Privacy Policy

Challenge Studio is software for building and running multi-day challenges, operated by Smartstack Platforms LLC. This policy covers the Challenge Studio application and its marketing website.

Two kinds of person use it, and the difference matters throughout. A creator builds and runs challenges inside a workspace. A participant takes part in someone’s challenge. For the content a participant submits into a challenge, the creator’s workspace decides what happens to it and we act on their instructions.

Only what the product needs to work. Specifically:

• Your account. Email address, the name you give us, and an avatar image URL if you set one. Your password is handled by our authentication provider and is stored only as a hash — we never see it.
• What you submit to a challenge. Written answers, assignments and reflections, and whether you marked each one private; your answers to quizzes and polls. Poll results are shown to other participants only as totals, never by name.
• What you post publicly in a challenge. Feed posts, comments and reactions.
• Files you upload. Documents and photos you attach to an answer, a feed post or your profile. An answer’s files are seen by you and the people running the challenge — its host and the team members they allow to review work — and by your group or the whole challenge only if you share that answer with them. When you upload a photo, where and when it was taken and the camera and editing details stored with it (EXIF, XMP, content credentials) are removed; its colour profile is kept, so it looks right.
• Your mobile number, if you add one. Only to send you the texts you agreed to; you can remove it, or reply STOP, at any time.
• Your progress. Which steps you completed and when, points earned, badges awarded, and your streak.
• Email we send you. A log of which message was sent to which address, when, and whether it was delivered, skipped or failed. We keep this so we can tell whether a message reached you and never send it twice.
• Your notification preferences. Including whether you have unsubscribed from a particular workspace.
• IP addresses, briefly. Used as a counter key to rate-limit registration forms and sign-in attempts. It is not attached to your account and is discarded when the time window passes — see Cookies and rate limiting.

Stating this plainly is more useful than leaving it to be inferred:

• No payment details. Challenge Studio does not process payments at all. A paid challenge checks an entitlement the creator grants elsewhere; card details never reach us because there is nothing here to reach.
• No advertising or tracking. No advertising network, no analytics script, no tracking pixel, and no cross-site profiling. The application sets no cookie other than the one that keeps you signed in.
• No sale of your data. We do not sell, rent or trade personal information, and we do not share it for anyone else’s advertising.

Some challenge steps let you mark an answer private. When you do, that answer is withheld on the server: other participants cannot see it, and within the creator’s team only members whose role includes permission to view private submissions can open it.

The creator’s participant export also excludes it. The export contains counts, dates and progress — it never contains the text of any submission, private or otherwise.

Two honest limits. The creator, as the workspace owner, can grant that permission to their own team members, and we have no way to know who they trust. And private means private from other participants and from unauthorised team members — not encrypted such that we could not read it if legally compelled.

• To let you sign in and keep you signed in.
• To run the challenge — unlock the right day, record what you finished, and show your progress.
• To send the challenge email you would expect: confirmations, a nudge when a day opens, feedback on your work.
• To show creators how their challenge is going, in aggregate and per participant.
• To keep the service standing up — rate limits against spam and abuse, and error logs to fix faults.

Challenge Studio sets one kind of cookie: the session cookie issued by our authentication provider, which is what keeps you signed in between page loads. It is necessary for the application to function and cannot be switched off while you are using your account.

There are no analytics, advertising or preference cookies, which is why you will not find a cookie banner — there is nothing to consent to.

Separately, the public registration form and the sign-in page count attempts per IP address so that neither can be flooded. Those counts hold an address and a timestamp, are not linked to any account, and expire on their own — within fifteen minutes for sign-in attempts and an hour for registrations.

Fonts are served from our own domain rather than fetched from a font network, so loading a page does not disclose your address to a third party for that purpose.

We use a small number of service providers, each handling data only on our instructions:

• Supabase — database and authentication. This is where your account and challenge data live, in AWS us-west-2 (Oregon, United States).
• Vercel — application hosting and delivery.
• Resend — sending transactional email. Receives the recipient address and the message.
• Upstash — shared counters for the rate limits described above, where configured.
• Stripe — payments, where a creator sells a challenge or a template. Stripe receives what you enter on its checkout page (your card is never seen or stored by us); we keep a record of the sale — amount, date, status and who bought it.
• Twilio — text messages, only if you add your mobile number and agree to texts. Receives the number and the message. Reply STOP to any text, or remove the number in your notification settings, to end them.
• Zoom — where a host connects Zoom to run live sessions: Zoom tells us which email addresses joined a session, so your attendance can be marked.
• Browser push services — if you turn on notifications on a device, your browser’s own push service (Google, Apple or Mozilla) carries them. We send it the notification’s title and text, nothing else.
• Anthropic — the AI behind the AI builder and AI coach, where switched on. A creator’s brief goes to it when they ask for a draft. When you ask a challenge’s AI coach something, it receives your message, that day’s content and your answers on that day — never your reflections, your name or your email. We keep no copy of the conversation, only a count of requests.

One thing worth flagging, because it is not obvious: if a creator embeds a video from YouTube or Vimeo, or a page from another service such as Loom, Google Docs or Spotify, into a challenge day, your browser contacts that service directly when it loads, and their own privacy terms apply to that request. We do not send them anything about you, and we cannot control what they collect.

And one choice that is the creator’s, not ours: a workspace can connect its own tools through our API or webhooks. If the challenge you joined is run by one that has, the name and email you registered with, your progress, and the answers you did not mark private go to the tools that workspace chose — never your reflections or private submissions. What happens to them there is between you and the creator. A workspace can also show its challenges on its own web address, and one run by an agency can show its own name in place of ours; either way the pages are still served by us, and this policy still applies.

Your data is stored in AWS us-west-2 (Oregon, United States). If you are in the United Kingdom, the European Economic Area or another region with data transfer rules, using Challenge Studio involves a transfer of your information to the United States. We rely on standard contractual clauses with our providers for that transfer.

• Your account — until you delete it, which you can do yourself at any time.
• Challenge content and progress — for as long as the creator’s workspace exists. If they delete the challenge or the workspace, it goes with it.
• The email delivery log — kept while your account exists, because it is what stops a message being sent to you twice and lets us answer whether something reached you.
• Rate-limit counters — minutes to an hour, then gone.

You can ask us to:

• tell you what we hold about you, and give you a copy — or download it yourself from Your data;
• correct anything that is wrong;
• delete your data in a challenge, or your whole account — which you can also do yourself from Your data;
• stop sending you challenge email — you can also do this yourself, per workspace, in your notification settings.

Email privacy@mychallengestudio.com and we will respond within 30 days.

How deletion works: it happens immediately and cannot be undone. Deleting your data in a challenge removes your answers, uploads, posts, comments, reactions, points, badges, check-ins and certificate there. Deleting your account does that for every challenge and also removes your profile, sign-in, team memberships, email settings and the record of emails sent to you. If you are the only owner of a workspace, you first give it another owner or delete it, so a team’s data is never removed by surprise. A creator’s owner or admin can also erase a participant’s data in their challenge. What remains: a line in the creator’s audit log saying that data was deleted, with no content; a count of offer clicks, with no link to you; and the unsubscribe list, so an address that asked us to stop is never emailed again.

Challenge Studio is not directed at children under 13, and we do not knowingly collect their information. A creator running a challenge for under-16s is responsible for obtaining whatever consent their own jurisdiction requires. If you believe a child has given us information, write to privacy@mychallengestudio.com and we will remove it.

Every request is served over HTTPS. Passwords are stored as hashes by our authentication provider. Access between workspaces is separated in the application and that separation is covered by automated tests, including tests that sign in as one customer and attempt to reach another’s data.

No system is perfectly secure, and we would rather say so than imply otherwise. If you find a vulnerability, please report it to legal@mychallengestudio.com before disclosing it publicly.

Challenge Studio is in beta and still changing. If we start collecting something new, or add a provider that handles your data, we will update this page and change the effective date at the top. Where the change is significant we will email you before it takes effect rather than relying on you to re-read this page.

Smartstack Platforms LLC
Privacy: privacy@mychallengestudio.com
Everything else: legal@mychallengestudio.com

See also our Terms of Service.