← Back to the cup

PRIVACY

Last updated October 10, 2026 · Contact support@healingwithgood.com

What we collect

When you join, we store your email address, chosen display name, city, state or province, country, a one-way password hash, and the date you joined. We store the good deeds you log, custom deed requests and comments you submit, reports you file, and moderation decisions. Older accounts can use a private player key once to add email and password. We do not ask players for their legal name, precise location, phone number, or photos. We do not collect payment card details on this site.

If you choose to support the site, Stripe collects the payment amount, email, and payment details on its hosted checkout. The site operator can see donation transactions in the existing PUNKTHEM Stripe account. Stripe handles payment data under its own privacy notice. Donations are separate from league accounts and scores.

Our site temporarily stores a one-way, keyed hash of your IP address to slow spam. The hosting provider may keep ordinary security and access logs. A secure, HTTP-only browser cookie or a token in the mobile device's secure storage keeps you signed in for up to 90 days; we do not save your password on the device. Password reset links expire after 30 minutes. Your device stores a manual language choice if you make one. Automatic language uses your device's language settings; Country language uses the country you choose or your device's region setting. We do not send your IP address to a language detection service. In the mobile app, a list of players you choose to hide is stored only on your device and can be cleared in app settings.

What other people see

After review, your first chosen name and city may appear with your self-reported point total. Approved comments and custom deeds appear with your first chosen name and city. Until your name is approved, public tables say “New player.” Your email, password hash, sessions, reports, and IP address are not public.

How we use and protect data

We use the data to run the league, show standings, moderate submissions, answer support requests, reset passwords, and prevent abuse. We do not sell member data. We do not run ad trackers on this site. Data is hosted with GoDaddy in the United States and may be accessed by the site operator for moderation. We use HTTPS, password hashes, and server-side session hashes. If you still have an old player key, keep it private until you upgrade your account.

Retention and deletion

You can delete your account from your player card on the website or in the app. This removes your player record, deed logs, ideas, comments, reports, and sessions from the live database. Some security logs and backups may remain temporarily with the host. If you forget your password, use the reset link on the sign-in form. For help, email support@healingwithgood.com. See the deletion steps.

Your choices

You may stop participating, sign out of a device, report content, hide someone from your own mobile app view, or delete your account. Hiding someone locally never changes another person's account or the league's scores. The owner reviews reports and can suspend accounts. Contact us about access or correction requests. We may need enough information to verify that the request concerns your account.

Age and changes

The service is for people at least 16 years old who may lawfully consent to participate where they live. We may update this notice as features change. We will post a revised date here.