Privacy policy

What we collect

Your email address, so you can sign in. Your display name, and optionally your bodyweight, birth year and country — these exist to make leaderboards fair, and every one of them is optional except the name.

The rucks you log: distance, duration, pack weight, elevation, a route name and when it happened. If you upload a FIT or GPX file, we keep the original file so we can re-read it if our parser improves.

What we do not do

We do not sell your data, and we do not run advertising on it.

We do not build an advertising profile of you. We do count visits (see below), but the figures are anonymous and aggregate — no tracking cookie, no cross-site identifier, nothing that follows you off this domain.

Who can see your rucks

Nobody, by default. New profiles are private, and stay private until you explicitly turn on public visibility in your account settings.

When you do turn it on, your hauls appear on the leaderboards you qualify for, alongside a mark showing whether each ruck came from a device or was entered by hand.

Activities imported from Strava are an exception: Strava's API terms permit showing their data only to the person it belongs to, so those rucks are visible to you alone and never counted on any public board.

Where it lives

In a Postgres database hosted in the EU, with row-level security so one account cannot read another's rows.

Provider access tokens, if you connect Garmin or Strava, are held in a table that no user-facing role can read at all.

Your rights

Export everything we hold about you as JSON, any time, from your account settings.

Delete your account from the same page. That removes your profile, every activity, your crew memberships and any uploaded files. It is immediate and cannot be undone.

Email we send

Sign-in links, because that is how signing in works. There is no way to opt out of those and still have an account.

The weekly digest — your week in kg·km, how your crews moved and where your challenges are — only if you asked for it. It is off unless you tick the box at signup or in account settings, and every one of them carries a one-click unsubscribe that needs no sign-in and no confirmation step.

Nothing else. No product announcements you did not ask for, no marketing, and your address is never shared with anyone. Email is delivered by Resend, who process it on our behalf and for no other purpose.

Cookies and analytics

Two cookies, both functional: one remembers whether you prefer metric or imperial, one keeps you signed in. That is the whole list. There is no advertising, tracking or profiling cookie here, which is why you are not asked to accept anything on arrival.

For traffic figures we use Vercel Web Analytics — which pages get opened, which country a visit came from, which kind of browser. It sets no cookie and keeps no lasting identifier: repeat visits within a day are recognised through a hash of the request that is discarded when the day turns over, so a visit stays a number. It cannot be traced back to you, attached to your account, or joined up with what you do on any other site.

Because none of it identifies you, there is no consent to give and no switch to turn off. Vercel processes the figures on our behalf and for nothing else. If you would rather it did not run at all, any content blocker will stop it and the site works exactly the same.