Privacy

Last updated 13 September 2026

This site holds your weight, your body measurements, what you eat, how you train, how you slept, and the prayers you have asked men to pray. That is about as personal as data gets, so this page is specific rather than general. It says what is collected, where it goes, and the exact cases where somebody other than you can see it.

The short version. Your data is not sold, not shared with advertisers, and not used to train anything. It is visible to you, to any accountability partner you accept, to an administrator who needs to fix something, and to the specific outside companies listed below when you choose to use the features that involve them.

What is collected

Account. Username, name, email address, date of birth, password (stored hashed, never readable).
Body. Weigh-ins, body composition, tape measurements, height, age, activity level.
Training. Workouts, sets, weights, routines, benchmark attempts.
Nutrition. Meals, foods, recipes, calorie and macro totals.
Sleep and recovery. If you connect an Oura ring: sleep and readiness scores, time asleep, heart rate variability, resting heart rate, body temperature relative to your own baseline, steps.
Faith and community. Prayer requests, Bible reading progress and reflections, goals, events and attendance, posts, comments, direct and group messages.
Technical. Server logs of requests, and a session cookie so you stay signed in.

Who can see it

You

Everything, at any time.

Accountability partners

A man you accept as a partner can read your training, nutrition, body measurements, benchmarks and goals. It is deliberately all or nothing: there are no per-category toggles, because a partnership with parts hidden is not one. He cannot change anything, and his AI assistant cannot see your data. Either of you can end it instantly, and access stops on his next page load. The who can see my data page lists exactly who this currently is.

Your prayer requests, direct messages and private reflections are not part of a partnership.

Other members

Whatever you post publicly: feed posts, prayer requests you share, event comments, group chats, and your benchmark results if you turn on the shared board. Streak counts appear on the leaderboard.

Administrators

The site is run by The 27, who has database access and can therefore see anything stored here. It is looked at to fix faults and to handle the conduct problems described in the terms, not out of curiosity.

Outside companies

Data leaves this server in four cases, all of which you choose:

Withings and Oura, if you connect a scale or a ring. Authorisation tokens are held here, encrypted; the readings come to us. Their own terms cover what they hold.
KLIPY, when you search for a GIF. The search words go to them. Your identity does not: requests are made by this server under one identifier for the whole site.
Anthropic or OpenAI, if you connect Claude or ChatGPT. The data those tools read leaves this site under their terms. Only your own data, never a partner's.
Open Food Facts, when you scan a barcode. The barcode is sent; nothing about you is.

There are no advertisers, no analytics services, and no tracking cookies. Nothing here is sold, and nothing here is used to train an AI model by us.

Where it lives

On one virtual machine hosted by Google Cloud in the United States, in a PostgreSQL database, with nightly backups to Google Cloud Storage. The connection to the site is encrypted. Passwords are hashed. Device authorisation tokens are encrypted at rest.

A word about health data

This is worth stating plainly, because people assume otherwise. The 27 is not a healthcare provider and not covered by HIPAA. The health data here does not carry the legal protections that the same numbers would have at a doctor's office. It is looked after carefully, but it is looked after by a friend running a server, not by a regulated institution. Log accordingly.

How long it is kept

For as long as your account exists. Ask an administrator to delete your account and the data attached to it goes with it, within a few days, and out of backups as those rotate. Messages you sent to other men stay in their conversations.

Your choices

End any partnership, at any time, from the visibility page.
Disconnect a scale, a ring or an AI assistant. Readings already imported stay unless you delete them.
Turn off push notifications in your browser or in the site's settings.
Delete individual entries yourself, or ask for the whole account to go.
Ask for a copy of what is held about you.

Getting in touch

Anything about your data, including a request for a copy or a deletion, goes to noreply@the27.org.