Who we are
Victory Lap is made by Little Planet Labs LLC ("we", "us"). This policy covers the Victory Lap iOS app and the website at victorylap.fit.
If you have a question about this policy or your data, email support@victorylap.fit.
What we collect
Apple Health data
With your permission, Victory Lap reads the following from Apple Health:
- workouts and workout routes
- heart rate, resting heart rate and, on iOS 27, per-workout heart rate and power zones
- active energy
- cycling functional threshold power (FTP)
- cycling and running speed and power
- cycling distance and walking and running distance
- cycling cadence
- step count
- running stride length and ground contact time
Victory Lap only reads Health data. It never writes anything to Apple Health. It also asks to be told in the background when a new workout is saved.
Health data is processed on your device. We use it to find the workout a photo or video was taken during and to draw the stats and maps in your overlays.
When you publish a post, the app uploads that workout's full GPS route (timestamps, coordinates, altitude and speed) and its raw workout data to our servers, where they are stored with the post. Only you can read that route and raw data back. The summary stats you include on the post are part of the post itself (see "Who can see your content").
Photos and videos
With your permission, Victory Lap reads your photo library to match photos and videos to workouts. It reads each item's capture date, location metadata, filename and type. This matching happens on your device.
Photos and videos you export with an overlay are saved back to your photo library.
We only upload a photo or video when you post it. What we upload is the finished export (JPEG, PNG, HEIC, MP4 or MOV) and, for videos, a still frame used as a preview. Location metadata is removed from photos and videos we upload.
Location
Victory Lap does not use your device's location services. Routes come from the workouts in Apple Health.
To show place names and map images, the app sends route coordinates to Apple's MapKit service.
Your account
You sign in with Apple. From Sign in with Apple we receive your name, your email address (which can be an Apple private relay address if you choose to hide your email) and an identifier Apple assigns to you for Victory Lap. We also store when you sign in and a hash of the sign-in token Apple gives us, which we use to stop that token from being reused.
Your profile holds your username, display name and profile photo, along with when you accepted our terms and your account status.
Social content
When you use the social features, we store what you create and do there:
- post titles, captions, summary stat cards and the visibility you choose
- captions on photos and videos
- comments and likes
- friend requests and friendships
- people you block
- groups you create or join, and invites
- reports you file, including the reason you pick and any note you add (up to 500 characters)
Notifications
If you allow notifications, we store your device's push token so we can send them.
Kept on your device only
Your list of activities and the index of your photo library that Victory Lap builds stay on your device. We don't upload them.
What we don't collect
The Victory Lap app contains no analytics, advertising or crash-reporting tools, and it does not track you across other companies' apps or websites.
How we use your information
We use your information to:
- match your photos and videos to your workouts and draw overlays, on your device
- run your account and sign you in
- store and show your posts, comments, likes, friends and groups to the people you've chosen
- send you notifications
- screen content and handle reports (see "Moderation")
- limit abuse, for example by rate-limiting requests
Moderation
We moderate social content with a word filter, automated screening of text, reports from other users and review by our staff.
Automated screening
We use TypeSafe AI (its Jev model) to screen text automatically. We send it:
- post titles and captions
- captions on photos and videos
- comments
- display names, usernames and group names
- the reason category of a report (never the note you add to a report)
- the flagged word, when our word filter checks one
We never send photos or videos to TypeSafe AI.
TypeSafe AI processes this text in the United States and returns moderation scores. Under TypeSafe AI's privacy policy, it does not train or fine-tune AI models on the text it receives, and it may keep request data for as long as reasonably necessary to provide its service.
Our screening log keeps a hash of the text and the scores it received, not the text itself.
Human review
Content that is held by screening, or that someone reports, goes into a queue for our moderators, who are Victory Lap staff. The queue keeps a copy of that text so a moderator can review it. Moderators can approve content, reject it or suspend an account. When content is rejected, we delete it along with any photos or videos uploaded with it.
Content that is held for review is visible only to you until a moderator approves it. If the word filter blocks something you wrote, you can ask for a person to review it.
You need to accept our community terms before you post.
Who we share information with
We use these companies to run Victory Lap. They handle data on our behalf:
- Vercel hosts our API and this website.
- PlanetScale hosts our database.
- Cloudflare R2 stores uploaded photos and videos, profile photos, and the routes and raw workout data from your posts.
- Apple provides Sign in with Apple, push notifications, iCloud and MapKit.
- TypeSafe AI screens text for moderation, as described above.
If you choose to share an export to Instagram Stories, the app hands the file to Instagram through your device's clipboard. From there, Instagram's own privacy policy applies. This only happens when you choose to share.
We don't sell your personal information or share it for advertising.
We may disclose information if the law requires it or to protect people's safety. If Victory Lap's business is sold, merged or transferred, your information may transfer with it and stays covered by this policy.
Who can see your content
Only people signed in to Victory Lap can see social content. Each post has a visibility setting:
- Public: anyone signed in to Victory Lap
- Friends: your friends
- Groups: members of the groups you choose
- Private: only you
Anything shown in the photo or video you post, including stats or a map drawn into the overlay, can be seen by whoever can see the post. The full GPS route and raw workout data uploaded with a post are not shown to anyone but you.
Blocking works both ways: when you block someone, neither of you sees the other's content. When you report something, it's hidden from you.
iCloud
Your overlay templates, template defaults and how often you use them, and export presets are stored in your own private iCloud database. We don't use a public iCloud database. Deleting your Victory Lap account doesn't remove this data. You can manage it in your device's iCloud settings.
Notifications
We send push notifications through Apple's push notification service when someone likes one of your posts, sends you a friend request or invites you to a group. The notification text is generic and doesn't include the content of your posts. Moderators also receive alerts when content needs review. You can turn notifications off at any time in your device's Settings.
The website
This website is hosted by Vercel and uses Vercel Web Analytics to understand how the site is used. Vercel Web Analytics doesn't use cookies. It collects aggregate page views, the referring site, and your approximate country, browser and device type. See Vercel's analytics privacy policy.
The waitlist and signup forms are hosted by Typeform. When you follow those links, you're on Typeform's site and its privacy policy applies.
Keeping and deleting your data
We keep your account and content until you delete your account, or until we remove content through moderation.
You can delete your account in the app. When you do, we delete your account, profile, profile photos, posts, uploaded photos and videos, post routes and raw workout data, comments, likes, friendships, blocks, groups you own, group memberships, invites and device push tokens. We delete the stored files as well as the database records, and we revoke Victory Lap's access to your Sign in with Apple account. Deleting a group you own removes it for its other members too.
Some records are kept after you delete your account:
- moderation records: copies of text that was held or reported, the actions moderators took, screening scores and hashes, and reports (with the identity of the person who reported removed)
- hashes of sign-in tokens, until those tokens expire
We keep copies of moderated text for one year after the moderation decision, then delete them. We may keep aggregate counts that don't identify anyone.
Records we use to rate-limit requests are deleted after one hour. Push tokens that stop being used are removed.
Photos and videos saved to your photo library and data in your private iCloud database stay under your control on your devices.
Your choices and rights
- See and correct your information: you can view and edit your profile in the app, and you choose each post's visibility when you publish it.
- Delete your account: you can delete your account and its data in the app, as described above.
- Control permissions: you can turn off Victory Lap's access to Health, Photos and notifications at any time in your device's Settings.
- Ask us: for anything else about your data, email support@victorylap.fit.
Children
Victory Lap is for people 16 and older, and it isn't directed at anyone under 16. If we learn that an account belongs to someone under 16, we delete it. If you think someone under 16 has an account, email support@victorylap.fit.
Security
Uploaded photos and videos, profile photos, and post routes and raw workout data are only reachable through short-lived signed links. Social content is only shown to signed-in users that the post's visibility setting allows, and only you can read back the route and raw data from your posts.
Changes to this policy
When we change this policy, we'll update the date at the top of this page. For material changes, we'll also tell you in the app or by email.
Governing law
This policy is governed by the laws of the State of Texas, United States.
Contact
Little Planet Labs LLC, support@victorylap.fit