PRIVACY

What we keep,
and how to remove it.

offday.club is a daily workout app. The public leaderboard and accounts are for people 16 and over; younger visitors use private mode with a parent or guardian's OK. This page describes what the code does today.

Under 16, or prefer not to say: private mode

If you are under 16 and a parent or guardian says OK, or you prefer not to give your age, offday.club runs in private mode. Workouts, videos, the timer, XP and streaks work. The public leaderboard and accounts are switched off: the app sends no leaderboard or account data, and nothing about you leaves the device. The age answer itself is stored only in this browser. Videos still come from YouTube's privacy-enhanced embed and only after you tap to load one; see the YouTube section below.

Browser data and the age answer

You can work out as a guest. Your browser stores a random device ID, plan and equipment choices, difficulty, display name, username preference, clan tag, sounds, XP, streak, workout history, exercise checks, reward times, course progress and readiness. A per-player leaderboard-sync pause is stored after deleting an entry. The age answer and answer time are kept separately on this device; an under-16 answer blocks access for a day before asking again. This is a self-declared 16+ rule, not age verification.

Local storage also holds the guest leaderboard ownership credential and any score offsets used when starting a protected entry, guest progress, an optional active-member identity, member progress waiting to sync and a snapshot taken before importing a backup. Clearing this site's browser data removes these local copies and the age answer. Delete server data first if you still want to remove your leaderboard row or account: clearing your browser can lose the credentials needed to do that.

Public leaderboard and reports

Saving account settings or earning workout rewards sends your device ID, chosen username or Anonymous, clan tag, total XP and workout count, most frequent workout focus and its count to /api/leaderboard. For signed-in members, the server uses the member ID and registered username instead of the guest identity. It stores a salted SHA-256 player key, the display fields, anonymous/hidden/banned flags and the last update time. The raw guest device ID is received to compute that key; the leaderboard table does not store it. A protected guest entry also uses a random 256-bit ownership token saved only in this browser. The server stores its SHA-256 hash, not the token. Member entry ownership uses the signed-in session.

The leaderboard publishes the top 50 visible, unbanned rows, including Anonymous rows: username, clan tag, XP, workouts, favorite focus and count, and the first 12 characters of the hashed player key. Workout completion and scores are self-reported.

Reporting stores the target and reporter's hashed player keys, a username-report reason and a creation time. A row is hidden after three distinct reporters. A report does not include a free-text message.

Optional member accounts

Accounts use a username and a generated member ID. Registration does not ask for an email address, phone number or birth date. The member table stores the username, member ID, creation time, saved progress JSON and its revision, a random password salt and a password hash made with PBKDF2-SHA-256 (100,000 iterations). The password itself is not stored in that table.

Login creates a random session token in an HttpOnly, SameSite=Strict cookie (Secure over HTTPS) for 30 days. The server stores its SHA-256 hash, member ID and expiry time. Signing out revokes that session. Expired sessions are cleaned up during successful login or registration.

Sign-in abuse counters store SHA-256 hashes derived from the IP address and lowercase username, plus attempt times. Account deletion attempts use a hash derived from the member ID. Sign-in counters older than 15 minutes are removed during successful login or registration; they may remain longer if no successful sign-in occurs.

Cloud progress and collections

When you join or save as a member, the app sends the plan, profile (including display name and goal), settings, XP, streak, dated workout history, movement names and checks, reward times, selected course and lesson, practice days and readiness answers to your account. It also saves favorite movement names, bookmarks, saved workouts with their settings and completed moves, and clips with their ID, YouTube video ID, title, start/end seconds and saved time. Clips are references to YouTube videos; no video file is uploaded. Member saves are limited and normalized by the app.

Your age answer and raw guest device ID are not part of the cloud progress schema. Exported JSON backups include normalized progress and collections, but not your password or session token. Keep those files private if your workout history or profile is private.

Leaderboard abuse counters and daily bounds

POST and DELETE share limits of 30 requests per player and 120 per IP per minute. The database stores salted IP fingerprints, a fingerprint derived from the player key, minute-window starts and request counts. Expired windows are removed on the next leaderboard mutation. A security row stores the hashed player key, ownership-token hash for guests, deletion status, an update version, current UTC day, baseline scores and last-admitted scores to admit at most 1,500 XP and 4 workouts per day. Existing higher totals are retained for authenticated members. These bounds do not verify that a workout happened.

Delete your leaderboard entry

Open Account → Delete my leaderboard entry. The app sends DELETE /api/leaderboard from this site, using your guest device ID and ownership token, or authenticated member session. It deletes your leaderboard row and reports targeting or made by it, and stops automatic leaderboard updates on that device until you apply account settings again. It does not delete member progress or local workouts. A deleted flag and update version block automatic or in-flight re-creation; applying account settings explicitly rejoins. The hashed ownership credential, daily baseline and last-admitted totals remain after guest leaderboard deletion so a person with the device ID cannot take over the deleted identity or bypass the daily limit; short-lived request counters follow the cleanup above. For banned guest entries, the hashed player key and ban flag remain; display fields and scores are cleared and the row is hidden.

Older guest rows have no ownership credential. They keep their prior scores and visibility flags but are frozen against updates, reports and self-service deletion based only on a device ID. Start protected entry creates a new leaderboard identity and score starting at zero while preserving all local XP and workouts. This cannot prove ownership of an older row; contact us for a reviewed legacy removal request. No automatic claim is offered.

Delete your member account

Sign in, open Account → Delete account, and confirm with your current password. DELETE /api/account requires your active session, the same site origin and password verification. One transaction deletes the member record and cloud progress, all its sessions, its leaderboard row and related reports, member/username attempt fingerprints, the leaderboard ownership/daily-baseline row and per-player leaderboard request counters. Short-lived hashed IP attempt records follow the cleanup described above.

After confirmed deletion, this browser removes its member cache and pre-import snapshot and restores its saved guest progress. Other devices lose server access when they reconnect. Exported files, downloaded copies and other-device offline progress cannot be remotely erased. Remove those copies and clear this site's browser data on each device yourself. Deletion does not erase Cloudflare request logs.

YouTube

No YouTube video or API script loads until you tap Load video from YouTube. A new video modal asks again; switching modes or backups in that modal uses the same permission. After the tap, the app loads YouTube's privacy-enhanced embed and player API. YouTube receives your IP address, browser/device information, requested video and playback requests; it can use its own storage and cookies according to its policies. Opening the original-video link also visits YouTube. The app does not send your member password, account ID or saved progress to YouTube.

Cloudflare hosting

Cloudflare receives request information, including IP address, URL and browser information, to serve this site and its APIs. Cloudflare may retain request/security logs under its configuration and privacy policy. This repository does not establish which logging options or retention periods are enabled on the production account. The app's deletion endpoints do not delete those logs. The app source includes no separate analytics script or advertising pixel.

Questions and access problems

Contact kenneth.inquiries@outlook.com about privacy, deletion or a lost device. Do not send your password. Requests needing identity verification or access to hosting logs require review; this page does not promise that a username alone proves ownership.