What we collect, where it goes, how to take it back.

Last updated: 2026-05-26

1. What this site does

GleamingGymnast is a gymnastics archive — athlete pages, competition results, an On This Day feed, and an Ask feature that answers questions about the data. Most of the site is static HTML on Cloudflare. Sign-in is optional and exists so future features (quiz progress, saved athlete pins) can follow you across devices.

2. What we collect from you, and when

When you sign in with Google or Apple. We receive from the provider your account identifier (sub), verified email, display name, and avatar URL. These land in our GG_USERS Cloudflare KV namespace, keyed by the provider account id. We do not receive your password — OAuth returns an identity token, not a credential.

When you submit an Ask query. The query text is sent server-side to the Anthropic API, the large-language-model provider that powers Ask. Anthropic's API terms govern that handoff. We do not attach your user id to the outbound request, and we do not cache the response — Ask replies with Cache-Control: no-store.

When you hit a rate-limited endpoint. We keep a short-lived in-memory record of request timestamps from your client IP (the CF-Connecting-IP header). The limit is 30 requests per 10 minutes on Ask. This record lives in Worker process memory — not in KV, not joined to your user record — and evicts when the 10-minute window closes.

When you're signed in. Two cookies (see § 6) resolve to a session record in GG_SESSIONS. That record carries your user id, a CSRF token, and a last-seen timestamp used for rolling-refresh.

What we do NOT collect. No analytics SaaS (Google Analytics, Plausible, Fathom, Mixpanel, Hotjar, Amplitude, Segment, PostHog, or equivalent). No advertising SDK. No third-party pixel. No cross-site tracking. Re-checked against the live Worker source before every publish of this page.

3. Where your data goes

Three parties, and only three:

• Cloudflare — hosts the Worker (gleaminggymnast.com) and the KV namespaces (GG_SESSIONS, GG_USERS). Cloudflare's data-processing addendum applies.
• Your identity provider — Google (OAuth 2.0 + PKCE + OpenID Connect) or Apple (Sign in with Apple). You exchange credentials with them, not with us; they return your verified identity.
• Anthropic — for Ask queries only, via api.anthropic.com/v1/messages.

No analytics, no ad network, no ML-training pipeline outside Anthropic's Ask terms.

4. Retention windows

• Sessions. 30-day absolute maximum via the cookie Max-Age; rolling server-side refresh bumps the TTL on requests more than 24 hours after last activity.
• User records. Stored in GG_USERS until you delete your account (see § 5).
• Ask queries + responses. Not cached server-side; discarded after the response returns.
• Rate-limit entries. 10-minute rolling window, in-memory only.
• OAuth pending state. 10 minutes, single-use, under pending:<state> in GG_SESSIONS.
• JWKS provider-key cache. 1 hour, under jwks:<issuer>.

5. Account deletion

Email hello@gleaminggymnast.com from the address on your account with "Delete my account" in the subject. We will delete your GG_USERS record and revoke every live GG_SESSIONS row keyed to your provider account id. We aim to do this within seven days of request. A self-serve delete UI is not yet shipped — the email route is the current deletion path, and it works.

6. Cookies, in plain language

• __gg_session — opaque session id. Domain=gleaminggymnast.com; Path=/; Max-Age=30 days; SameSite=Lax; Secure; HttpOnly. Set when you sign in; cleared on sign out. Required for the site to remember that you're signed in.
• __gg_csrf — CSRF double-submit token. Same attributes as __gg_session minus HttpOnly (client JavaScript reads it and echoes it as the X-CSRF-Token request header on mutating requests). Pairs with __gg_session.
• gg_auth — shared password cookie for the dev preview gate (7-day Max-Age). This cookie disappears when the site moves out of preview; it does not identify you individually.

No third-party cookies. No ad cookies. No tracking pixels.

7. GDPR & CCPA applicability

If you're an EU, UK, or EEA resident, you have data-subject rights under GDPR including access, rectification, erasure, restriction, portability, and objection. If you're a California resident, you have equivalent rights under the CCPA/CPRA including the right to know, delete, and opt out of sale — we do not sell your information. Email hello@gleaminggymnast.com to exercise any of these rights. This section is applicability-only; a full data-processing addendum is not yet drafted.

8. Children

This site is not directed at children under 13 (or 16 where that's the threshold). We do not knowingly collect personal information from children. If you believe a minor has signed in, email us and we'll delete the account. Athletes featured on archive pages are often themselves minors — that data is public competition-results data, not user data, and is handled under the Sources section of the About page.

9. Changes to this policy

When this policy changes we update the Last-updated stamp at the top. For material changes — a new data recipient, a change in what we collect, a new retention window — we'll surface a banner on your next sign-in. We do not currently have an email-dispatch vendor wired, so we do not email signed-in users about policy changes.

10. Contact

Email hello@gleaminggymnast.com with "Privacy" in the subject.

Back to the archive Terms of Service →