Privacy Policy

Effective date: 6 October 2026 · Last updated: 14 October 2026

If you already had a TodayHurts, PigeonTicket, CookedHere or SockLedger account on 6 October 2026, the previous version of this policy applies to what you do with that account until 6 November 2026, together with the Resend entries in section 4, which apply to everyone from 6 October 2026. Everything else this policy covers follows this version from 6 October 2026, including any Service you use without an account.

This Privacy Policy explains how Metric Ton LLC ("Metric Ton," "we," "us") collects, uses, and shares information when you use TodayHurts, PigeonTicket, CookedHere, SockLedger and Off the Peel (each, a "Service"), and this website, ametricton.com. Where a practice applies to only one app, we say so.

Holakare, OpenTill and Tip Night have their own privacy policies, at holakare.com/privacy, opentilldawn.com/privacy and tipnight.com/privacy. For those products, their own policy applies instead of this one.

1. Who we are

Metric Ton LLC, 5900 Balcones Drive #20977, Austin, TX 78731, United States. Questions: [email protected].

2. Information we collect

We collect only what a Service needs to work. Depending on the app, that includes:

• Account & contact: name/handle, email, and authentication identifiers.
• Content you create: e.g. PigeonTicket trip ideas, itineraries, journals, uploaded photos and any template you publish; TodayHurts workouts, notes, goals, event plans, benchmarks, blocked exercises, reminder settings, and training plans you import or set day by day, with their weekly check-ins; CookedHere meal photos, captions and cook notes.
• Health & fitness data: in TodayHurts, the heart rate captured during a workout (average and maximum, time in each zone, the sensor it came from, and a bounded, down-sampled heart-rate timeline rather than the raw sensor stream), readiness, and the soreness and pain you report in a training plan's weekly check-in. If you allow it, TodayHurts imports the workouts you choose from Apple Health or Health Connect, with their heart rate. To find them, it reads every workout recorded in the import window (its type, times, source app and heart-rate samples, plus calories on iPhone), including workouts it then skips, such as ones TodayHurts wrote there itself or duplicates. It keeps only the workouts it imports and the calories of any workout it matches to one you recorded in TodayHurts. On iPhone it also reads your resting heart rate, overnight HRV and sleep from Apple Health for readiness, and keeps up to the last month of them with your account, so readiness and the Morning Brief work on every device. It reads your body weight to estimate calories until you log a weight in the app. With Health Connect it only reads, and only exercise, heart rate and the earlier history an import needs to find workouts recorded before you gave permission. TodayHurts reads only these types and does not copy your whole Health database.
• Body measurements: in TodayHurts, the body weight, body fat and waist measurements you choose to log, and the body-composition readings you import from a smart-scale report: muscle, lean and skeletal muscle mass, body water, protein, bone mass, visceral and subcutaneous fat, BMR, metabolic age, and a per-limb breakdown.
• Location: in TodayHurts, only if you allow it. During an outdoor workout it records your GPS route, distance and pace, and keeps the route with that workout. If you set up weather reminders and choose to use your current location, it reads your location once and saves it, to about 11 meters, until you clear it; our reminder service uses it to fetch your forecast. TodayHurts does not read your location at any other time.
• Operational & financial records: in SockLedger, the projects, expenses, allocations, reimbursements, renewals, providers, domains and uploaded receipts you enter or import to track what your own products cost, the App Store, Railway and GoodDay figures you choose to sync, and the encrypted keys that sync them. This is your business and operational data. For a payment card it keeps only a name and the last four digits, never the full number.
• Purchase data: subscription status and the payment records Stripe gives us. PigeonTicket is free to use in the browser; optional tips, and any PigeonTicket subscription, are paid on the web through Stripe. Off the Peel is free, and an optional tip is paid through a Stripe page. We never see or store card numbers.
• Device & usage: app version, device type, diagnostics/crash data, and usage events. Where our apps and websites use analytics, they run on GoodDay, our own self-hosted, cookieless analytics: it stores no cookies and no device identifiers, counts a visitor with a hash whose key is deleted every 24 hours (a copy can stay in our server's disk backups for a few days until they rotate), and never leaves our servers, which are in Germany. On this website, GoodDay also counts clicks on the buttons and links we have tagged (the product tiles and the "tell me when it opens" links on our home page, each recorded with the name of the product you picked and nothing else) and on any link that leaves ametricton.com (recording only the other site's address and the page path, never a query string). Like any other visit, these are counted by the same-day hash described above and nothing more. On our websites and web apps where we have switched them on (this website and the PigeonTicket, CookedHere, SockLedger, TodayHurts, Sleevefolk and Off the Peel websites), optional measurement scripts also report how far down the page was scrolled, which sections of it came into view (only on pages whose sections we have marked, such as this website's home and press pages), and how quickly it loaded and responded. They read only the page you are looking at (its visibility, scroll position and performance timings) and nothing stored on your device. What they send is a few counts and timings per page view, such as one per section seen, the deepest scroll band and one set of load timings. Each is stored like a page view (the page, the time, and the same coarse browser and device details), but with no identifier and without the same-day counting hash, so we do not use it to identify you or to link your visits together. When you click a link to a file to download (a PDF, say), the script also records that you did, with the link's address (without any query string). That is counted like any other click we record, by the same-day hash described above and nothing more. In the TodayHurts app, on the web and on mobile, GoodDay also receives three generic events (a workout generated, started or completed) and which screens you open. A screen is recorded by its shape only, such as "a workout's detail screen", never by which workout or other record it showed, and none of these events carries workout content, profile data, notes or location. GoodDay honors Do Not Track and Global Privacy Control signals: when your browser sends either one, our analytics server discards what the page reports instead of storing it. We use no third-party analytics.

TodayHurts does not collect your contacts, microphone or camera recordings, payment-card details or advertising identifiers, and nothing it collects is used to track you across other companies' apps or websites.

3. How we use information

• To provide and operate the Service and your account.
• To sync your data across your devices and, where you choose, share it with people you invite (trip members, household members, workout groups and trainers, workspace members).
• To turn what you capture into a structured record: CookedHere sends your caption, the meal photo if you add one, today's date, and the names and nicknames of the people in your household to Anthropic's Claude, to fill in fields you can edit or ignore. This runs on an Anthropic API key that you or your household supply and control, which we store encrypted, so the request is made under that key holder's account with Anthropic and is governed by their agreement with Anthropic, not ours. Anthropic's commercial terms say it does not train models on API inputs by default.
• To run optional AI features you ask for: TodayHurts can, for example, explain a workout, review a session, a week, a goal or a benchmark result, suggest changes to today's workout or new exercises for your equipment, summarize your session notes, read the numbers off a photo of a smart-scale report you choose, and draft a training plan from text you paste or type. Each runs only when you request it, and only on an Anthropic API key you supply: the request goes from your device straight to Anthropic under that key. Depending on the feature, it can include a summary of your training, heart rate and readiness figures, your equipment types, notes you wrote (for the journal and adjustment features) and the text you give the plan drafter. Only the feature that suggests changes to today's workout says whether the athlete is under 18, and never the age itself; plan drafting is not offered for an athlete under 18. A request does not include your name, email or account ID, with one exception: a scale-report photo is sent as you chose it, so it carries whatever the scale app printed on it, which can be your email address (Wyze reports print it at the top). The answer itself is shown to you and not stored. You check the numbers read from a scale report before anything is saved, and only the values you save are stored. What it changes is saved like the rest of your data: a workout rebuilt by an adjustment, exercises you approve for your library (including the text the AI wrote for them), or a drafted plan, which is saved only if you apply it.
• We do not use your content to train any model.
• To keep the Service secure, debug problems, and improve it.
• To communicate with you about the Service: account, security and transactional messages, including reminders you set up. We do not send unsolicited marketing. There is one exception, which is opt-in and started by you: from ametricton.com you can ask to be told if GoodDay, SockLedger, Sleevefolk or TodayHurts ever open to new accounts. These are personal projects and may never open; the list exists so we can gauge interest and tell you if that changes. It is not a newsletter, we do not use it to advertise anything else, and every message carries an unsubscribe link.

4. When we share information

We share information only as described here:

• People you choose: e.g. trip members, read-only link recipients and, if you publish a template to the community library, every signed-in PigeonTicket user (PigeonTicket); group members and a trainer you invite (TodayHurts); the members of your household (CookedHere); or workspace members you add (SockLedger). In TodayHurts, a group session you join shares the group's name and join code, each member's display name, and the live state of each member's workout tile (such as the current exercise, the time and, when present, heart rate) with the group. A private trainer link you create shows the trainer only limited planning context (your gym's name, its equipment names and types when the link allows it, and your current week), and lets them propose a week and a note for you to review.
• Wherever you share a workout image: in TodayHurts, the share image is made on your device and goes only where you send it from your device's share sheet. It can show the date, the workout's name and numbers, personal records and, when there is room, your heart-rate-zone split and the muscles worked, but never a route or location. We do not receive or keep a copy.
• Service providers that run the Service on our behalf, under contract. Which ones apply depends on the app:

  Service	Providers
  TodayHurts	Supabase (sign-in, database, storage and server functions), Netlify (web app hosting), Sentry (crash diagnostics; the web app can also send masked session replays and performance data, while the mobile apps send errors only, with no replay),Expo, Apple and Google (push notifications you turn on, and app updates through Expo), GitHub and Cloudflare R2 (nightly database backups), Open-Meteo (the forecast for a weather reminder you set up, requested with your saved location rounded to about a kilometer and without your identity)
  PigeonTicket	Supabase (sign-in, database and photo storage), Netlify (hosting), Sentry (crash diagnostics), Resend (booking reminder email), Geoapify (place search), Stripe (payment processing for tips and any subscription; Metric Ton is the seller of record, so Stripe acts as a processor)
  SockLedger	Neon (database, including uploaded receipts), Netlify (hosting), Resend (alert email to the workspace owner, when turned on)
  CookedHere	Clerk (sign-in, account and invitation email), Netlify (hosting, and the server functions that handle your requests), Neon (database), Cloudflare R2 (photo storage)
  Off the Peel	Netlify (hosting), Stripe (optional tips only). Bake notes and photos stay in your browser and are not sent to us.
  ametricton.com (this site)	Netlify (hosting), Mailchimp / Intuit (launch-notification list for GoodDay, SockLedger, Sleevefolk and TodayHurts only, sent from its us2 region; the link takes you to a form hosted by Mailchimp, so it receives the name, email address and free-text comment you choose to type there, plus the technical request data any web request carries. We never attach anything from the apps to it, including health, household or usage data, and we do not ask for any; but the comment box is free text, so please do not type anything there you would not want Mailchimp to hold)
  All of the above	Resend (service email to account holders, such as notice of a change to this policy)

  Push notifications are delivered by your browser or operating system vendor, and the TodayHurts mobile app sends them through Expo's push service. We hold the device token or subscription endpoint, your time zone, the browser or device model it came from, and the reminder times you choose. A notification's text passes through these push services (Expo, Apple Push Notification service, Firebase Cloud Messaging or your browser's push service) and can show on your lock screen. In TodayHurts, a workout reminder can name your planned workout and count down to your next race or goal, by name. If you turn on detailed previews for the Morning Brief (they are off by default), the brief also adds a recovery score that our servers compute from your resting heart rate, HRV and sleep summaries.
• Files loaded straight from other servers: some pages and apps load files directly from OpenStreetMap (map tiles for a saved route in TodayHurts and for maps in PigeonTicket), unpkg (the map code in the TodayHurts mobile app) and Google Fonts (fonts on the cookedhere.com home page). These providers don't act on our behalf, as the service providers above do; they handle the requests under their own terms. Each receives your IP address and the technical data any web request carries, including which file was requested, but not your name, email address or other account details. For OpenStreetMap, the tiles requested also show the area on the map, such as where a saved route ran.
• Connected services you enable: in TodayHurts, Apple Health and Google Health Connect, through the permissions you grant on your device, and Strava, through the access you grant when you connect your Strava account. TodayHurts reads from Apple Health and Health Connect only what section 2 describes, and on iPhone, if you allow it, saves the workouts it records to Apple Health with their heart rate, calories, distance and a list of the exercises done (names, sets, reps and loads); it never writes to Health Connect. For Strava, we store the access tokens Strava issues and post your completed-workout summaries, the heart-rate readings captured during them and the active calories we stored for them, but never GPS coordinates. In SockLedger, App Store Connect, Railway and GoodDay read your own account data with keys you supply. Each of these services is subject to its own terms. They are off by default and you can disconnect them at any time.
• Anthropic, on a key you supply: the optional AI features in TodayHurts and the caption parser in CookedHere (see section 3) send data to Anthropic on an Anthropic API key that you or your household supply, under that key holder's own agreement with Anthropic, not ours. Neither runs until a key is saved. The two keep the key differently. In TodayHurts, the key stays only in your device's secure storage and is never saved in our database, and you can clear it in Settings. In CookedHere, we store the key, encrypted, so your household can use it, and you can replace it in Settings. The key holder can revoke either one in their Anthropic account at any time.
• Legal & safety: when required by law or to protect rights and safety.
• Business transfers: in a merger or acquisition, subject to this policy.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising (as those terms are defined under California and other state laws).

Health data: special handling (TodayHurts)

We treat health and fitness data as sensitive. We do not use it for advertising or marketing, do not sell it, and do not disclose it to third parties except to provide the Service or with your permission. Data obtained through Apple HealthKit or Google Health Connect is used only to provide health/fitness features, consistent with those platforms' requirements.

5. Data retention

We keep information for as long as your account is active or as needed to provide the Service, then delete or de-identify it within 30 days, except where longer retention is required by law. Deleted data may persist in our backups for up to a further 90 days before those backups age out.

In TodayHurts, deleting a workout leaves a small record of it in your account, so that a delayed sync or a re-import cannot bring the workout back: its identifier, when it ran, its activity type, when you deleted it and, for a workout imported from Apple Health or Health Connect, that app's reference to it. The record holds none of the workout's content and is deleted with your account. Deleting your TodayHurts account also revokes its access to your Strava account. Copies already in Apple Health, Health Connect or Strava, including anything already posted to Strava, stay there until you remove them in that service.

6. Security

We use reasonable technical and organizational measures to protect your information. Traffic between your device and our services is encrypted in transit over TLS. Passwords are stored only as salted one-way hashes, never in a readable form. In TodayHurts, PigeonTicket and CookedHere, the database enforces access rules at the row level, so one account, trip or household cannot read another's records even if application code is at fault. In SockLedger, the application checks every request against your workspace. No system is perfectly secure, and we do not claim otherwise.

TodayHurts also keeps an offline copy of your data on your device, so workouts keep working on a poor connection. On iPhone and Apple Watch, the widgets, Live Activities and watch complications you add show the next session, a countdown to your next race or goal, your training load and your readiness from a copy the app keeps on your iPhone and sends only to your paired Apple Watch, never to our servers. They can be seen without unlocking the device. If you turn on health details for widgets (off by default), the iPhone Training Status widget also shows last night's sleep, resting heart rate and HRV; watch complications, Live Activities and the Today widgets do not.

7. Your choices & rights

• Access & deletion: you can request a copy of your data or its deletion at any time, and we will act on it. In TodayHurts you can delete your account yourself in the app, under Profile → Danger zone → Delete account. In PigeonTicket, SockLedger and CookedHere there is no self-service deletion yet, so email [email protected] and we will delete the account for you.
• Permissions: you control device permissions in your OS settings and can revoke them at any time. In TodayHurts these are Health, location, Bluetooth, photo library and notifications.
• In-app controls (TodayHurts): you can disconnect Strava, clear your saved garage location, turn off reminders, leave a group, revoke a trainer link or remove your Anthropic key.
• Marketing: the GoodDay / SockLedger / Sleevefolk / TodayHurts launch-notification list is the only marketing email we send. It is opt-in, and you can unsubscribe from any message it sends. Transactional messages, such as a trip invite you sent or a security alert, are not marketing and cannot be opted out of while you hold an account.
• State privacy rights: depending on where you live, you may have rights to access, delete, correct, or limit use of your data. To exercise them, contact [email protected].

8. Children's privacy

You must be 18 or older to hold an account, as our Terms of Service require. Our Services are not directed to children, and we do not knowingly let anyone under 18 create an account or knowingly collect personal information from them directly.

Adults do enter information about other people, including children, and we handle that as the account holder's content rather than as the child's own account. In TodayHurts, an adult can set an athlete age between 6 and 17 so generated workouts are scaled for a young athlete. The age is saved with the account's training preferences and with each workout it shapes, so it is stored in the adult's account. Drafting a plan with AI is not offered for an athlete under 18, and the AI feature that adjusts today's workout tells Anthropic only that the athlete is under 18, never the age. In CookedHere, a household record may describe meals for a family. In PigeonTicket, an account holder may name other trip participants, who take part as non-paying participants whose age and relationship we do not ask for or store. In every case the adult account holder controls that information and can delete it.

If you believe someone under 18 has created an account, or that a child has given us personal information directly, contact [email protected] and we will remove it.

9. International users

We are based in the United States, and your information is processed there, except our GoodDay analytics, which run on our own server in Germany, rented from Hetzner. Where you use a Service from outside the United States, you are sending your information to the U.S.

Availability differs by app and by territory, and can change; a Service is not offered everywhere. Where the GDPR or UK GDPR applies to you, the terms below apply.

Metric Ton LLC is the controller of your information, and we rely on these lawful bases:

You have the right to access, correct, delete, restrict, or object to our use of your information, and to receive it in a portable form. Withdrawing consent does not affect processing already carried out. To exercise any of these, contact [email protected]. You also have the right to complain to your local supervisory authority (in the UK, the Information Commissioner's Office).

Because we have no establishment in the EU, transfers of your information to the United States rely on the European Commission's Standard Contractual Clauses, and on the UK Addendum for UK transfers.

10. Changes

We may update this policy; we'll post the new date above and, for material changes, we will notify you in the app or by email before they take effect.

11. Contact

Metric Ton LLC · 5900 Balcones Drive #20977, Austin, TX 78731, United States · [email protected]