Laurels is made by Whisk Mobile Development Pty Ltd. This policy covers the Laurels apps for iOS and Android, and the Laurels website at laurels.fit. We use "we", "our" and "us" to mean Whisk Mobile Development Pty Ltd.
Laurels sends one short record per activity, listed field for field in section 1, plus whatever name you choose to go by. It reads nothing from your phone unless you ask it to, and it shows you the exact data before it leaves. There is no advertising, no analytics and no tracking, and we do not sell personal information.
An account is created when you first open the app. It is anonymous: a random identifier, when it was created, and whether it is still active. No name, no email address, no phone number.
You can optionally sign in with Apple or Google, so the account survives a lost phone and works on a second device. The credential is attached to the same anonymous account you already had, so nothing you have sent changes hands.
The two providers are not equivalent, and it is worth saying which is which. Apple, asked for no scopes, gives us an opaque identifier and nothing else. Google puts the account's email address and Google display name into the authentication record, and there is no narrower permission available to ask for. Neither is ever copied into the league database, neither is ever shown to another member, and we do not email you. But if you sign in with Google, that address is held in the authentication record for as long as the account exists, and Apple is the choice that avoids it.
For each league you join: the display name you chose for that league, which team you are in if the league uses teams, whether an administrator has approved you, and when you agreed to this policy. A display name is whatever you type. Nothing in the app asks for or checks a real name.
One record per activity you send. This is the whole thing, field for field. The app shows it to you before you send an activity yourself, and in your sent log for any activity sent automatically.
{
"memberId": "<your anonymous id>",
"activityType": "ride",
"distanceM": 24310,
"durationS": 3742,
"elevationM": 318,
"startedAt": "2026-09-14T06:12:00+08:00",
"source": "healthkit",
"wasUserEntered": false,
"autoSubmitted": false
}
source records which health platform the numbers came from,
and wasUserEntered whether the workout was typed in by hand
rather than recorded by a device. autoSubmitted records whether
you reviewed it first or had the app send it for you, because "the app sent
this without asking me" is something you should be able to check later. We
also store the score the activity earned, worked out from the numbers above
and the league's own weightings.
Distance and duration are in the payload, so an average pace can be worked out from them. We would rather say that than claim otherwise.
There is no analytics package, no crash reporting, no advertising identifier and no third-party software development kit that collects anything. Nothing in Laurels counts what you tap.
The app reads workout summaries from Apple Health on iOS, or Health Connect on Android, and only after you grant that permission on the phone. You can withdraw it at any time in the operating system's own settings, and the app will simply stop finding new workouts.
Nothing is read on a schedule unless you turn on automatic sending, and turning it on applies from that moment forward. It never reaches back over workouts recorded before you switched it on.
Health data obtained through Apple Health or Health Connect is used for one purpose: scoring the league you chose to send it to. It is never used for advertising or marketing, never sold, and never disclosed to a third party for their own purposes.
A league has a public web page. Anyone with the link can see, without signing in: the league's name and description, each member's display name, their totals and rank, and the most recent activities with their distance or time, the score earned, and any reactions.
That page is the point of the product, so it is worth being precise about it. A league marked unlisted carries a random suffix in its address, which means the page has to be given to you rather than guessed at. It is still a public web page. Pasting a league link into a chat app hands the address, and the preview it generates, to that app's servers. That is true of every link and is not something we can fix from our end.
The exact figures you sent, as opposed to the totals derived from them, are readable only by you.
We use the information above to run the league you joined: to score your activities, rank the table, and show the activity feed. We do not use it for anything else, and we do not sell personal information.
Laurels runs on Google Firebase, which provides authentication, the database, the server code, file storage and web hosting. Google processes the data on our behalf under its own terms, and does not use it for its own purposes. No other third party receives it.
The database is in Google's United States multi-region and the server code runs in Iowa, so if you are outside the United States your information is stored and processed there. For Australian users, this is a disclosure of personal information to an overseas recipient, and we would rather state it here than leave you to work it out.
Leaving a league and deleting your account are deliberately different.
Deletion is immediate and cannot be undone. Backups held by our hosting provider are overwritten on their own cycle, within 30 days. An individual activity can be taken back at any time without deleting anything else. It stops counting, the league's totals are recalculated without it, and the record of it is erased: the type, the distance, the duration, the elevation, the time and the source all go. An empty marker stays behind, carrying none of those, so that automatic sending cannot put the same workout back the next day. You can send it again yourself if you change your mind; the automatic path cannot.
All of these are in the app, under Settings, and none of them require asking us:
If you would rather we did it, or you cannot reach your account, email us at the address below. Depending on where you live you may also have the right to correct your information, object to how it is handled, or complain to a regulator. In Australia, that is the Office of the Australian Information Commissioner.
Connections are encrypted in transit and the stored data is encrypted at rest. Who can read what is enforced by database rules rather than by the app being polite about it: the rules are what stop one member reading another's submissions.
To keep other people's software from writing into your league, requests are checked with Apple's App Attest on iOS and Google's Play Integrity on Android. Both answer one question, which is whether the request came from a genuine copy of Laurels. Neither tells us anything about you or your device.
The website sets no cookies and runs no trackers. The league administrator page stores a sign-in token in your browser so you stay signed in; that is local to your browser and is not used to follow you anywhere.
Laurels is not intended for children under 13, and we do not knowingly hold information from one. If you believe a child has created an account, email us and we will erase it.
If we change this policy we will post the new version on this page and change the effective date. Where a change affects what we collect or who can see it, the app will ask you to agree again rather than quietly updating the date at the top.
Whisk Mobile Development Pty Ltd
ABN 90 695 496 685 · ACN 695 496 685
Perth, Western Australia
privacy@whiskmobile.com