NoFlake helps you keep workout and arrival promises. This policy covers the app, invitation webpages, and account service. It explains what stays on your device, what is sent to the service, and what other participants can see.
1. Your account
The app requires Sign in with Apple. We verify Apple’s authorization response and store an app-specific Apple user identifier, encrypted authorization credentials, your display name, and a public account ID. Your name from Apple can be used as your initial display name; you can change it in the app. We do not request your email address from Apple.
Account information lets you sign in, recover account-based promises on another device, and join or manage shared promises. A signed-in person who knows your full account ID can look up your display name and send an invitation. You choose whether to accept. Session credentials are stored in the device Keychain, and the service stores their hashes. Sessions expire after 180 days.
2. Apple Health and workout verification
With your permission, NoFlake uses HealthKit to read supported workouts, including activity type, distance, duration, start and end times, the source, and whether a workout was manually entered. For hiking altitude goals, it reads workout-route locations to find the highest recorded altitude. Workout records and evidence are processed and cached on your device. NoFlake does not write, edit, or delete Apple Health data.
For account-based workout promises, the app sends a limited verification summary: workout identifier, activity, start and end times, the qualifying distance, duration or altitude value, and the manual-entry flag. The service uses it to check the promise and prevent one workout from fulfilling multiple promises. It retains a completion record with its time and workout identifier. Accepted members can see progress and completion records; another person’s workout identifier is not shown to them.
NoFlake does not upload raw workout routes, heart rate, or full workout files to its account service. Older local promises and full local workout evidence do not sync through your NoFlake account. Apple’s Health storage and syncing are controlled separately by your Apple settings.
3. Arrival promises and location
The service saves a promise’s title, time, time zone, venue name, address and coordinates, optional notes, invitation and membership details, participation replies, arrival results, and arrangement history. Anyone with an invitation link can preview the basic arrangements, including the chosen venue. Active participants can see member names and participation states.
When you tap “I’m here,” the app obtains a current location and sends its coordinates, accuracy and timestamp to the service. The service checks whether it is within the venue’s range and the allowed time window. It does not retain that location sample or display your current coordinates to other participants; it retains the arrival result and time.
Optional arrival detection must be enabled for each promise. It operates within the window from two hours before the planned time to six hours after it. On a nearby event, it obtains a fresh location for the same server check. It does not upload continuous location or movement history. iOS may delay or prevent background detection. Apple’s map, place-search and geocoding services handle searches and location requests under Apple’s own privacy terms.
4. Shared progress and your pigeon
Account-based promises store their rules, deadlines, periods, members and witness roles, completion records and responses. Historical entries may contain notes supplied under earlier versions. New workout promises cannot be completed by a self-reported check-in.
Your pigeon’s name, growth and milestone memories are stored with your account. Promise Score is calculated from the records available in the app for personal motivation. It is not a credit score. When you choose to export a result card, it may include participants’ display names and outcomes. Share only with the people or services you intend.
5. Storage, providers and retention
Vercel hosts the website and API, and a Postgres database stores account and shared-promise data. These providers process information to operate the service. Requests may appear in hosting logs. Short-lived IP-based and account-based counters help prevent abuse; some unauthenticated request counters temporarily contain the IP address, while others use a hash. NoFlake does not use health data for advertising, sell health data, or use advertising tracking.
Account and shared-promise records currently have no automatic retention cutoff. Account deletion removes your account data and treats retained shared history as described below. Local preferences and evidence remain on the device until removed using available app controls or by removing the app. Hosting logs follow the provider’s retention settings. NoFlake cannot delete screenshots, shared cards, or calendar entries already exported to another person or app.
6. Permissions and deletion
You can revoke Health or location access in iPhone Settings, disable arrival detection for a promise, and turn reminders off. Refusing Health access prevents workout verification; refusing location access prevents arrival verification. You can still use features that do not need that permission.
To delete your account, open Me, tap your account, choose Account management, then Delete account and confirm. The service revokes the Apple authorization, removes your account credentials, sessions, invitations, workout completion records and pigeon data, and cancels promises you hosted. Some shared promise titles, notes, venue details and other participants’ history remain. Your name is removed from retained arrival records, and your arrival status and time are cleared; pseudonymous record references can remain. If revocation cannot finish, the app lets you retry. Account deletion does not delete workouts from Apple Health or older local workout records. Contact us if shared content still contains personal information you want removed.
A one-way digest of the Apple identifier is kept for ten minutes after deletion to block sign-in attempts started before the deletion. It is removed after expiry during a subsequent sign-in or deletion request. Contact support@noflake.fun for help with a privacy or deletion request. Do not send passwords, Apple authorization codes, or session credentials.
7. Children and changes
NoFlake is not intended for children under 13. We update this policy when the service or its data handling changes. The date above identifies the current policy.
8. Contact
For support or questions about your information, email support@noflake.fun.