Invitation and account privacy · September 6, 2026

Your details. Your choice.

StrainArena uses the details you submit to manage invitations to its founding cohort.

What we collect

Your email and any name, X handle, or business URL you provide, the time you sign up, your consent, and an optional referral link. X handles are self-reported at this stage. No WHOOP health data, payment details, or passwords are collected through this form.

How we use it

We store requests in our database so we can contact you about access. Signup details are private. Referral links are public, contain no email address, and do not change a competitive rank. Technical logs record signup success or failure without your submitted details.

Spam prevention

A temporary keyed hash of your network address is used to limit repeated requests. The address itself is not stored in the signup database. Hosting providers may process request logs under their own privacy terms.

Optional account sign-in

When sign-in is enabled and you choose Google or GitHub, StrainArena stores your provider account identifier, name, email, email verification status and profile image, plus encrypted provider tokens and server-side session records. Session records can include your network address and browser information. Essential, host-only cookies keep you signed in; we do not receive your Google or GitHub password.

Your account is held by StrainArena, not shared sign-in with StreakWar. Signing in does not publish a profile or connect WHOOP. Signing out revokes the current session; it does not delete your account or invitation request. Contact us for account deletion and session-revocation requests. Separate consent will be requested before health data is connected or displayed.

If you choose email sign-in, your email address and a short-lived code are sent through Resend to deliver the login message. StrainArena stores a secret-keyed hash of the code, its expiry and verification attempts, not the code itself. Verifying the code creates an account or signs you in to the existing account for that email address. Email login does not subscribe you to marketing.

Analytics and crawler requests

We use MetricPanel to understand visits to public pages and requests from AI and search crawlers. Browser analytics uses cookieless identifiers, requests IP anonymization, and respects Do Not Track and Global Privacy Control. Public campaign/referral labels may be included; account pages, sign-in and API routes are excluded. Crawler tracking includes the requested public path, user agent and, on Vercel, the client IP for crawler verification, but excludes query strings and authentication headers. No form fields, email addresses, login codes, WHOOP data or payment details are intentionally sent to analytics.

Keeping and deleting details

Invite-list details are retained while invitations are being managed. You can ask us to remove your request at any time. Separate consent and retention information will be provided before health data is connected or published.

Contact

For access or deletion requests: [email protected].