Effective date: October 4, 2026
Last updated: October 4, 2026
Reform LLC, an Illinois limited liability company, operates Pact. Contact support@reformapp.org for support or privacy requests.
This policy covers the Pact iOS and Android apps and Pact-related pages on reformapp.org. It does not describe data practices inside our other apps. Pact is offered in the United States. Our separate Consumer Health Data Privacy Policy explains our handling of fitness and other consumer health data. We extend the request rights described below to all U.S. Pact users without requiring them to establish coverage under a particular state statute.
| Category | Examples and source | Purpose |
|---|---|---|
| Account and profile | Name, email, optional profile photo; sign-in information from you or your chosen sign-in provider | Create and secure your account; identify you to your partner |
| Age and age-related signals | Date of birth entered for screening; retained age band of 13–15, 16–17, or 18+; available App Store age and consent signals and related identifiers | Enforce eligibility and apply age-related protections; an entered exact birthdate is not retained |
| Onboarding answers | Fitness goal, intended workout frequency, consistency history, general lifestyle barriers, commitment rating, partner intention, optional step goal | Set up Pact and tailor reminders |
| Workout activity | Workout dates and photos, weekly goals, streaks, achievements, and whether goals were met | Logging, accountability, and progress display |
| Communications | Comments, reactions, reports, support emails, privacy requests, and any attachments you provide | Partner interaction, support, safety, and request handling |
| Consent and transaction records | Document version, acceptance time, feature-consent decisions, the paywall copy and price shown when purchasing, and subscription events linked to transaction identifiers | Document choices, administer subscriptions, and meet recordkeeping duties |
Names, email, age screening, and onboarding answers are required to create and configure an account. A photo is required to log a workout. Profile photos, comments, reactions, support communications, and step features are optional.
We do not ask for diagnoses, medication lists, treatment history, sexual or reproductive health information, weight, diet, or other medical details. However, a photo, comment, or support message may reveal sensitive information if you include it. Please avoid unnecessary sensitive details and other people’s private information. We do not extract facial templates or other biometric identifiers from photos.
Sign in with Apple. We store an Apple-issued token in a restricted server-side table to revoke Pact’s Apple sign-in authorization when you delete your account. It is then deleted. Apple and Google also process sign-in information under their own policies.
With your permission, Pact reads daily step totals from Apple Health, which may include steps recorded by your phone or other sources connected to Apple Health. We do not read other HealthKit data or write data into Apple Health. We store steps on our backend to display progress and track your optional step goal. Step counts do not affect workout streaks.
Turning off step collection in Pact’s own Settings deletes previously collected Pact step data. Revoking permission in Apple’s Health app stops future reads but does not itself delete our existing copy: Apple does not tell Pact whether read permission has been revoked. To remove stored steps, use Pact’s setting, delete your account, or send a deletion request. This does not delete the underlying records in Apple Health.
Step collection is available only on iOS. On Android, Pact does not read your steps; you may still see a partner’s steps if that partner uses iOS and has chosen to share them with you. Partner step sharing is separately controlled in Pact, off by default, and resets to off for each new pairing. When sharing is off, Pact does not send your partner notifications about your step-goal activity. You can use the rest of Pact without granting Apple Health access. We do not use HealthKit data for advertising, marketing, or prohibited data mining, and do not store it in iCloud.
Pact and its providers process account identifiers, push tokens, IP addresses, request timestamps, device/app information, and subscription status and transaction identifiers. These support authentication, delivery, troubleshooting, abuse prevention, and billing. Apple (on iOS) or Google Play (on Android) handles payment details; we do not receive your payment-card number. On Android, we do not collect or use your Android advertising ID.
Pact does not request location permission or collect GPS coordinates. Embedded photo metadata, including GPS metadata, is stripped before storage. IP addresses and the visible contents of photos may nevertheless reveal approximate location; this is distinct from requesting device location.
Cloudflare receives website requests, including network and browser information needed to serve and secure Pact pages. We do not place advertising or cross-site tracking pixels on those pages. Provider operational processing is distinct from advertising tracking.
Pact derives streaks, goal progress, and internal reminder categories from your activity and onboarding information. Those categories tailor reminders; they are not advertising profiles or decisions producing legal or similarly significant effects. Fitness-related inferences are covered by the Consumer Health Data Privacy Policy.
We use information to operate accounts and pairing; display workouts and progress; deliver the optional features you select; send service and activity notifications; administer purchases; handle reports and privacy requests; secure the Service; and meet legal obligations. We do not send marketing email or use Pact data to advertise other products. For users 18 and older, we also use limited device information to measure whether our own advertising led to an installation. Optional processing that requires consent is not authorized merely by accepting our Terms or reading this policy.
Your current partner sees your name, profile photo, logged workouts and photos, weekly goals, streaks, achievements, comments, and reactions. If step sharing is enabled, the partner can also see your step count and progress toward your step goal.
Pairing requires an invite code; there is no discovery or matching feature. Share codes only with someone you know and trust. Pairing does not verify the other person’s identity or guarantee their conduct.
Turning off step sharing ends the partner’s authorized access to your steps. When a pairing ends, you and your former partner can no longer see each other’s workouts, photos, comments, reactions, streaks, or steps, the shared streak stops counting, and reactions on workouts from that pairing are deleted. Each person keeps their own workouts and photos in their own account, and a comment a former partner left on your workout stays with that workout. A partner may already have seen information or made a screenshot outside Pact; we cannot guarantee removal of those independent copies. Restricted backups and legal holds are described below.
| Recipient | Information and purpose |
|---|---|
| Supabase | Account data, authentication records, fitness data, photos, comments, consent/subscription records, and technical logs; database, authentication, file storage, and synchronization. Pact’s primary backend is hosted in the United States. |
| Apple | Sign-in and purchase information, platform age/consent signals, and notification delivery data. HealthKit access is authorized on the device; push notifications may reveal fitness activity. |
| Information needed for Google Sign-In if you choose it. On Android, purchase information through Google Play and push-notification delivery through Firebase Cloud Messaging. Photos you upload are sent to Google Cloud Vision (SafeSearch) for automated safety screening on our behalf. | |
| RevenueCat | App-specific user identifier, purchase/subscription events, and entitlement information for subscription management. |
| Expo | Push tokens, notification text, and delivery payloads. Messages can indicate activity such as meeting a step goal, even when no numerical count is included. |
| Resend | Recipient email address, transactional message contents, and associated delivery information for inactivity warnings, subscription reminders, price-change notices, and other service communications. |
| Zoho Mail | Support and privacy correspondence, sender details, and attachments, potentially including health information you choose to send. |
| Cloudflare | Website requests and associated network/browser information for hosting and securing Pact pages on reformapp.org. It does not host Pact’s app database. |
Providers acting as our processors handle information to perform their contracted services. Apple and Google also act independently for their own platform, account, security, and payment operations, subject to their policies and applicable law. We do not represent every provider as having no independent legal duties or purposes.
We may disclose information in response to valid legal process, to make required reports to NCMEC, or under another applicable legal permission, including a qualifying emergency. Private communications are not disclosed merely because someone requests them or alleges a Terms violation. We assess disclosure under the Stored Communications Act and other applicable law.
Information may transfer in a merger, acquisition, or sale of business assets subject to applicable law and existing privacy obligations. Any additional consent required for a new purpose or disclosure must be obtained before that processing begins.
Advertising measurement (Meta). If you are 18 or older, Pact starts Meta’s SDK. Meta may receive your device type, operating system, app version, IP address, install and app-open timing, and, only on iOS and only if you separately allow tracking in Apple’s prompt, your device advertising identifier. On Android, we do not collect or send Meta your Android advertising ID. We configure the SDK in Meta’s Limited Data Use mode and limit it to install and app-open measurement. We send Meta no content or activity from inside Pact. Meta acts under its own terms and privacy policy. Because Pact is a fitness-related app, the fact that a device has Pact installed could be considered sensitive. You can turn this off at any time in Settings; it fully takes effect the next time you open Pact. Declining or withdrawing does not affect your use of Pact. We do not enable this for users under 18 or users whose age is unknown. Under some state laws this disclosure may be treated as “sharing” for advertising; you can opt out using the Settings toggle or by emailing support@reformapp.org.
Other than the Meta measurement above, we do not sell personal information or share it for cross-context behavioral or targeted advertising.
| Category | Retention rule |
|---|---|
| Account/profile and onboarding data | Until account deletion or the inactivity process below, unless a narrower deletion request applies |
| Workouts, photos, comments, reactions, streaks | Until deleted through available controls, account deletion, or pairing termination |
| Step records | Until deletion through Pact’s collection setting, a verified request, or account deletion |
| Apple sign-in token | Until used for revocation during account deletion and then deleted |
| Inactive accounts | After 24 months without sign-in, we send a warning; deletion follows 30 days later unless you sign in again |
| Routine backend/authentication logs | Configured for a 7-day window; this does not describe every independent provider’s security or operational records |
| Subscription/billing records | Four years after the recorded transaction for accounting and disputes |
| Automatic-renewal consent evidence | At least three years after consent, or one year after the contract ends, whichever is later; retained longer only where another applicable legal obligation requires it |
| Support correspondence | Up to 24 months after the correspondence is closed, unless a deletion right or specific legal requirement calls for different treatment |
| Routine database backups | Supabase Pro daily database backups have a rolling 7-day window. This database backup does not include the actual photo files stored through Supabase Storage. |
Deletion removes information from active Pact systems and triggers applicable requests to providers. Information in restricted database backups expires on the stated schedule. When recovering from a backup, we reapply deletion instructions before restored data is made available to users. Provider-held records are addressed through applicable deletion obligations; the 7-day database-backup period is not a promise that every vendor deletes all records within seven days.
We retain a limited subset of information where required or permitted by applicable law, such as subscription-consent evidence and material subject to a valid preservation obligation. Required NCMEC preservation generally lasts one year from a report, with extensions where legally authorized. Retained material is restricted to the relevant purpose; it is not kept for ordinary partner sharing. A legal hold does not justify keeping unrelated information indefinitely.
Deleting Pact or your Pact account does not cancel your subscription. Cancel separately in your Apple subscription settings or in Google Play, depending on where you subscribed, to stop renewal.
Measures include encryption in transit and at rest provided by our infrastructure, database access controls, private photo storage with signed URLs, metadata removal, and restricted administrative access with multifactor authentication on administrative accounts. Only Reform’s principal currently has administrative access. No system can guarantee perfect security.
We provide breach notices when required by applicable law. Email is our usual communication channel, supplemented by another required notice method where applicable. You may request first-class mail for breach notices by emailing support@reformapp.org with a mailing address; we use that address for that purpose.
Use Pact’s settings to stop step collection and delete stored steps, stop step sharing, change teen engagement choices, end a pairing, block a partner, or delete your account. Device settings control push notifications and, on iOS, HealthKit read permission; revoking HealthKit permission alone does not delete stored Pact steps.
Email support@reformapp.org to request access, correction, deletion, a portable copy, details of recipients, withdrawal of consent, or an appeal. We extend these request rights to all U.S. users. Access includes applicable information about inferences and disclosures. You can turn off Meta advertising measurement in Settings at any time. We do not sell personal information or conduct profiling with legal or similarly significant effects.
We verify identity and any agent’s authority proportionately, collecting no more verification information than necessary. Control of an email address may need additional confirmation before we disclose sensitive information. We handle authenticated requests within 45 days, or sooner where required. Any extension is limited to what applicable law permits; we explain its reason before the initial deadline expires. Where required, we acknowledge receipt sooner.
If we decline a request, we explain the reason and how to appeal. Reply with Appeal in the subject line. We respond within 45 days or a shorter applicable deadline and provide information about contacting the relevant state authority if the appeal is denied. Authorized agents may act with verified permission as allowed by law.
We do not retaliate for exercising privacy rights. A feature that needs data you decline to provide or ask us to delete may no longer function; unrelated functionality remains available. Our response will explain any applicable, limited legal exception to deletion or access.
California residents under 18 who are registered users may also request removal of their posted content by contacting us. Removing content from Pact does not necessarily remove copies held independently by others or records lawfully retained.
Do Not Track and Global Privacy Control. We do not sell personal information. If your device sends a recognized opt-out signal, we treat it as turning off Meta advertising measurement where technically able. The Settings toggle is the primary opt-out.
Pact is for users 13 and older. An age screen precedes account creation. We do not knowingly permit under-13 accounts. If we learn of one, we promptly restrict it and delete its information, subject only to applicable preservation requirements. Contact us if you believe a child under 13 has an account.
For users known to be 13–17, Pact limits processing to legally permitted purposes and obtains consent for optional processing where required. Before optional streaks and escalating reminders are enabled, teens are offered equally prominent choices to enable them or leave them off, and can change their choice in Settings. Teen reminder escalation is capped, with quiet hours from 9 p.m. to 7 a.m. local time. These controls do not replace any separately required parental consent or platform-age requirement.
We do not use teens’ information for advertising or sell it. Meta’s SDK is never started for users under 18 or users whose age is unknown. If we learn an adult-designated account belongs to a teen, we apply the corresponding protections. Parents’ and guardians’ requests are verified for identity, authority, and compliance with the teen’s privacy rights; a request is not an automatic right to view another person’s content.
The primary Supabase backend is hosted in the United States. Other providers may process information in the United States and other countries under their service arrangements. U.S.-only app availability does not mean all vendor support and infrastructure processing stays in the United States.
We update this policy before materially changing the practices it describes, provide appropriate notice, and obtain consent where required. Continuing to use Pact is not a substitute for consent required for a new use of sensitive information.
Contact Reform LLC at support@reformapp.org. Related documents: Terms of Service and Consumer Health Data Privacy Policy.