Summary
The Pact is a small app for two to eight people who make a shared health pact. To make that work, we keep what you record and show it to the other people in your pact. That is the whole point, and it is also the most important thing to understand about your privacy here.
We don't sell your data, we don't show ads, we don't use tracking or analytics cookies, and we don't profile you or let an algorithm make decisions about you. You can download everything as a file and delete your account whenever you like.
On this page
1.Who we are
The Pact (the website at thepact.lol (opens in a new tab) and our iOS, Android and desktop apps) is run by Cohort Technologies Limited, a company incorporated in the Dubai International Financial Centre (DIFC), United Arab Emirates. Our registered address is Level 1, Innovation One, DIFC, Dubai, United Arab Emirates.
We are the controller of the personal data described in this policy, which means we decide how and why it is used. We process it in line with the DIFC Data Protection Law (DIFC Law No. 5 of 2020) and the Data Protection Regulations made under it. If you live in the European Economic Area or the United Kingdom, you also have the rights given to you by the EU or UK General Data Protection Regulation (GDPR), and we honour them.
For anything about privacy, including using any of your rights, write to support@thepact.lol. A real person reads every message.
2.What we collect
We only collect what the app needs to work. Most of it is information you type in yourself.
Your account
- Name and email: your first name and email address, and whether your email has been verified.
- Password: we never store your password itself. We store a one-way hash made with argon2id, which cannot be turned back into the password. If you use Google only, there is no password at all.
- Google sign-in (optional): if you choose Continue with Google, Google shares your name, email address and profile photo with us, along with an account identifier and the sign-in tokens needed to link the two accounts. We don't ask for access to your contacts, calendar, files or anything else in your Google account.
- Time zone: detected automatically from your device and editable in Settings. We use it so that "today" means your today, and so reminders arrive at your local time.
- One-time codes: when you verify your email or reset your password we send a 6-digit code. We store only a scrambled (hashed) version of it, which expires after 15 minutes.
Health and wellness information you record
- exercise minutes, each session's activity type (walk, cycle, stretch, strength or other) and whether it was logged by hand or with the timer
- how many meals you ate and whether you followed low-carb eating that day, plus any meal note
- fasts you plan and complete, any fasting note, and the fasting method you describe in Settings
- health pauses, if you pause your exercise or fasting target
- your daily check-ins and your weekly reflections
- your answers to the day-30 review
We do not ask for or store your weight, body measurements, calories, macros, diagnoses or medication, and we don't connect to Apple Health, Google Fit or wearables.
Your pact
- the pact's name, start date and shared goals, and the history of goal changes
- goal proposals and every member's agree or decline vote
- your acknowledgement of the pact agreement and the date you committed
- encouragements you send and receive (one of a few fixed phrases)
- approved meals (name, meal slot, ingredients, preparation), the weekly menu and the shared grocery list
- invitations: the email address and optional first name of each person a member invites, who invited them, and whether the invitation is pending, accepted, declined, withdrawn or expired
- a record of changes made in the pact (for example "goal agreed" or "day updated"), which keeps every member's screen in sync and lets us investigate problems
Profile photo
If you upload a profile photo, your device crops it to a square and resizes it to 512 pixels before it is uploaded. If you don't upload one, we use your Google photo (if you signed in with Google) or your initials.
Devices, sessions and notifications
- Signed-in devices: a label such as "Safari on iPhone", the platform (web, iOS, Android or desktop), the IP address it last connected from and when it was last active. We use this to keep your account secure, to show you your signed-in devices, and to email you when there is a sign-in from a new device.
- Server logs: like every website, our servers briefly record IP addresses, browser user agents and request details to keep the service running, to apply rate limits on sign-in and password reset, and to stop abuse.
- Push notification tokens: if you turn on push reminders, we store the address your browser, Apple or Google gives us for delivering notifications to that device.
- Reminder preferences: which reminders you turned on, at what time, and whether by push or email, plus a record that a reminder was sent on a given day so you never get it twice.
Emails we send you
For every email we send (for example a verification code, an invitation or a weekly summary) we keep a log entry with the recipient address, the kind of email, its subject, whether it was delivered, and the email provider's reference. We do not track whether you open emails or click links in them.
Messages to support
If you write to support@thepact.lol, we keep your message and our reply so we can help you.
3.Your health data and your consent
Exercise, eating, fasting, health pauses and reflections are information about your health. Under the DIFC Data Protection Law this is special category personal data (under the GDPR it is "special category" data concerning health), and it gets extra protection.
We only process it with your explicit consent. You give that consent when you create your account (or, if you sign up with Google, on the step before you set up your pact) and again when you commit to a pact, after being told that what you record is shared with your pact. Each time, we keep a record of what you agreed to, which version of this policy and when, with your account. You don't have to record anything you'd rather keep to yourself; every field is optional.
You can withdraw your consent at any time by deleting your account (see Deleting your account), or by writing to us. Withdrawing consent doesn't make our earlier use of your data unlawful, but once it is withdrawn we stop processing your health data and delete it as described below.
4.Who can see what you record
Everything you record is visible to everyone in your pact
This is how The Pact works. Every member of your pact can see, in real time, everything you record: exercise, meals, low-carb status, fasts and fasting method, pauses, check-ins, notes, weekly reflections, encouragements, votes, your profile photo and your name. A pact has at most eight people, and only people who have accepted an invitation and joined your pact can see it. Pacts are never public and can't be searched for.
- Members can't see your email address, password, devices, IP addresses, reminder settings or time zone.
- When another member is using the app, you may see a small dot on their photo. We never show when someone was "last seen".
- When you leave a pact or are removed, you stop seeing it and the remaining members stop seeing your new activity. Shared things you added to the pact itself, such as an approved meal, a grocery item or your vote on a goal, stay with the pact.
- Our team can access account and pact data only when needed to run the service, to answer a support request you made, or to deal with a security or legal issue, and that access is limited to the people who need it.
5.People you invite
When you invite someone, you give us their email address and, optionally, their first name. We use that information only to send them the invitation, to send one reminder (either when you press Resend or automatically after three days if they haven't replied; never more than two emails in total), to show the invitation to the people in your pact, and to tell you whether they accepted or declined.
Please only invite people you know and who would expect to hear from you about The Pact. The person you invite can decline without creating an account, and declining stops all further emails about that invitation. Invitations expire after 14 days. If an invitee writes to us, we'll delete their details.
Our legal basis for using an invitee's details is our legitimate interest, and yours, in letting members invite the people they want to make a pact with.
6.How we use your data and why we're allowed to
Data protection law requires a lawful basis for each thing we do with your data. Here is ours.
| What we do | Lawful basis |
|---|---|
| Create and run your account, sign you in, and provide the pact features you ask for (logging, sharing with your pact, proposals, meals, export) | Performing our contract with you (the Terms of Use) |
| Store your health and wellness entries and show them to your pact | Your explicit consent |
| Send essential emails: verification codes, password resets, security alerts, invitation responses | Performing our contract with you; for security alerts, our legitimate interest in keeping accounts safe |
| Send optional reminders, summaries and celebration messages by push or email | Your consent, which you give when you switch each one on and withdraw by switching it off or using the unsubscribe link |
| Keep the service secure: rate limits, new sign-in alerts, device lists, preventing abuse, fixing errors | Our legitimate interests in protecting you, other members and the service |
| Send invitations to the people members invite | Our and the inviting member's legitimate interests |
| Keep records we're required to keep, respond to lawful requests, and establish or defend legal claims | Complying with legal obligations; our legitimate interests |
Where we rely on legitimate interests, we have weighed them against your rights and kept the processing to what is necessary. You can object to it at any time (see Your rights).
7.What we don't do
- We don't sell, rent or trade your personal data, and we never will.
- We don't show advertising, and we don't share data with advertisers or data brokers.
- We don't use analytics, tracking or advertising cookies, pixels or SDKs, and we don't track you across other apps or websites.
- We don't profile you, score you or rank you against anyone.
- We don't use artificial intelligence or any automated system to make decisions about you that have legal or similarly significant effects. The rules in the app (for example whether a day was "kept") are simple calculations on what you entered, shown only to you and your pact.
- We don't use your health data to train AI models.
9.Service providers we use
We use a small number of trusted companies to run The Pact. They act as our processors: they may only use your data to provide their service to us, under written contracts that require them to keep it secure and confidential. We don't share your data with anyone else unless the law requires it (see below).
| Provider | What they do for us | Data involved | Location |
|---|---|---|---|
| Railway Corporation | Hosts the app, its database (PostgreSQL), Redis cache and job queue, and database backups | All account, health and pact data | United States and/or European Union |
| Resend, Inc. | Sends and receives our email | Recipient email address, name, email content | Company in the United States; our account's region is Asia-Pacific (Tokyo, Japan) |
| Cloudflare, Inc. (R2 storage) | Stores and serves profile photos; stores encrypted weekly database backups | Profile photos; backup copies of the database | United States and other Cloudflare locations |
| Google LLC (only if you use Google sign-in) | Lets you sign in with your Google account | Your Google name, email, photo and account ID | United States |
| Apple Inc. (Apple Push Notification service) and Google LLC (Firebase Cloud Messaging) | Deliver push notifications to iPhone and Android devices | Device push token and the notification text | United States |
| Your browser's push service (for example Google, Mozilla or Apple) | Delivers web push notifications if you turn them on in a browser | Push address and an encrypted notification | Varies by browser vendor |
| Functional Software, Inc. (Sentry), if enabled | Error monitoring, so we can find and fix crashes | Technical error details, which may include an IP address, device type and account ID; we configure it not to collect what you've recorded | United States |
If you choose a password, we may check it against the Have I Been Pwned database of breached passwords. Only the first five characters of a one-way hash of your password are sent, so your password never leaves our servers. Our desktop app checks GitHub (GitHub, Inc., United States) for updates, which shares your IP address and app version with GitHub. When you download our mobile apps, Apple's App Store and Google Play handle that under their own privacy policies.
We may disclose data where we are legally required to (for example a valid order from a court or regulator with authority over us), to protect someone's life or safety, or to establish or defend legal claims. If The Pact or our company is ever reorganised, merged or sold, your data would transfer under this policy, and we would tell you before it became subject to a different one.
10.International transfers
We are based in the DIFC, but our service providers store and process data in other countries, mainly the United States, the European Union and Japan, as shown in the table above. That means your data is transferred outside the DIFC.
We only make those transfers in a way the DIFC Data Protection Law allows:
- to countries that the DIFC Commissioner of Data Protection has recognised as providing an adequate level of protection, or
- under appropriate safeguards, mainly standard data protection clauses (the DIFC standard contractual clauses, or the European Commission's or UK's equivalents, as relevant) in our contracts with each provider, together with the extra security measures described below.
For users in the EU or UK, transfers out of the EU or UK rely on adequacy decisions (including the EU-US Data Privacy Framework where the provider is certified) or standard contractual clauses. You can ask us for a copy of the relevant safeguards at support@thepact.lol.
11.How long we keep data
We keep personal data only for as long as we need it. These are our standard periods:
| Data | How long we keep it |
|---|---|
| Account, health and wellness entries, and profile photo | For as long as you have an account |
| After you ask to delete your account | Deleted from our live systems within 30 days |
| Database backups | Backups roll over automatically; deleted data disappears from every backup within 35 days of being deleted from our live systems |
| Shared pact content (pact name, goals, proposals, meals, grocery list) | For as long as the pact has members. When the last member leaves, the pact is archived; its shared content is deleted once none of its former members still has an account |
| Invitations (invitee email and name) | Invitations expire after 14 days. Details of invitations that expire, are declined or are withdrawn are deleted 90 days later; accepted invitations become part of the new member's account |
| Signed-in device records and IP addresses | 90 days after the device was last active, or sooner if you sign that device out |
| Server and security logs | 90 days |
| One-time codes | Expire after 15 minutes; deleted within 24 hours |
| Email logs | 12 months, then deleted or anonymised (the log of an email sent to you is removed when your account is deleted) |
| Error reports (if Sentry is enabled) | 90 days |
| Support emails | Up to 2 years after the conversation ends, unless you ask us to delete them sooner |
We may keep something longer only where the law requires it, or where it is needed to deal with a legal claim or a security incident, and only for as long as that lasts.
12.Deleting your account and leaving a pact
- Leaving a pact: you can leave at any time from Settings. The pact owner can also remove members. Leaving doesn't delete your account or your records; you can still export them or delete your account.
- Deleting your account: use Delete account in Settings, or write to support@thepact.lol from the email address on your account. In Settings you confirm it's you with your password (or, if your account has no password, by signing in with Google again). If you're in a pact, you leave it first, exactly as if you'd tapped Leave pact: if you started the pact, ownership passes to the longest-standing member; if you're the last member, the pact is archived; the others get a short email to say you've left. We then delete straight away your account, your health and wellness entries, your encouragements, your reflections, votes and review answers, your reminders, your profile photo, your devices, sessions and push tokens, your sign-in links to Google, your one-time codes, your consent records, the log of emails sent to you and what you added to your pact's history. Invitations you sent that are still waiting are withdrawn. Meals and grocery items you added stay with the pact, shown as "Added by a former member", and the invitation you joined with no longer shows your name or email. Deleting your account signs you out on every device, and we send a confirmation email to your address (we don't keep a log of it). Requests made by email are completed within 30 days. Copies in backups disappear within a further 35 days.
- Before you go: you can download a copy of your data first (see Your rights).
13.How we protect your data
- All connections to The Pact use HTTPS (TLS), including the real-time connection that keeps your pact in sync.
- Passwords are stored only as argon2id hashes. One-time codes and invitation links are stored only as hashes, are single use and expire.
- Sign-in, code verification and password reset are rate-limited to stop guessing.
- We email you when your account is signed in on a new device, when your password or email changes, and when Google is linked, and you can sign out other devices from Settings.
- Every request checks that you are signed in and a member of the pact you're accessing. Members can only change their own entries.
- Access to production systems is limited to the people who need it, uses individual accounts and strong authentication, and is logged.
- Our hosting providers encrypt stored data and backups at rest.
No system is perfectly secure. If you think your account has been compromised, change your password, sign out other devices from Settings and let us know straight away.
14.Your rights
Under the DIFC Data Protection Law (and the GDPR, if you are in the EU or UK) you have the right to:
- Access: get confirmation that we process your data and a copy of it.
- Rectification: correct anything inaccurate or incomplete. You can edit most things yourself in the app.
- Erasure: have your data deleted, for example by deleting your account.
- Restriction: ask us to limit how we use your data while a concern is being looked into.
- Portability: receive your data in a structured, machine-readable format. Settings → Export your data downloads a JSON file of your account and the pact data you can see, without passwords or other secrets.
- Objection: object to processing based on our legitimate interests. We'll stop unless we have compelling grounds that override yours.
- Withdraw consent: at any time, for health data (by deleting your account) and for optional reminders (by switching them off), without affecting what we did before.
- Automated decisions: not be subject to a decision based solely on automated processing that significantly affects you. We don't make any such decisions.
- Non-discrimination: not be treated differently for using any of these rights.
To use any of these rights, write to support@thepact.lol from the email address on your account. We may need to confirm your identity first. We will respond within one month, and tell you if we need longer (up to two further months for complex requests) and why. It's free, unless a request is clearly unfounded or excessive.
Complaints
If you're unhappy with how we've handled your data, please tell us first so we can try to put it right. You also have the right to complain to the DIFC Commissioner of Data Protection (Dubai International Financial Centre Authority, difc.ae (opens in a new tab)). If you are in the EU or UK, you can also complain to the data protection authority where you live or work, such as the UK Information Commissioner's Office.
15.Children
The Pact is only for people aged 18 and over. By creating an account you confirm that you are 18 or older. We don't knowingly collect data from anyone younger. If you believe someone under 18 has an account, please tell us at support@thepact.lol and we'll delete it.
16.If something goes wrong
If a personal data breach happens, we'll act quickly to contain it, notify the DIFC Commissioner of Data Protection (and any other authority we're required to) as soon as practicable, and tell you directly, by email, without undue delay if the breach is likely to put your rights at high risk, with what happened and what you can do.
17.Changes to this policy
We'll update this policy if what we do with data changes. The date at the top shows when it was last changed. If a change is significant, for example a new purpose or a new kind of data, we'll tell you by email or in the app before it takes effect, and ask for your consent again where the law requires it.
18.Contact us
Cohort Technologies Limited
Level 1, Innovation One, DIFC, Dubai, United Arab Emirates
Email: support@thepact.lol
Please also read our Terms of Use, which explain the rules for using The Pact.
Questions?
Cohort Technologies Limited, Level 1, Innovation One, DIFC, Dubai, United Arab Emirates. Write to us at support@thepact.lol.