Challenge Accepted is a local‑first habit and challenge tracker. We value your privacy and designed the app to work without accounts or servers by default.

What we store

• Local data: Your challenges, habits, and progress are stored in your browser's local storage on your device. This data never leaves your device unless you explicitly export or sync it.
• Optional Google Sheets sync: If you connect Google on the Import Data or Export Data pages, the app requests an access token via Google Identity Services and communicates directly from your browser to the Google Sheets API to read/write a spreadsheet you explicitly choose by creating it or pasting its ID. No server operated by us proxies or stores your data or tokens.
• Spreadsheet ID: If you create a spreadsheet or paste an ID to sync, that ID may be saved in local storage for convenience.

What we do NOT do

• No account creation or sign‑ups.
• No tracking, analytics, or ads.
• No server‑side storage of your personal data.

Third‑party services

The optional Google integration uses Google Identity Services and Google Sheets API. Your use of these services is subject to Google's terms and privacy policies.

How we use Google user data

• Purpose: With your explicit consent, we request an OAuth 2.0 access token scoped only tohttps://www.googleapis.com/auth/drive.fileto create, open, and modify a Google Sheet created within the app (or a sheet it previously created via its ID) for the sole purpose of importing/exporting your Challenge Accepted data. Because of the drive.file scope, sheets created elsewhere cannot be accessed. We do not list or search your Drive files.
• Limited use: Google user data (the token and spreadsheet contents you choose) is used only in your browser to perform the requested Sheets operations. We do not use it for advertising, profiling, or any unrelated purposes.
• Token handling: The OAuth token is acquired client‑side and may be cached in your browser's local storage to allow optional silent restore. You can remove it at any time by clicking Disconnect Google or by clearing site storage for this app.
• No server copy: We do not run a proxy for Google APIs and we do not store your token, Sheets data, or personal information on our servers.

Sharing and disclosure of Google user data

• No sale or sharing: We do not sell, share, transfer, or disclose Google user data to third parties.
• Direct to Google only: Your browser communicates directly with Google Identity Services and the Google Sheets API to fulfill your requests. Aside from Google as the service provider you chose to connect, your data is not disclosed to any other party.
• User control: You can revoke app access at any time from your Google Account security settings. Disconnecting within the app also revokes the token stored in your browser.
• Legal compliance: We may disclose information if required by law, but we do not otherwise transfer Google user data.

Data security and protection

• Encryption in transit: All requests to Google APIs occur over HTTPS.
• Local‑first storage: Your app data and, if enabled, the OAuth token are stored only on your device's browser storage and are not sent to our servers.
• Least privilege: We request only the Google Sheets scope needed to read/write your selected spreadsheet.
• User controls: You can export and delete local data at any time, disconnect Google to revoke the token and clear the saved sheet ID, and revoke access from your Google Account.
• No sensitive categories: The app does not require or infer sensitive personal categories. Any data you choose to store is under your control.

Cookies

The app itself does not set tracking cookies. Google's sign‑in flow may set cookies necessary for authentication if you choose to connect Google.

Data export and deletion

You can export your data at any time from the Export Data page or import it from Google Sheets on the Import Data page. To delete your local data, clear your browser's site storage for this app. If you synced to Google Sheets, you control and can delete the spreadsheet in your Google account.

Children's privacy

Challenge Accepted is not directed to children under 13. If you believe a child has provided us with personal information, please contact us so we can assist, though by design we do not hold server‑side data.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected on this page with an updated effective date.

See also: Terms of Service.