Privacy

• Account — a handle, a display name, and a password we only ever store hashed. We do not ask for an email address or a phone number, and there is no third-party sign-in. The handle and display name are visible to anyone you share a profile or invite link with.
• Training data — the sessions, sets, reps and loads you log, the programme you follow, your streaks, XP and badges.
• Food data — meals you log, their macros, and any photo you submit for recognition.
• Body metrics you choose to enter — bodyweight and, if you add them, measurements and posture photos.
• Social graph — who you are friends with, your pair streaks, friend codes you have issued or redeemed, cheers and comments.
• Push token — only if you turn notifications on, and only so a reminder can reach the device. We run no analytics, no attribution and no crash-reporting SDK, so we do not collect device models, app usage or crash logs.

No advertising identifiers. No third-party analytics SDKs that follow you across other apps. No contact list upload — friend codes exist precisely so we never have to ask for your address book. No location tracking; if you attach a gym, that is a gym you picked from a list.

A photo you submit for recognition is passed straight through our API to OpenAI, turned into an itemised list, and returned to you for approval. We do not store it. It is held only for the seconds the request takes, is never written to our database, is never used to train models, and is never shown to other users. Nothing about the meal is saved until you press Log.

• Your friends see your live presence while you train, your finished sessions in the feed, your pair streak with them, and your league position.
• Anyone with your invite link sees your display name, handle, avatar, streak and total workout count. That is what makes an invite worth accepting. Rotate the code in the app and old links stop resolving.
• Nobody else. There is no public directory, no discovery feed, and no search by name.

getcreed.app serves static pages plus two dynamic ones — a profile page and an invite page — which read a public, unauthenticated endpoint to show who is inviting you. The site sets no cookies, runs no analytics, and stores nothing in your browser. Server logs kept by our host record IP address and user agent for a short period for abuse prevention.

Your data is kept while your account exists. Delete your account from Settings → Account → Delete account, and the account, training history, food log, photos and social graph are removed within 30 days. Backups age out within a further 30 days. Deletion is irreversible and it is not preceded by a retention offer.

You can request a copy of your data, ask for a correction, or ask us to delete it, at any time, by writing to privacy@getcreed.app. If you are in the EEA or the UK, your legal basis for the social features is contract — the app does not work without them — and for diagnostics it is legitimate interest, which you can object to.

Creed is not intended for anyone under 13, and under-16s in the EEA need a parent or guardian’s consent. We do not knowingly keep accounts for children; write to us and we will remove one.

If this policy changes in a way that affects what is collected or who can see it, the app will tell you before the change takes effect. The date at the top of this page always reflects the current version.

privacy@getcreed.app