuse of the SPARK economy, rewards, and prize challenges | Legitimate interest (Art. 6(1)(f)) |
| Complying with legal obligations (e.g. accounting, fraud prevention) | Legal obligation (Art. 6(1)(c)) |
5. Third-party services
We share data with the following processors to operate the service. Each is bound by a data processing agreement.
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Supabase | Database, authentication, edge functions | All user and activity data | EU (AWS eu-central-1) |
| RevenueCat | Subscription entitlement management | Pseudonymous app user ID, subscription status (no payment details) | US (Standard Contractual Clauses apply) |
| Apple / Google | In-app purchase processing, Sign in with Apple/Google, push delivery (APNs/FCM) | Store account handles the payment; we receive no card data. Opaque sign-in ID, push token. | US/EU (Apple and Google DPAs apply) |
| Google (Gemini API) | AI features: coach chat, insights, weekly summaries, nudges | Activity statistics (check-ins, streaks, challenge names) and the messages you write to the coach — never your name, email, or account identifiers | US/EU (Google DPA and SCCs apply) |
| PostHog | Product analytics | Pseudonymous usage events (screens, feature usage, device model/OS) | EU (EU cloud) |
| Sentry | Crash and error reporting | Pseudonymous app user ID, device model/OS, app version, and the technical detail of an error — the stack trace and the screens visited just before it. Never your name, email or health data. | US (Standard Contractual Clauses apply) |
Health data from Apple Health, Health Connect or Strava is not shared with the AI provider, PostHog, Sentry, or any advertising service. It is stored in Supabase (EU) solely for activity verification as described in Section 3.
We do not sell your personal data to any third party. We do not use your data for advertising purposes.
6. Your GDPR rights
If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you.
- Right to rectification — ask us to correct inaccurate or incomplete data.
- Right to erasure — request deletion of your account and all associated data. You can do this from Settings → Delete Account inside the app; deletion is immediate and permanent.
- Right to data portability — request a machine-readable export of your data (challenges, check-ins, focus sessions, SPARK ledger) by emailing support@gostreak.app.
- Right to restriction — ask us to suspend processing of your data in certain circumstances.
- Right to object — object to processing based on legitimate interest (e.g. product analytics). We will stop unless we have compelling legitimate grounds.
- Right to withdraw consent — where processing is based on consent (health data, push notifications, cookies, winner publication), you can withdraw at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email support@gostreak.app. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
7. Data retention
We retain your data for as long as your account is active. When you delete your account:
- All data is permanently and irreversibly deleted immediately — account, challenges, check-ins, focus sessions, notes, comments, SPARK ledger, streaks, badges, verified workouts, coach conversations, and any associated files.
- Apple, Google, and RevenueCat retain purchase records under their own legal obligations; we have no control over this. Remember that deleting the account does not cancel a store subscription — cancel it in your App Store or Google Play settings.
- Anonymised, aggregated analytics (with no link to your identity) may be retained indefinitely.
- Records we are legally required to keep (e.g. accounting records for prize deliveries) are retained for the statutory period and no longer.
8. Cookies
The gostreak.app website uses a single analytics cookie to understand aggregate visitor behaviour (pages visited, session duration, referral source). No personal profile is built; the data is anonymised.
We obtain your consent via the cookie banner shown on your first visit. You can withdraw consent at any time by clicking "Decline" in the banner or clearing your browser cookies. Declining does not affect your ability to use the website.
The streak. mobile app itself does not use cookies.
9. Push notifications
The app sends push notifications for daily reminders, streak milestones, streak-protection alerts (e.g. when a freeze was used or a streak can be repaired), and (optionally) community challenge updates. We request OS-level notification permission only after you create your first challenge or on your second app launch — never on first open.
You can disable push notifications at any time from your device's Settings app or from within streak. → Settings → Notifications. Disabling notifications does not affect any other app functionality.
10. Children
streak. is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with their data, please contact us at support@gostreak.app and we will delete the data promptly.
Users in the EEA must be at least 16 years old, or have verifiable parental consent, to create an account.
11. Changes to this policy
We may update this Privacy Policy from time to time. When we make material changes, we will notify you via email or an in-app notice at least 14 days before the changes take effect. The "Last updated" date at the top of this page reflects the most recent revision.
Continued use of streak. after the effective date of a revised policy constitutes acceptance of the new terms.
12. Contact
For any questions, requests, or concerns regarding this Privacy Policy or your personal data:
- Email: support@gostreak.app
- Company: Julius Petrik, živnostník, IČO: 09412859, Slovak Republic
We aim to respond to all privacy requests within 30 days.