Privacy notice
BetaThrek is in public beta: testers use it on iPhone and Android before it reaches the App Store and Google Play. This text describes what the service does today.
This Privacy Notice explains how Salvatore Amideo (VAT number IT14878190967), based in Italy (“Threk”, “we”, “us” or “our”), processes personal data when you use the Threk application, website and public result pages.
1. Data controller
Salvatore Amideo
VAT number IT14878190967
Italy
Certified email (PEC): salvatore.amideo@namirialpec.it
Email: privacy@threk-app.com
Threk is currently operated by Salvatore Amideo as an individual.
2. What personal data we process
Depending on how you use Threk, we may process:
Account information
- email address;
- public handle;
- optional displayed name;
- year of birth;
- optional sex classification;
- country;
- city;
- selected gym;
- optional profile photograph.
Your email address is not publicly displayed.
Performance information
For attempts, we may process:
- challenge;
- work completed;
- score;
- duration;
- attempt date and time;
- verification status;
- leaderboard position;
- age-bracket information;
- applicable leaderboard segmentation.
Video
If you choose to record a video, Threk processes the recorded video, sound included.
A video may contain:
- your image;
- your movements;
- your voice and any other sound around you;
- your surroundings;
- other people who accidentally enter the frame.
Video is used for verification and moderation. Once uploaded, it is visible to other registered users next to your leaderboard row, before it has been reviewed (section 9).
Profile photograph
If you choose to provide a profile photograph, it may be reviewed by an authorised Threk moderator before publication.
Technical information
Threk may process limited technical information necessary to operate and secure the Service, including IP address information and technical connection information.
IP information may be used temporarily for rate limiting, security and limited shared-link functionality.
IP addresses also appear in the server’s technical logs, together with the address requested, the time, the response status and the type of browser or app. These logs are kept for up to 14 days, for security and to diagnose faults.
The App also sends an identifier of its installation on your device. Threk stores only a one-way fingerprint of it, and only when an account is blocked for age (section 13).
Beta programme
If you apply for the public beta on the website, Threk processes your email address, the phone platform and model you indicate, your language and the date of your confirmation. If you arrived through one of our links that carries it, we also store the channel you came from (LinkedIn, Instagram, a direct message from us, or other): it tells us which channels bring interested people, and it is deleted together with the application. We use no cookies or tracking tools to know it.
Support messages and reports
If you write to support or submit a privacy report, Threk processes your email address, the topic or reason you choose, the content of your message and, if you provide them, the phone and app version.
Product events
Threk uses first-party product events to understand how core product functionality is used. Examples include:
- sign-up;
- challenge selection;
- attempt start/completion;
- result display;
- local ranking display;
- share actions.
Threk does not currently use third-party advertising or analytics SDKs.
3. Data we do not collect
Threk does not currently request access to:
- Apple HealthKit;
- Google Health Connect;
- GPS activity tracks;
- heart-rate sensor data;
- elevation data; or
- other fitness sensor streams.
Threk does not ask users to provide medical conditions or diagnoses.
Threk does not use facial recognition or biometric identification.
4. Purposes of processing
We process personal data to:
- create and maintain accounts;
- authenticate users;
- provide challenges;
- record performance;
- calculate scores;
- operate leaderboards;
- verify video submissions;
- moderate content;
- provide public sharing where selected;
- maintain security;
- prevent fraud and abuse;
- respond to privacy requests;
- comply with legal obligations; and
- maintain and improve the Service.
5. Purposes and legal bases
For each purpose, the data used and the legal basis under the GDPR are:
| Purpose | Data | Legal basis |
|---|---|---|
| Account, sign-in, challenges, attempts, scores and leaderboards | Email, handle, displayed name, year of birth, sex, country, city, gym, attempts and results | Performance of a contract (Art. 6(1)(b)) |
| Publication of your videos next to your leaderboard row in the App | Video, including image, voice and surroundings | Consent (Art. 6(1)(a)), given with the second checkbox when you accept the Safety Acknowledgement |
| Public web result page | The result data listed in section 7 | Consent (Art. 6(1)(a)), given when you confirm public sharing |
| Security, abuse and fraud prevention | IP address and technical connection data | Legitimate interest (Art. 6(1)(f)) in keeping the Service and its accounts secure and protecting them from automated or abusive use |
| Server technical logs, for security and fault diagnosis | IP address, address requested, time, response status, type of browser or app | Legitimate interest (Art. 6(1)(f)) in detecting attacks and abuse and in diagnosing faults in the Service |
| Moderation of videos, results, profile photographs and reports | Video, profile photograph, attempt data, report content | Legitimate interest (Art. 6(1)(f)) in keeping the leaderboards credible and removing content that breaks the rules or the rights of others |
| Product usage events | The events listed in section 2 | Legitimate interest (Art. 6(1)(f)) in understanding which features are used, to improve the Service |
| Age check and age block | Date of birth (only the year is kept), the outcome of the platform age check, the device fingerprint of a blocked account | Legitimate interest (Art. 6(1)(f)) in keeping people under 18 out of a service that is not intended for them and that involves strenuous physical activity |
| Public beta programme | Email, phone platform and model, language, arrival channel | Steps taken at your request (Art. 6(1)(b)) |
| Replies to support messages and privacy reports | Email and message content | Steps taken at your request (Art. 6(1)(b)) |
| Compliance with legal obligations and rights requests | The data needed for the specific obligation or request | Legal obligation (Art. 6(1)(c)) |
Right to object. Where Threk relies on legitimate interest, you can object at any time, on grounds relating to your particular situation, by writing to privacy@threk-app.com. Threk will then stop that processing unless it demonstrates compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish, exercise or defend legal claims.
Where Threk relies on consent, you can withdraw it at any time: withdrawing an entry from the App removes it and its video from public view, and a public result page stops when you withdraw the result or delete your account. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.
6. Leaderboards
Leaderboards are a core feature of Threk.
Depending on the leaderboard, users may compare performances by:
- worldwide ranking;
- country;
- city;
- age bracket;
- sex;
- gym.
Your actual year of birth is not displayed publicly.
Your sex is not displayed next to your name.
Choosing “undisclosed” or skipping the sex field excludes you from sex-based leaderboard segmentation.
Country, city and gym information are not automatically displayed next to your name.
7. Public results
Normal Threk leaderboard publication is part of the core Service.
Public web sharing is separate.
When you select Share and explicitly confirm public sharing, Threk creates a public result page.
The public page may contain:
- challenge;
- result;
- leaderboard position;
- displayed name or handle;
- verification status;
- date; and
- applicable verification information.
The page may be accessible without an account and may be indexed by search engines.
The public page is not created until the user explicitly confirms the sharing action.
8. Public sharing consent
The public sharing action is recorded separately from the Safety Acknowledgement.
Threk records:
- user identifier;
- attempt identifier;
- consent/action type;
- consent version;
- language;
- date and time.
Without the corresponding public-sharing consent record, a public share code is not created.
9. Video processing
Video is optional.
When a user records a video, the recording is continuous and made directly through the App.
Before submission, the user can review the recording and choose Keep & Submit or Discard & Record Again.
A discarded recording is not submitted for moderation.
The recording includes sound.
Once a video is uploaded, it is visible to other registered users next to your leaderboard row, from the moment of upload and before it has been reviewed. It is not visible to people without an account, and the public web result page does not show it.
Submitted videos may be reviewed by authorised Threk moderators.
Moderators use videos to assess whether the performance satisfies the applicable verification requirements.
10. Video retention
Two thresholds apply to the worldwide leaderboard of each challenge.
- A person reviews the videos of the top 20 of each challenge.
- After review, a video is kept only while its result is in the top 5. Outside the top 5 the video is deleted.
Videos that have never been reviewed are deleted after 30 days.
Deleting a video does not delete the associated performance result.
11. Accidental third-party recording
Users are instructed not to record other people without appropriate consent or legal basis.
If you appear in a Threk video and believe your privacy or image rights have been affected, you may submit a privacy report without creating a Threk account.
Reports may be submitted through the reporting mechanism available on the relevant public result page or by contacting privacy@threk-app.com. See the Content & Privacy Reporting Policy.
Threk will assess the report and take appropriate action where required.
12. Profile photographs
Profile photographs are optional.
They may be reviewed by authorised Threk moderators before being displayed.
Profile photographs are displayed only in the contexts supported by Threk’s leaderboard functionality.
13. Age
Threk is only for people aged 18 and over.
When you sign up, we ask for your full date of birth and check on our server that you are at least 18. We keep only the year of birth, which is also used to derive age-bracket leaderboard information. The actual year of birth is not publicly displayed.
Where your device offers it, the App also reads the age range of your Apple or Google account. Threk does not store the age range itself, but it stores the outcome: that the platform confirmed the age, or that the account was blocked.
If an account turns out to belong to someone under 18 — from the date entered, from the platform age range, or from a moderator reviewing a video — the account is blocked and the device it was used from is blocked too, so that a new account cannot be created from it. Then:
- its videos and profile photograph are deleted immediately;
- its attempts are removed from the public leaderboards;
- the account is deleted entirely after 30 days; and
- the device fingerprint — a one-way hash of an identifier of the App installation, not the identifier itself — is kept for 24 months.
14. Handle and public identity
Users may choose a public handle and, optionally, a displayed name.
A displayed name may be a real name or another name chosen by the user.
Users may change their handle subject to Threk’s applicable anti-abuse limits.
Email addresses are not publicly displayed.
15. Location
Threk does not request device GPS location.
Country and city information are selected by the user.
Threk does not use an IP address to infer the user’s city.
Gym search may use the Google Places API.
16. Service providers
Threk uses these providers to operate the Service:
- Hetzner — the servers that run the Service and its database.
- Cloudflare (R2) — storage of videos and profile photographs.
- Resend — delivery of all the Service’s emails: sign-in codes, verification outcomes, beta programme emails, the account deletion receipt, and replies to support messages and reports.
- Apple (TestFlight) — receives the email address of iPhone beta testers, to send them the TestFlight invitation.
- Google (Google Play and Google Groups) — receives the Google account email of Android beta testers who join the testers group and the test.
- Google Places API — receives the text typed in the gym search and the coordinates of the city you declared, not your identity.
- GeoNames — city data, used through Threk’s own copy of the dataset; nothing is sent to GeoNames.
Threk does not use third-party advertising or analytics SDKs.
17. International transfers
Some providers are based outside the European Economic Area, or may process data there. For each of them, the transfer mechanism is:
- Cloudflare (R2) — Cloudflare, Inc. (United States). The storage bucket is not restricted to the EU jurisdiction, so videos and photographs may be stored or processed outside the EEA. Mechanism: certification under the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses in Cloudflare’s data processing addendum.
- Resend — Resend (United States). Mechanism: Standard Contractual Clauses in Resend’s data processing agreement.
- Apple and Google — United States. Mechanism: certification under the EU-U.S. Data Privacy Framework and the Standard Contractual Clauses in their data processing terms.
- Hetzner — Hetzner Online GmbH (Germany), servers in the EU: no transfer outside the EEA.
18. Data retention
Personal data is kept for these periods:
- sign-in codes: 10 minutes;
- IP address linked to a shared link: 15 minutes;
- server technical logs, including IP addresses: up to 14 days;
- beta programme confirmation link: 48 hours;
- videos that have not been approved: 30 days;
- videos after review: as described in section 10;
- beta applications: 30 days if never confirmed, otherwise 12 months;
- privacy reports: 24 months after they are closed;
- database backup copies: 14 days;
- accounts blocked for age and device fingerprints: as described in section 13;
- account data: until the account is deleted (section 19);
- legal and security records: where retention is necessary to comply with law or to establish, exercise or defend legal claims.
19. Account deletion
You can delete your account in the App: Profile, then Settings, then Delete my account.
Account deletion removes your personal data, attempts and videos from active systems immediately. Database backup copies are overwritten within 14 days and are never used to restore a deleted account.
What remains after deletion:
- product usage events, with no reference to you; and
- if the account had been blocked because it belonged to someone under 18, the one-way fingerprint of the blocked device, for up to 24 months (section 13).
Public result pages associated with deleted results will become unavailable where technically applicable.
20. Your rights
Where the GDPR applies, you may have the right to:
- access your personal data;
- correct inaccurate data;
- request deletion;
- request restriction of processing;
- object to certain processing;
- receive certain data in a portable format;
- withdraw consent where processing is based on consent; and
- lodge a complaint with the supervisory authority: in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it).
Requests can be sent to privacy@threk-app.com.
We may need to verify your identity where necessary to protect your account or personal data.
21. Automated decision-making
Threk does not currently use automated decision-making that produces legal or similarly significant effects on users.
Scores and leaderboard positions may be calculated automatically according to predefined rules.
Video verification is performed through human review.
22. Security
Threk implements appropriate technical and organisational security measures, including:
- passwordless authentication;
- one-time access codes;
- passkeys where supported;
- HTTPS;
- HSTS;
- signed and expiring upload URLs;
- restricted administrative access; and
- server-side management of third-party credentials.
No internet service can guarantee absolute security.
23. Children
Threk is only for people aged 18 and over.
We do not knowingly permit users below the minimum age to participate in challenges.
24. Changes to this Privacy Notice
We may update this Privacy Notice when:
- the Service changes;
- processing activities change;
- legal requirements change; or
- additional safeguards are implemented.
Where required, we will provide appropriate notice and obtain renewed consent.
The current version is available at threk-app.com/privacy.
25. Contact
For privacy questions and requests:
Salvatore Amideo
VAT number IT14878190967
Italy
Certified email (PEC): salvatore.amideo@namirialpec.it
Email: privacy@threk-app.com
You may also contact the supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it).