Home

Privacy policy

Version 2026-08-04

1. Controller

The controller of your data is Bogumiła Drabarz, Koszalin, Poland. For anything concerning personal data, contact contact@hardmodechallenge.com.

2. Special category data

What you record here — the days you log, the triggers you tag, your written reflections, the outcome of the orientation questionnaire and whether you are trying to conceive — concerns your sex life. Under article 9(1) GDPR that is special category data. The only basis we rely on is your explicit consent (article 9(2)(a) GDPR), given when you create your account. Without that consent no account is created.

3. What we collect

  • E-mail address — used solely to sign you in. Basis: performance of a contract (article 6(1)(b) GDPR).
  • Nickname, time zone and language — your nickname is visible to members of your challenge; your time zone decides which day counts as “today” for your entry.
  • Daily entries — a date and one of two values.
  • Triggers — labels from a fixed list, never free text.
  • Reflections — text you write yourself. This is the most sensitive data in the Service. It is never visible to other participants, in any view or by any query. You can skip it and you can delete it.
  • If-then plans — text you write yourself. Only you see them; they exist so that they are already on the “This is hard” screen before you have to go looking for them.
  • Goal — the mode, the length or weekly limit, the check-in rhythm and the start date.
  • Challenges — the group’s name, its terms, the stake as described and the house rules written by its host, and your membership in it. A stake is a description and nothing else: the Service records no payment and no note of whether anybody settled up.
  • Requests for support — the fact that the button was pressed and the challenge it belongs to, with not one word of content. Other members of that challenge see a raised hand for a day. Records older than a week are deleted the next time you ask, and all of them go with the account.
  • Notification subscriptions — if you turn notifications on, we store the address your browser receives them at, encrypted with the application’s own key, and a language. The database holds no readable copy of that address for anyone who might read it.
  • Questionnaire outcome — we store a descriptive band and a date. Your individual answers are never stored; they are scored and discarded.
  • Consent record — the date and the version of the document consented to. This record cannot be altered or removed except by deleting the whole account, because it is the evidence that consent was given.

4. What we do not do

  • No analytics or tracking on any signed-in screen.
  • No selling or sharing of data for marketing.
  • No automated decision-making and no profiling.
  • We never ask for your name, phone number or address.

5. Measurement on the public pages

On the front page, the blog, the terms and this notice we use Google Analytics 4 to count visits and see which articles are read. The script loads only after you agree — until you choose “Allow”, not one request leaves this site for Google. You can withdraw consent by clearing this site’s data in your browser.

It is on no screen behind sign-in and not on the page carrying the crisis numbers, and it never will be. For this, Google is a separate controller, and data may leave the European Economic Area under standard contractual clauses. The IP address is truncated, and the advertising and personalisation signals are set to denied.

6. Processors

Data is held by providers acting on our instructions: Supabase (database and sign-in; servers in Ireland) and Vercel (application hosting). A data processing agreement is in place with each. Data is not transferred outside the European Economic Area for any purpose beyond the technical operation of those services.

7. Retention

Until you delete your account or withdraw consent. Deleting your account erases the data permanently.

8. Your rights

You have the right of access, rectification, erasure, restriction, portability and objection. You may withdraw consent at any time; withdrawal does not affect processing carried out beforehand. Deleting your account in settings both withdraws consent and exercises your right to erasure. You may also complain to the Polish data protection authority (Prezes Urzędu Ochrony Danych Osobowych).

9. Providing data is voluntary

Entirely voluntary — but without an e-mail address, a nickname and the article 9 consent there is no account, because there would be nothing to process and no basis for processing it.