Firstlap · Privacy Policy
Your story stays yours.
Firstlap is a community for sharing the small beginnings that make movement feel possible. This policy describes the information used to run your account, publish and sync community activity, keep members safe, and give you control over your data.
Effective: September 25, 2026 · Last updated: September 25, 2026
1. Scope and operator
This policy applies to the Firstlap iOS application, the Firstlap community service at api.firstlapx.com, and the related support and moderation tools. Firstlap is provided by the developer identified on the App Store product page. In this policy, “Firstlap,” “we,” “us,” and “our” refer to that provider.
This policy covers information processed by Firstlap. Apple and other service providers process information under their own terms and privacy notices when you use their products.
2. Information we collect
Account and authentication
When you create an account, we process your email address, display name, password hash and salt, email verification status, account status, and the dates associated with account creation and updates. We do not store your password in readable form. Registration and password-reset codes are sent to the email address you provide and expire after a short period. Signed-in sessions use an opaque token stored in the iOS Keychain and may remain valid for up to 90 days unless you sign out, reset your password, delete your account, or the session is revoked for security reasons.
Profile and community content
We process the information you choose to add to your profile and community, including your display name, profile image or initials, sport interests, biography, group memberships, posts, “My First” milestone cards, everyday moments, captions, feelings, comments, replies, and optional photos. A post may also include the sport, selected group, creation time, and visibility you choose.
Do not post sensitive information that you do not want other members to see. Photos may contain information visible in the image or embedded by the source file. Firstlap does not ask you to upload government identifiers, financial records, medical records, or precise workout routes.
Interactions and relationships
To make community actions work across devices and members, we process applause and “With you” reactions, saves, follows, group joins, post and comment identifiers, notification state, and the people or content you block. We also record the time and basic state of these actions so the App can display accurate counts and undo an action when supported.
Safety, reports, and appeals
If you report a post, comment, group, or member, we process your selected reason, optional explanation, the reported content and surrounding context, the parties involved, and the status of the review. If a moderator acts, we keep the decision, reason, audit record, notice to the affected member, and any appeal and outcome. Reports are not shown publicly. Authorized moderators use this information to enforce the Community Guidelines, prevent repeat abuse, and document consistent decisions.
Photos and media
When you choose a photo through the iOS photo picker, the selected file is uploaded to Firstlap so it can appear with your post and sync to other signed-in devices. Firstlap does not scan your full photo library. Draft uploads may be held briefly while you finish a post and are removed when they expire or are no longer needed. Current uploads are limited to 2 MB per photo.
Notifications and device information
If you enable push notifications, we process an Apple Push Notification service device token, notification preferences, and the event needed to prepare the notification, such as a comment, follow, reaction, moderation decision, or appeal result. Apple delivers the notification to your device. In-app notifications can be provided without remote push.
Network, security, and diagnostics
When the App contacts the service, our infrastructure may process IP address, request time, route, HTTP headers, response status, device or App version information supplied by the request, and security signals needed to authenticate requests, prevent abuse, enforce upload limits, diagnose failures, and keep the service available. We do not use this information for third-party advertising or to build advertising profiles.
Information kept on your device
The App keeps certain preferences, unfinished draft text, local journey records, selected media references, saved interface state, and supported export data on your device. The authentication token is stored in the iOS Keychain. Removing the App may remove local-only information that has not been published or synchronized.
Information we do not intentionally collect
Firstlap does not currently use HealthKit, continuous fitness sensors, precise GPS location, contacts, microphone recordings, payment card information, the advertising identifier, or third-party advertising SDKs. The App does not offer purchases or paid subscriptions. If these practices change, we will update this policy and request system permission or consent where required.
3. Where information comes from
- From you: account details, profile information, posts, photos, comments, reports, appeals, support messages, and settings you choose.
- From your activity: reactions, saves, follows, group membership, blocks, notification state, session activity, and service requests.
- From your device and network: push token, app version, request metadata, IP address, and security or diagnostic information.
- From other members: comments, follows, reactions, or reports that relate to your account or content.
- From service providers: delivery or error status needed to send an email or push notification and maintain the service.
4. How we use information
We use information only for the purposes described below:
- create, verify, secure, and recover accounts;
- authenticate sessions and synchronize profiles, content, groups, relationships, and settings;
- publish posts and comments according to their selected visibility;
- deliver reactions, replies, follows, saved items, in-app activity, and optional push notifications;
- send registration codes, password-reset codes, account notices, and support responses;
- receive reports, hide blocked-member activity, review possible violations, take moderation action, and decide appeals;
- protect members and the service from spam, fraud, unauthorized access, unsafe content, and technical abuse;
- operate, troubleshoot, measure reliability, enforce storage limits, and improve the App; and
- comply with law, valid legal process, and obligations connected with safety or App Store distribution.
We do not sell your personal information or share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about you.
5. Content visibility
Your choices and the feature you use determine who can see information:
- Community content can be viewed by signed-in Firstlap members and may display your profile identity, post, photo, sport, reactions, and comments.
- Group content follows the access and membership rules shown for that group.
- Private journey items remain available to your account and are not placed in the community feed unless you choose to publish them.
- Reports and appeals are limited to authorized reviewers and the people who need the resulting notice. We do not tell a reported member who submitted the report unless required by law.
- Blocked relationships are not public. Blocking filters the affected accounts’ posts, comments, follows, and actor notifications from one another as described in the App.
Other members may capture or share content they can view. Deleting a post removes it from Firstlap, but we cannot remove copies another person made outside the service.
6. Service providers and disclosure
Firstlap uses a limited set of processors to provide the service:
- Cloudflare hosts the API, account and community database, private media storage, security controls, and delivery infrastructure. Cloudflare may process network and service data to provide and protect that infrastructure.
- Resend sends requested registration and password-reset emails from the Firstlap mail domain. It processes the recipient email address, message content, and delivery information needed for that purpose.
- Apple distributes the App, provides the iOS photo picker and Keychain on your device, and delivers push notifications through APNs when you enable them. Apple processes related information under its own policies.
Providers may use information only to perform services for Firstlap and must protect it consistently with their contractual and legal duties. We may also disclose information when reasonably necessary to comply with a valid legal request, protect someone from serious harm, investigate abuse, enforce our Terms, or protect the rights and security of members, Firstlap, or others. If the service is reorganized or transferred, information may move as part of that transaction subject to continued protection and applicable notice requirements.
7. Retention and account deletion
We keep information only for as long as needed for the purpose for which it was collected:
- account and profile information remains while your account is active;
- posts, comments, reactions, saves, follows, groups, and media remain until you remove them, the service removes them, or you delete your account;
- verification and reset codes expire quickly and are not valid after their expiration or successful use;
- sessions remain until expiration or revocation, generally no longer than 90 days without renewal;
- pending photo uploads and unneeded media are cleaned up after they are abandoned or expire;
- support, security, report, appeal, and moderation records are retained as reasonably needed to resolve the matter, prevent repeat abuse, demonstrate enforcement, comply with law, and protect the community; and
- limited logs and backups may persist for a restricted period until they rotate or are safely overwritten.
You can permanently delete your account in My journey → Settings → Delete account. Deletion requires your current password and an explicit confirmation. It revokes sessions and removes your posts, comments, media, reactions, saves, follows, blocks, group memberships, reports you submitted, and notification device tokens from the active service. A minimal anonymized account tombstone and limited safety or audit records may remain where needed to preserve moderation integrity, prevent abuse, resolve disputes, or meet legal obligations. Those retained records are not used to rebuild your profile or advertise to you.
8. Your choices and rights
- Profile and content: edit supported profile details and delete your own posts or comments from the App.
- Visibility: choose an available audience before publishing and keep personal moments private when offered.
- Notifications: review account activity inside Firstlap and manage remote push permission in iOS Settings.
- Photos: select only the photo you want to share through the system photo picker.
- Safety: report content or members, block and unblock members, and appeal eligible moderation decisions.
- Local export: create the supported on-device export from Settings. Treat the export carefully because it may contain personal content.
- Account deletion: permanently delete your account in the App. If you cannot sign in, contact support from the account email address.
You may also ask to access, correct, delete, or receive information associated with your account by emailing care@firstlapx.com. We may need to verify that you control the account before completing a request. Some requests may be limited where retention is required by law or necessary for security, fraud prevention, legal claims, or the rights of others.
9. Regional privacy information
EEA, United Kingdom, and similar jurisdictions
Where applicable, our legal bases are: performance of the agreement with you to provide your account and requested community features; legitimate interests in securing the service, preventing abuse, supporting members, and improving reliability; consent for optional device permissions and push notifications where consent is required; and compliance with legal obligations or protection of legal claims. You may withdraw consent through the relevant App or iOS setting. Withdrawal does not affect processing already completed lawfully.
Depending on local law, you may have rights to access, correct, erase, restrict or object to processing, receive portable data, and complain to a data protection authority. You may also contact us first so we can review the request.
California and other U.S. states
The categories collected during the preceding 12 months may include identifiers, account credentials, internet or network activity, user-generated content, photos you choose, interactions, approximate location inferred from IP address, and support or moderation information. We collect these categories from the sources and for the purposes described above, and disclose them to service providers and when legally required. Firstlap does not sell personal information or share it for cross-context behavioral advertising. Where state law applies, you may request access, correction, deletion, or a copy of covered information and may appeal a denied privacy request by replying to our decision. We will not discriminate against you for exercising a privacy right.
10. Children
Firstlap is not intended for children under 13. If the law where you live requires a higher minimum age to use an online community without parental authorization, that higher age applies. We do not knowingly collect personal information from a child who cannot lawfully use the service. A parent or guardian who believes a child provided information may contact us so we can investigate and delete it where required.
11. Security and international processing
We use measures designed to protect information, including encrypted HTTPS transport, password hashing, revocable session tokens, iOS Keychain storage, private media storage, access-limited moderation tools, upload and abuse limits, and audit records for administrative actions. No online service can guarantee absolute security. Please use a unique password, keep verification codes private, and contact us if you suspect unauthorized account activity.
Firstlap and its providers may process information in countries other than the one where you live. Those countries may have different data-protection laws. Where required, we use contractual, organizational, or other lawful safeguards for international processing.
12. Changes and contact
We may update this policy when features, providers, laws, or data practices change. The “Last updated” date will show the latest version. If a change materially affects how we use personal information, we will provide an appropriate notice in the App or through another available channel before the change takes effect when required.
For privacy questions or requests, email care@firstlapx.com. Please do not send your password or verification code. You can also use these public pages:
- Privacy Policy: firstlapx.com/pages/privacy
- Terms of Service: firstlapx.com/pages/terms
- Support: firstlapx.com/pages/support