SendMode Privacy Policy

Last updated: 7 October 2026 Effective date: 19 September 2026

This policy is published at https://timechamberstudios.com/privacy.

Who we are

SendMode is a fitness app made and operated by Time Chamber Studios ("SendMode," "we," "us") that turns your real workouts into an in-app currency called watts (⚡). This policy explains what data we collect, why, how we protect it, and the choices and rights you have.

If you have any questions, contact us at privacy@timechamberstudios.com.

The short version

We collect the workout and account data we need to run the app — nothing more.
We never sell your data, and we never use it for advertising or share it with data brokers.
We use no third-party analytics or advertising SDKs. The app does not track you across other apps or websites.
Your health and fitness data is used only to calculate your watts, streaks, achievements, and leaderboard position — and, if you allow it, to show you a movement summary that stays on your phone.
You can delete your account and personal data from inside the app at any time (Profile → Delete Account).

What we collect

We collect only the following, all linked to your account and used only to provide the app's features (never for tracking or advertising):

Data	What it is	Why we need it
Account identifier	A one-way hash of your email address (from Sign in with Apple or email registration) and a random user ID. We store a hash of your email, not the email itself.	To create and secure your account and sign you in.
Display name	An optional username you choose.	Shown on your profile and the leaderboard, and on the profile card other players see when they tap your leaderboard row.
Time zone	The name of your device's time zone (for example `America/Los_Angeles`), reported by the app whenever it changes.	So your streak, daily achievements and "today" reset at your midnight rather than ours. (Daily and weekly earning caps stay on universal time — a shared safety limit needs a clock nobody can move.) Not used for anything else and never shown to other players.
Workout / fitness data	Distance, duration, pace, elevation, heart rate, calories, activity type, and start/end times of your workouts — imported from Apple Health, entered manually, or (if you connect it) synced from Strava.	To calculate the watts, streaks, and achievements you earn, and your leaderboard rank. Some cosmetic items react to this data, and wearing one publishes a coarse version of what it shows: the Kilometer Cloak shows your lifetime distance rounded down to the nearest 25 km, and the PR Strobe shows that you set a personal record in the last 24 hours (to the hour, never the exact time). Both are shown only while you have that item equipped. If you and another player follow each other, each of you can also see a limited view of the other's workout history — see Following, blocking and reporting below.
Watts ledger	An append-only record of every watts transaction (amount, reason, source, timestamp).	To keep your balance honest and auditable — this is the core of the app.
Cosmetics & progress	Items you own or have equipped, packs opened, achievements unlocked.	To render your avatar and track your collection. Your avatar, currently equipped items, and current streak length are visible to other signed-in players on your profile card, along with the coarse workout figures any reactive item you are wearing displays (see Workout / fitness data); what you own but haven't equipped, and when you acquired anything, are never shown to others.
App usage events	Which screens you open and which actions you take in the app — sign-in, onboarding steps, logging or syncing a workout, opening a pack, equipping an item — with a timestamp, your app version, and the platform. No free text, no location, no health or workout data, and no advertising identifier: the list of event types is fixed and each one carries only short machine-readable tags (checked server-side to be lowercase letters, digits and underscores — never prose).	To measure whether people come back and where new users get stuck, so we can fix the parts that don't work. Off by default — nothing is collected unless you opt in, either at the ask during onboarding or with "Share Usage Data" in Profile, and turning it off discards anything already held on your device. This is first-party only: no analytics SDK, and the events go to our own server, never to a third party. Deleting your account unlinks these events from you permanently and coarsens their timestamps to the day, so they cannot be matched back to your workouts.
Push notification token	An Apple-provided device token, if you enable notifications.	To send you the notifications you opt into (e.g. an achievement unlock). You can turn off social notifications (new followers, friends passing you) with "Social Notifications" in Profile.
Security logs	Authentication events (sign-in, sign-out, token refresh, profile changes) and social actions (follows, unfollows, blocks, unblocks and reports), with IP address and a hashed device user-agent.	To protect your account and detect abuse, including harassment between players. Deleted automatically after 90 days; if you delete your account, they are de-identified immediately (account link, IP address, and device fingerprint removed) and the anonymous remainder ages out on the same schedule.

We do not collect precise GPS location, contacts, photos, advertising identifiers, or browsing history. We do not track you across other apps or websites, and we share nothing with data brokers or advertisers.

Health data (Apple Health / HealthKit)

If you grant permission, SendMode reads workout data from Apple Health to award watts. Per Apple's rules and our own policy:

Workout data from HealthKit is used solely to power your watts, streaks, achievements, and leaderboard position — and, if you and another player follow each other, to show them the limited view of your workout history described in Following, blocking and reporting, which you can switch off at any time.
Under the same Apple Health permission, we also read your daily walking/ running distance and active energy (if you allowed those types) to show you a Movement summary in Stats. That daily data is read and displayed on your device only — it is never sent to our servers and never earns watts.
We never use HealthKit data for advertising or marketing, never sell it or share it with data brokers, and never store it in iCloud or CloudKit.
You can revoke Health access at any time in the iOS Settings → Privacy & Security → Health → SendMode.

Following, blocking and reporting

Following. Any signed-in player can follow you; you don't approve it. A follow puts you in their FRIENDS leaderboard filter and lets the app tell them when you pass them on the weekly leaderboard. You get a notification that they followed you (unless you turn social notifications off). Your profile card shows how many followers you have — a number, never a list; only you can see who your followers are.
Your workout history. If you and another player follow each other, each of you can open the other's workout history from their profile card: for each workout, the activity type, the date and time it started, distance, duration, pace, and the watts it earned. Never your heart rate, calories, or where the workout came from. Following someone is what offers them your history: if they follow you too — before or after you follow them — they can open it. Someone who follows you but whom you don't follow cannot see it, and unfollowing them takes it away again. "Workouts Visible to Followers" in Profile hides your history from everyone, including mutual follows.
Blocking. Blocking a player removes any follows between you in both directions, stops either of you following the other, and hides your profile card and history from them. They can still see your leaderboard row — handle, standing, avatar and streak — like anyone else, including on any competition board you share. We keep a block while it is in place.
Reporting. When you report a player, we store who reported whom, the reason you picked from a fixed list, and when — no free text. We review reports and delete each one once it has been handled; the security log keeps a record that a report was made for 90 days.

Deleting your account removes your follows, blocks and reports, in both directions.

How we use your data

We use your data to:

Provide the core loop — import workouts, calculate watts, track streaks and achievements, and rank you on leaderboards.
Maintain your account, sign you in, and keep your session secure.
Send notifications you have opted into.
Detect, prevent, and investigate fraud, abuse, and security incidents.
Diagnose and fix problems and improve the app (using our own logs only — no third-party analytics SDKs).

We do not use your data for advertising, and we do not make automated decisions that produce legal or similarly significant effects about you.

What we never do

We never sell your personal data.
We never share your data with advertising networks or data brokers.
We never use third-party tracking or advertising SDKs.
We never put your health data in iCloud/CloudKit.

Our future data-marketplace principle (not active today)

SendMode's long-term vision includes an opt-in program that would let you choose to share anonymized fitness data and be paid a share if it is ever sold. This program does not exist yet. If we ever build it, it will be strictly opt-in, it will require your explicit, separate consent, you will be able to withdraw at any time, and we will update this policy and notify you before any such feature becomes available. Until then, nothing about your data is sold or shared for value, period.

Who we share data with

We share data only with the service providers required to run the app, and only as needed:

Hosting & database — our backend runs on a cloud host (currently Fly.io) with a managed PostgreSQL database. Your data is stored there.
Apple — for Sign in with Apple, HealthKit (on your device), and the Apple Push Notification service (if you enable notifications).
Strava — only if you choose to connect Strava, and only to sync the activities you authorize. You can disconnect at any time.

These providers process data on our behalf under their own terms; we do not authorize them to use your data for their own purposes. We may also disclose data if required by law or to protect the rights, safety, and security of our users and SendMode.

How long we keep it

Account and workout data is retained while your account is active.
Security logs are deleted automatically after 90 days, and de-identified immediately if you delete your account.
App usage events are deleted automatically after 180 days.
Reports are deleted once we have reviewed them; blocks are kept until you lift them.
When you delete your account (below), we de-identify your account immediately: your email hash is scrambled, your username, sign-in credentials, connected-service tokens, notification tokens, follows, blocks and reports are removed, and your account can no longer be logged into or linked back to you. We retain the resulting anonymized workout and watts records, which are no longer personal data.

Deleting your account

You can delete your account at any time from Profile → Delete Account inside the app. This permanently removes your personal data as described above and signs you out. This action cannot be undone. If you need help, contact privacy@timechamberstudios.com.

Two things are worth being specific about. Your watts ledger and workout records are kept in de-identified form — they no longer point to you, but the totals remain, because the ledger is append-only and other people's leaderboard history depends on it. Your app usage events are unlinked from you in the same pass: the counts survive, the connection to you does not.

Your rights and choices

Depending on where you live (for example, under the EU/UK GDPR or the California CCPA/CPRA), you may have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to not be discriminated against for exercising these rights. Because we do not sell or share personal data for advertising, there is no "sale" to opt out of. You can exercise the deletion right directly in the app; for any other request, contact privacy@timechamberstudios.com and we will respond as required by applicable law.

International users

We operate from the United States and process data there. If you use SendMode from outside the US, you consent to your data being transferred to and processed in the US and other countries where our service providers operate, which may have different data-protection laws than your own.

Children

SendMode is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact privacy@timechamberstudios.com and we will delete it.

Security

We protect your data with encryption in transit (HTTPS/TLS), hashed account identifiers, hashed passwords (Argon2id) for email accounts, scoped access tokens, and standard operational safeguards. No system is perfectly secure, but we work to protect your data and to respond promptly to any incident.

Changes to this policy

We may update this policy. When we make material changes, we will update the "Last updated" date and, where appropriate, notify you in the app. Continued use after an update means you accept the revised policy.

Contact

Questions or requests: privacy@timechamberstudios.com