Privacy
Policy.

supplementary.me and The Protocol Games are operated as a personal research and community project. This policy explains what data we collect, why we collect it, and how it is used. We collect only what is necessary to run the platform.

By using supplementary.me or participating in The Protocol Games, you agree to the practices described here.

Account data — when you create an account via email or Google Sign-In:

• Your email address
• Your name and profile picture (Google Sign-In only, provided by Google)
• Account creation timestamp

Protocol Games participant data — if you enter a competition:

• Demographic information you provide during onboarding (year of birth, sex, height, weight, country)
• Lifestyle baseline data (diet, sleep, exercise, supplement use, digital habits)
• Your declared protocol — this is published publicly once submitted
• Cognitive test scores from Mind Games sessions — stored sealed, revealed on reveal day
• Cooper test GPS distance from Heart Games sessions — pulled via Strava API with your explicit authorisation
• Weekly protocol log entries you choose to submit

Usage data — standard web analytics including pages visited, browser type, and approximate location. We do not use advertising trackers.

• To operate your account and authenticate you securely
• To run The Protocol Games competition and calculate your scores
• To display your public protocol declaration to other participants and the community
• To send transactional emails — account confirmation, password reset, competition updates
• To improve the platform based on aggregate usage patterns

We do not sell your data. We do not use your data for advertising. We do not share your data with third parties except as described in the section below.

We use the following services to operate the platform:

• Supabase — database and authentication infrastructure. Your account data and competition data are stored on Supabase servers. Supabase privacy policy: supabase.com/privacy
• Google Sign-In — optional authentication method. If you use Google Sign-In, Google shares your name, email, and profile picture with us. Google privacy policy: policies.google.com/privacy
• Strava — Heart Games participants connect Strava to verify Cooper test runs. We request read access to your activities to pull GPS distance for your registered test runs only. We do not store your full Strava activity history. Strava privacy policy: strava.com/legal/privacy
• Netlify — website hosting. Netlify may log standard web server data including IP addresses. Netlify privacy policy: netlify.com/privacy
• Resend — transactional email delivery. Your email address is passed to Resend to deliver confirmation and notification emails.

Cognitive test scores and Cooper test results are kept sealed until reveal day, at which point improvement scores and league rankings become public. Raw scores are never made public.

• Account data is retained for as long as your account is active
• Protocol declarations are retained permanently as part of the competition record
• Cognitive test scores are retained permanently for longitudinal research purposes
• You may request deletion of your account and associated personal data at any time — see contact below
• Publicly declared protocols may remain in the archive after account deletion as part of the research record, attributed to your username only

You have the right to access, correct, or delete your personal data at any time. To exercise these rights, contact us at the email below. We will respond within 30 days.

If you are in the European Union, you have additional rights under GDPR including the right to data portability and the right to lodge a complaint with your local data protection authority.

We use session cookies for authentication only — to keep you logged in between page visits. We do not use advertising cookies or cross-site tracking cookies. You can disable cookies in your browser settings but this will prevent you from staying logged in.

The Protocol Games is not directed at or intended for anyone under the age of 18. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.

We may update this policy as the platform evolves. Material changes will be communicated via email to registered participants. The date at the top of this page reflects the most recent update.