Privacy Policy

1. Who is responsible for your data

Streak is operated by the team behind the fyrhen.com domain, acting as the controller of the personal data processed on the public website and in the app. For anything related to privacy, the channel is contato@fyrhen.com.

This document covers two different environments: the public website at fyrhen.com, which anyone can visit without an account, and the app at streak.fyrhen.com, which requires signing up. Whenever a rule applies to only one of them, that is stated explicitly.

2. Data we collect on the public website

Visiting the site, reading the blog or browsing any institutional page requires no account and asks nothing of you. Browsing still generates technical information that is processed automatically:

• Your language preference, stored in a cookie so that your next visit opens in the language you chose.
• Aggregated browsing data collected by Google Analytics: pages visited, reading time, traffic source, device type, browser and approximate region derived from the IP address.
• Data used to serve and measure ads, collected by Google AdSense as described in section 5.
• Pages visited and clicks on the download and access buttons, collected by the Meta Pixel once you accept the advertising category, as described in section 5.
• Server logs, such as IP address and request time, kept by the hosting provider for security and diagnostics.

3. Data we collect in the app

When you create a Streak account and use the app, we process the data the service needs to work:

• Account data: display name, email address and login credentials.
• Product usage data: workout check-ins, the date and time of each one, exercises added, streak, points and ranking position.
• Content you publish: workout photos and profile picture, visible to the friends you connect with in the app.
• Social connections: the friends you add and the likes you give and receive.

4. Cookies and similar technologies

Cookies are small files stored in your browser. We use three categories, and only the first one loads before you decide:

• Essential: they make the site work, such as the language cookie and the app session cookies. They cannot be turned off without breaking the service.
• Analytics: they measure site usage in aggregate, so we can tell which content is useful. They require your consent.
• Advertising: used by Google, Meta and their partners to select, cap the frequency of and measure the ads shown on the blog and the campaigns that bring visitors here. They require your consent.

You accept or reject the non-essential categories in the banner shown on your first visit, and you can review your cookie preferences at any time.

5. Advertising: Google AdSense and the Meta Pixel

Blog pages display Google AdSense ads. That revenue is what keeps the content open and free.

Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website and to others. Google's use of advertising cookies enables it and its partners to serve ads to you based on those visits.

You can opt out of personalised advertising in Google Ads Settings, and opt out of third-party vendor cookies at aboutads.info/choices. If you reject the advertising category in our cookie banner, AdSense is instructed not to use advertising cookies and the ads shown become non-personalised.

To understand how Google handles data collected on partner sites, see how Google uses data on partner sites.

We also use the Meta Pixel to measure the ads we run on Facebook and Instagram and to build remarketing audiences — showing the ad again to someone who visited the site and did not download the app, for instance. It records pages visited and clicks on the download and access buttons, with no name, email address or account data.

The Pixel only loads after you accept the advertising category in the cookie banner: until then, no Meta script enters the page. If you withdraw your choice, it stops loading.

6. Audience measurement: Google Analytics

We use Google Analytics 4 to learn which pages get read, where visits come from and where people stop reading. The reports we look at are aggregated: we do not identify individual visitors and we do not cross this data with the app account database.

Besides page views, we record clicks on the download and app access buttons, to measure how many readings turn into product usage.

You can block this collection by rejecting the analytics category in the cookie banner, or by installing the Google Analytics opt-out add-on in your browser.

7. What we use the data for

• Keeping your account, your workout history and the app's social features running.
• Understanding which blog content is useful and deciding what to produce next.
• Serving and measuring the ads that fund the free content.
• Answering the messages you send us by email or through in-app support.
• Protecting the service against fraud, abuse and misuse, and meeting legal obligations.

8. Legal bases for processing

We process personal data under Brazil's General Data Protection Law (Law 13.709/2018) and, for visitors in the European Economic Area and the United Kingdom, under the GDPR:

• Performance of a contract: the account and usage data needed to deliver the app you asked to use.
• Consent: analytics and advertising cookies, collected in the first-visit banner and revocable at any time.
• Legitimate interests: service security, fraud prevention and keeping server logs.
• Legal obligation: when the law or an order from a competent authority requires us to retain or hand over information.

9. Who we share it with

We do not sell personal data and we do not hand it over for third-party commercial use. We share only what is necessary with the providers that operate parts of the service on our behalf:

• Google (AdSense and Analytics): browsing and ad delivery data, as described in sections 5 and 6.
• Meta (the Facebook and Instagram Pixel): pages visited and CTA clicks, used to measure and optimise our campaigns, as described in section 5.
• Hosting provider: running the site and the app, including server logs.
• Cloudinary: storage and delivery of the images used on the blog and in the app.
• Public authorities: only upon a valid legal request.

10. International data transfers

The providers listed above run servers outside Brazil, which means the data described in this policy is transferred internationally. Those transfers happen under the contractual clauses and protection commitments adopted by each provider, as required by article 33 of the LGPD.

11. How long we keep it

• Account data and workout records: for as long as the account exists. When you delete it, the associated data is erased, except what the law requires us to retain.
• Audience analytics data: for the retention period configured in Google Analytics, currently 14 months.
• Support messages: for as long as needed to close the request and keep its history.

12. Your rights

You have the following rights over your personal data, at any time and free of charge:

• Confirm whether we process your data and access that data.
• Correct incomplete, inaccurate or outdated data.
• Request anonymisation, blocking or deletion of unnecessary data or data processed unlawfully.
• Request portability of your data to another provider.
• Withdraw consent and be told who we share your data with.
• Object to processing based on legitimate interests.

13. How to exercise your rights

Write to contato@fyrhen.com or use the contact page. If you have a Streak account, the fastest route is the form inside the app, under Settings and then Support, because we already have your account context. We reply within 15 days.

Deleting your account and all associated data can be requested through those same channels.

14. Children

Streak is not directed at children under 13 and we do not knowingly collect data from that age group. If we find an account created by a child without parental consent, it is removed. Parents or guardians who suspect this can write to us at contato@fyrhen.com.

15. Security

Traffic to the site and the app is encrypted in transit, passwords are stored hashed and database access is restricted. No system is immune to incidents: if one occurs that poses a relevant risk to your rights, we will notify you and the Brazilian data protection authority, as article 48 of the LGPD requires.

16. Changes to this policy

We may update this document when the product, our providers or the law change. The date at the top shows the last revision, and relevant changes are announced on the site before they take effect.

17. Contact

Questions about this policy, the data we process or your rights: contato@fyrhen.com. You can also read our Terms of Use and Editorial Policy.