Legal

Privacy Policy

Last updated: 27 September 2026

This describes what the software in this repository actually does with your data. It is deliberately specific, and it points at the files you can read to check it. Nothing below is aspirational.

The short version

• Everything you log is saved to your account in a database hosted by Supabase. Progress photos are the exception: they stay on your device and are never uploaded.
• The only analytics is a page counter run by Vercel, which hosts the site. It counts which pages are opened, not who opened them, and it sets no cookies. There is no advertising, no tracking pixels, and no other third-party script.
• Apart from that database, nothing leaves Arkway unless you chat with the AI Coach, or talk to it out loud on Enhanced or Unlimited.
• Your data is separated per account and is not visible to other accounts.
• Arkway does not encrypt what it stores, so anyone with access to the database can read it.

What Arkway stores

When you create an account, the app stores:

• Your email address and display name.
• A salted hash of your password, produced with Node’s scrypt. Your actual password is never written to disk and cannot be recovered from the hash (see lib/auth.js).
• If you sign in with Google, the ID Google uses for your Google account, so the next sign-in finds the same account. An account made that way has no password.
• Your date of birth. It is used to work out whether you are old enough to have an account and whether a parent needs to be involved, and for nothing else. It is stored as the date rather than as an age, so it stays correct on your birthday.
• If you are 13 to 17, a parent or guardian’s email address, and a record of whether they have approved the account.
• Your time zone, so the app knows when your day rolls over. It is detected from your browser and you can change it on your Profile.
• The date the account was created.

Under that account, it stores only what you choose to log:

• Profile details: sport, position, experience, goals, and any optional notes you fill in.
• Your weekly schedule.
• Check-ins: a 1-5 mood rating, a 1-5 soreness rating, and the date.
• Training sessions, weight-room lifts, and game stats.
• Coach feedback you type in, and the goals suggested from it.
• Your Coach Points balance and the ledger of how they were earned and spent.
• Avatar items owned and equipped.
• Safety flags: a record that a concern was raised, with a type and a date.

What Arkway never collects

• Precise location, GPS, or any device sensor data.
• Contacts, photos, camera, or microphone access.
• Payment or financial information. There are no payments in this app.
• Behavioural analytics, session recording, heatmaps, or advertising identifiers.
• Any data at all from people who do not have an account. There is no page in this app that a stranger can open.

Where it goes

Your account and everything you log under it are stored in a Postgres database hosted by Supabase (see lib/db.js). Apart from that database, there are exactly five ways information leaves Arkway, and this list is the whole list:

• The AI Coach, on every plan including Free. When you chat with the coach, your message goes to Anthropic (the company behind Claude) along with the parts of your profile, schedule, goals and recent logs the coach needs to answer about you rather than about nobody. Anthropic’s handling of that is governed by their terms, not this policy. Every plan has a daily budget for this and Free’s is the smallest; once a day’s budget is spent the coach still answers, from your own data using Arkway’s own rules, and those answers are not sent anywhere at all.
• Talking out loud, on Enhanced and Unlimited. When you press Talk, or Say the set in the Weight Room, your voice goes to ElevenLabs, which turns it into words as you speak, and the coach’s written answer goes to them to be turned into speech. It only happens while the microphone is on, which is only after you press the button, the app asks you before the first time, and Arkway keeps no audio at any point. The transcript is kept, because it becomes a message in your coach history exactly like a typed one, and you can delete it with the rest of your account.
• Fonts. Pages load their typeface from Google Fonts, which means your browser makes a request to fonts.googleapis.com and Google can see your IP address. No account data is attached to it. It is listed here because it is a request leaving your device and this list would be dishonest without it.
• Page counts. Vercel, the company that hosts the site, counts page views with its Web Analytics: which page was opened and what linked to it, the time, your browser, operating system and kind of device, and a rough location worked out from your internet address (country, region and city). Nothing you log goes with it. It sets no cookies and is not linked to your account, your name or your email; to tell visitors apart it uses a code made from the request, which Vercel throws away after 24 hours.
• Google sign-in, if you use it. “Continue with Google” sends your browser to Google to sign in, so Google knows you use Arkway. Google sends back your name, email address and account ID. Arkway sends Google nothing about you, and asks for nothing else: not your contacts, your files, or your photo.

Progress photos are not on that list and never will be. They are held in your own browser’s storage on the device that took them, they are never uploaded, and no paid plan changes that.

Voice, specifically

Voice deserves its own section because a recording of your voice is more personal than a squat number, and because you are likely under eighteen. In plain terms:

• Nothing records unless you press the button. There is no listening in the background, no wake word, and no always-on microphone.
• The app tells you audio leaves your phone before the first recording, not only here.
• The recording is not saved by Arkway, at either end. What is saved is the text of what you said, in the same place your typed messages go.
• Your voice is never used to train anything, never used to build a voice clone, and never shared with anyone other than the transcription service that turns it into words.
• Deleting your account deletes the transcripts along with everything else.
• If you would rather not, type instead. Everything the coach can do with a recording it can do with typing, and typing costs less of your plan.

Separation between accounts

Every read and write is scoped to the signed-in account. A session is an HTTP-only, signed cookie; a forged or expired one is rejected on every data request. This is covered by an automated test that creates two accounts, logs different data under each, and asserts that no read function ever returns the other account’s data (scripts/multiuser-test.js).

What a parent can see

Parent View shows the athlete’s schedule, goals, and whether anything has been flagged. It deliberately leaves out day-to-day check-ins (mood, soreness) and never shows the specifics behind a safety flag. That boundary exists so that an athlete keeps a reason to report honestly. A flag is a prompt for a conversation with a real person, not a report delivered behind the athlete’s back.

Browser storage

Arkway keeps these in your browser:

• The session cookie, which keeps you logged in.
• Settings for this device, in local storage: your choices on the Settings page, whether you have agreed to the one-time note about where your voice goes, the coach’s last greeting, so the next one is different, and whether you said no to motion access for the Coach’s background, so you are not asked again.
• Progress photos, in the browser’s IndexedDB storage. They are never uploaded.

There are no tracking or advertising cookies of any kind.

How long data is kept

Until you delete it. There is no automatic expiry and nothing is kept after you ask for it to go. Deleting your account removes your account record and everything logged under it. It is a real delete, not a hidden flag: there is no recovery window and no archived copy, which is the point.

Your rights over your data

• See it and take it with you: “Download my data” at the bottom of your Profile gives you everything the account holds as one plain JSON file. Your password hash is deliberately left out of it.
• Correct it: edit anything through the Profile page.
• Delete it: “Delete my account” on the same page. It asks for your password, or for you to sign in with Google again if that is how you log in, then removes everything. Nobody has to do it for you.
• Stop: logging is optional throughout. You can use the app while tracking almost nothing.

Progress photos are the exception to the download, because they were never uploaded. They are on your phone only, so they are not in the file and Arkway could not put them there. The Progress page has its own button to save copies of them, and you should use it: clearing your browser deletes them and there is no copy anywhere else.

Athletes under 18

Arkway is built for high-school athletes, so this matters more here than it does on most sites.

Under 13: you cannot make an account. Signup asks for your date of birth and refuses. That is not us being awkward. Services for under-13s have to get a parent’s permission in a specific, verifiable way before collecting anything at all, and Arkway cannot do that yet. Turning you away is the honest answer; taking your information and working it out afterwards would not be.

A rejected signup leaves nothing behind. The age is checked before an account is created, not after, so there is no record to delete: no date of birth, no email, no name. Creating the row and then removing it would already have collected the data the rule exists to prevent us collecting. This is what makes the age screen worth having rather than a formality — see the comment in app/api/auth/signup/route.js, where the check sits above createUser() for exactly this reason.

13 to 17: you can make an account, and signup asks for a parent or guardian’s email so they know it exists and can ask questions, see the account, or have it deleted. Being asked for their address is not the same as them having approved it, and Arkway does not claim otherwise anywhere.

A parent or guardian can ask for an account and everything in it to be deleted at any time, and the athlete can do it themselves from the Profile page.

Security, honestly stated

Passwords are hashed and salted with scrypt. Sessions are signed and HTTP-only, with a key that has to be supplied by whoever runs the app rather than being a constant sitting in the source code. Repeated wrong passwords lock an account for a while, so nobody can sit there guessing. Supabase’s public REST API, which Arkway does not use, is shut out of Arkway’s tables: row-level security is on and the API’s access is revoked (see lib/schema.sql). That part is real.

What is not in place: Arkway does not encrypt what it stores, so anyone with access to the database can read it. There is no audit logging, there are no backups, and none of this has had an outside security review. Until that changes, do not log anything you would mind being read in plain text.

Changes to this policy

If what the software does changes, this page changes with it, and the date at the top moves. The version history lives in the project repository alongside the code it describes.

Who is responsible for this data

Arkway is operated as Arkway Athlete Platform, by an individual rather than a registered company. That person is the data controller: they decide what is collected and why, and they are who you exercise your rights against. There is no company standing between you and them.

Four other companies process data on Arkway’s behalf, and only for the jobs described above: Vercel, for hosting the site and counting page views; Supabase, for hosting the database that holds your account and everything you log; Anthropic, for the AI Coach on every plan; and ElevenLabs, for turning your voice into words and reading the coach’s answers out loud, on Enhanced and Unlimited. Neither Anthropic nor ElevenLabs receives anything unless you use the feature it powers.

Contact

Questions about your data — what is held, getting a copy, correcting it, or having it deleted: support@arkwayapp.com. A parent or guardian can use the same address on behalf of an athlete under 18.

If you are running your own copy of Arkway, the data controller is whoever runs it and the questions above go to them instead. This policy describes what the software does; it cannot speak for someone else’s installation of it.