Privacy Policy
Version 2 · Updated
About this policy
HeroWOD.com (the "site") is run by HeroWOD.com ("we," "us" and "our"). This policy explains what information we collect, how we use it, who we share it with, how long we keep it, and the choices you have.
Anyone can browse the site. Only people with a US phone number can create an account; numbers from US territories are accepted, and toll-free and premium-rate numbers are not. The site is run from the United States, and the information we collect is stored and processed there.
We don't sell your information, we don't show ads, and we don't share your information for advertising.
Information we collect
When you browse
Like any website, our hosting provider receives technical details with each request: your IP address, browser and device type, the page you asked for and when. We use them to deliver pages, keep the site secure and fix problems.
When analytics are turned on, we count page views with Vercel Web Analytics (see "Analytics" below).
When you create an account
- Phone number, which we confirm with a one-time code sent by text.
- Email address, which we confirm with a link.
- Display name, and an optional profile photo and bio. We remove location and other hidden details from photos when you upload them.
- Your confirmations that you're 18 or older and that you accept our legal documents, with the version of each document and when you accepted it.
- Passkeys, if you add one: the passkey's public key, its name, and when and on what kind of device it was added and last used. Your fingerprint, face or device PIN never leaves your device.
When you use the site
- Results: each workout you mark complete, with its date, your time zone, the variation and your result.
- Comments, including ones you delete. Deleted comments are hidden from other members, but staff can still see them until your account is deleted.
- Groups: groups you create or join, your role in each, join requests and your result-sharing settings.
- Reports you file, appeals you send, and workout submissions, including any photo, source links and your relationship to the hero.
- Your time zone, from your browser, so we can show dates in your local time and send notifications at the right hour.
- Sessions: for each place you're signed in, the device, browser and operating system, the date you signed in, when you were last active, and an approximate city and state worked out from your IP address when you signed in. We don't show or keep your IP address with your sessions.
- Notification settings and records of your consent to text notifications (see Text messages below).
Security information
To limit abuse, we count recent attempts to send codes and links, sign in, post and so on. These counts are keyed to fingerprints (keyed hashes) of IP addresses, phone numbers, emails or accounts, never to the plain values.
Forms that send a code or link, and family removal requests, include a Cloudflare Turnstile check that tells people from automated programs. Cloudflare receives information about your browser and device to do this.
Supporters
If you subscribe, Stripe handles your payment. We never receive your full card number. We keep the Stripe customer and subscription IDs and your subscription's status. Stripe keeps billing and tax records under its own privacy policy.
Family removal requests
If you ask us to remove a hero's page, we collect your name, your relationship to the hero, your email (which we confirm with a link), an optional phone number and your message.
How we use information
We use information to:
- run the site and your account, and sign you in
- keep the site and your account secure, and prevent abuse and suspension evasion
- send you sign-in codes and links, account messages, and the notifications you choose
- show your history and statistics, and share results with your groups as your settings allow
- review reports, submissions, appeals and family removal requests, and moderate the site
- handle Supporter subscriptions, receipts and refunds
- understand how the site is used, in aggregate, so we can improve it
- meet legal obligations and protect people's rights and safety
Who can see what
- Everyone: hero and workout pages, and statistics built from everyone's results, which never name anyone.
- Signed-in members: your display name, photo, bio and Supporter tag; your comments; and on your profile, how many workouts you've completed and your streaks. Profiles are not shown to search engines.
- Your groups: that you're a member, and your results, unless you or the group owner hide them.
- Only you: your actual results compared with everyone's, your phone number and your email.
- Our staff: your account information, to support you and moderate the site. Staff never see codes, link or session secrets, passkey keys or full payment details, and every time staff view an account's details, it's logged.
While an account is suspended, its profile, comments and place in group lists are hidden from other members.
Service providers
We share information with companies that run parts of the site for us, only as they need it to do that work:
- Supabase, which hosts our database
- Vercel, which hosts the site, works out approximate location from IP addresses, and provides our analytics
- Bird, which delivers our texts and emails
- Cloudflare, which stores images (R2) and provides the Turnstile check
- Stripe, which processes Supporter payments
We may also share information when the law requires it, to protect anyone's rights or safety, or with a business that takes over running the site, such as a company formed to run HeroWOD, which would then follow this policy.
Text messages
We text your phone number from two numbers: one for sign-in codes and one for optional notifications. Sign-in codes are sent only when a code is requested. The SMS terms in our Terms of Use explain both.
Text notifications are off until you turn them on in your settings. When you do, we record what you agreed to, the consent wording you saw, and when. If you reply STOP to the notifications number, we turn text notifications off and keep a record that you opted out. Message and data rates may apply.
No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. The sharing described in "Service providers" excludes text-messaging originator opt-in data and consent; this information will not be shared with any third parties.
We email you sign-in links and account messages. Optional notification emails each include a one-click unsubscribe link.
Cookies and device storage
This section lists every cookie the site uses and everything it stores on your device, and why.
We use only what's strictly necessary to sign you in and keep your account secure, plus a little storage on your device for the install prompt. We don't use advertising or tracking cookies, so there's no cookie banner to click through.
Cookies we set
These cookies are set by herowod.com only and are never sent to any other site, including our image subdomain. Your browser sends them only over secure connections, and the site's scripts can't read them.
| Cookie | What it does | How long it lasts |
|---|---|---|
__Host-session | Keeps you signed in. It holds only a random ID; we store a keyed hash of it, never the ID itself. | 30 days, renewed each time you visit. Your session ends after 30 days without a visit (14 days for staff), or when you sign out. |
__Host-auth-flow | Ties a sign-in, two-step staff sign-in, account recovery, identity check or passkey step to the browser that started it, so a code or link can't be used to finish it somewhere else. Its contents are encrypted. | Up to 30 minutes. |
__Host-signup | Holds your progress through the sign-up steps, encrypted, so nothing is saved as an account until you finish. | Up to 1 hour. |
Stripe cookies on billing pages
Stripe processes Supporter payments. Its script loads only on the billing pages in your account settings, and there it sets two fraud-prevention cookies:
| Cookie | What it does | How long it lasts |
|---|---|---|
__stripe_mid | Helps Stripe recognize the device and prevent fraud. | 1 year |
__stripe_sid | Helps Stripe recognize the browsing session and prevent fraud. | 30 minutes |
Stripe's own cookie policy explains them.
Security checks
Forms that send a code or link, and the family removal request form, include a Cloudflare Turnstile check that tells people from automated programs. It runs in a Cloudflare frame on those forms only. Cloudflare says Turnstile doesn't set cookies; it does read information about your browser and device to make its check. See Cloudflare's Turnstile privacy policy.
Storage on your device
The site can be installed on a phone's home screen. To ask at the right time, it keeps two small items in your browser's local storage:
| Item | What it does | How long it lasts |
|---|---|---|
herowod:visits | Counts your visits on this device, so the install prompt appears only from your second visit. | Until you clear the site's data |
herowod:install-prompt | Remembers if you chose "Not now," which hides the prompt for 30 days, or "Don't ask again." | Until you clear the site's data |
These items stay on your device and are never sent to us.
Analytics cookies
There are none. When analytics are turned on, we count page views with Vercel Web Analytics, which sets no cookies. "Analytics" below explains what it records.
Managing cookies
You can block or delete cookies and site data in your browser's settings. If you block the cookies we set, you can still browse, but you won't be able to sign in or sign up. Clearing the site's data also resets the install prompt.
We'll update this section before the site uses any new cookie or storage item.
Analytics
When analytics are turned on, we use Vercel Web Analytics to count page views and see which pages are used. For each page view, Vercel records the page, the site you came from, and your approximate location, browser, operating system and device type.
It doesn't use cookies. Vercel tells visits apart with a hash of each request, which it discards after 24 hours, and it doesn't follow you across other websites. Visits are counted in aggregate, without building a profile of you.
Before a page view is sent, we strip anything in its address that could identify you or open your account, such as the code in a sign-in link or a group invitation.
We use it only within the allowance our hosting plan already includes.
How long we keep information
- Your account information stays until you delete your account.
- Sessions are deleted 30 days after they end.
- Sign-in codes, links and other verification steps are deleted within about an hour after they expire.
- Abuse-prevention counts are deleted when their time window ends, a week at most.
- Results are kept after you delete your account so statistics stay accurate, but they're given a random ID and are no longer linked to you.
- Reports you filed, submissions we've already decided, and suspension records are kept after you delete your account, without the link to you.
- Our staff activity log, which records every staff action, is kept with names as they were at the time, and with phone numbers and emails masked.
- If your account was suspended, the fingerprints of its phone number and email stay on our suspension list, even after you delete your account, until the suspension is lifted.
- Text-message consent and opt-out records are kept after you delete your account, under a fingerprint of your phone number rather than the number itself, so we can show that we had consent and honored opt-outs.
- Family removal requests are kept as a record of how each request was handled.
Deleted information can remain in our providers' backups for a limited time.
What happens when you delete your account
Deleting your account is permanent. We delete your profile, photo, phone number, email, passkeys and sessions; your comments, including ones you deleted earlier; your join requests, notification settings, legal acceptances, appeal text and pending submissions. We cancel any Supporter subscription immediately.
Groups you own pass to the longest-serving group admin, or if there isn't one, to the longest-standing member. A group with no other members is deleted.
Your choices and rights
- See and download your information: "Download my data" in your account settings gives you a file with your profile, results, comments, group memberships, legal acceptances, notification settings and Supporter status.
- Correct it: change your display name, photo, bio, phone number and email in your account settings.
- Delete it: delete your account at any time in your account settings, after confirming it's you.
- Notifications: choose email and text notifications separately in your settings, reply STOP to the notifications number, or use the unsubscribe link in any notification email.
Depending on the state you live in, you may have other rights, such as asking what we hold about you, asking us to delete or correct it, or opting out of its sale or use for targeted advertising. We don't sell information or use it for targeted advertising. To make a request, email support@herowod.com. We'll confirm it's you before acting, and if we decline, we'll explain why and how you can ask us to reconsider.
Children
Accounts are only for people 18 or older. The site isn't directed to children under 13, and we don't knowingly collect their information. If you think a child has given us information, contact us and we'll delete it.
Security
We protect your information with encrypted connections and limited staff access. We store sign-in codes, link tokens and session IDs only as keyed hashes, and we log every staff action. No system is perfectly secure, so please also keep your phone, email and devices secure.
Changes to this policy
This policy is versioned, and each new version says what changed. When a change needs your agreement, we'll ask you to accept it the next time you use the site while signed in.
Contact
Email support@herowod.com.