Privacy Policy

1. Who we are

Athlorun ("Athlorun", "we", "us" or "our") provides the Athlorun mobile application and related services (together, the "Services"). We are the data controller responsible for your personal information processed through the Services.

If you have any questions about this policy, contact us at support@athlorun.com.

2. Information we collect

2.1 Information you provide

• Account information: your name, email address and password when you sign up with email, or your name, email address and profile photo from your Google account if you choose "Sign in with Google". Passwords are handled by Firebase Authentication and are never visible to us.
• Profile information: display name, profile photo, country, and any other details you add to your profile.
• Health assessment: answers you give during onboarding, which may include your fitness goal, gender, age, weight, blood type, fitness level, sleep quality, mood and eating habits. Every question is optional.
• Goals, schedules and gear: daily step/activity goals, workout schedules, and sports gear (for example, running shoes) you add.
• Content and communications: photos you choose to upload, messages you send to support, and feedback you provide.

2.2 Information collected automatically

• Fitness and activity data: step counts, distance, calories, active minutes, activity type (e.g. walking, running, cycling), workout duration, pace, perceived exertion and activity history.
• Precise location: GPS coordinates while you are recording a workout, used to draw your route and calculate distance and pace (see Section 3).
• Physical activity recognition and motion sensor data: data from your phone's step counter, accelerometer and activity recognition APIs to count steps and detect activity.
• In-app activity: challenges joined, missions completed, coins earned and redeemed, badges, leaderboard positions and notification preferences.
• Device and technical information: device model, operating system version, app version, language, and diagnostic information such as crash logs, which help us keep the app reliable.

2.3 Information from third parties

• Google Sign-In: your name, email address and profile photo, if you choose to sign in with Google.
• Android Health Connect: steps and distance data, only if you grant permission (see Section 4).

3. Device permissions

Athlorun asks for the following Android permissions. You can grant or revoke them at any time in your device settings; some features may not work without them.

4. Health Connect & health data

Athlorun integrates with Android Health Connect. If you grant permission, the app may:

• Read steps and distance, to display your daily activity, calculate progress toward your goals, and power missions, challenges, rewards and statistics.
• Write steps and distance from workouts you record in Athlorun, so other apps you have authorised can use them.

We treat Health Connect data and the health information in your assessment ("health data") with extra care:

• Health data is used only to provide and improve the user-facing fitness features of Athlorun.
• We do not sell health data, use it for advertising or marketing, or share it with data brokers or information resellers.
• We do not use health data to determine credit-worthiness, insurance eligibility or for any lending purpose.
• We do not transfer health data to third parties except service providers that help us run the app under confidentiality obligations, when required by law, or as part of a merger or acquisition with equivalent protections.
• Humans do not read your health data unless you give explicit consent (for example, when you ask support to look into a problem), it is needed for security purposes, or required by law.

You can revoke Health Connect access at any time from Android Settings → Health Connect → App permissions → Athlorun. Revoking access stops future reads and writes; data already synced to your Athlorun account can be deleted as described in Section 9.

5. How we use information

• Provide the Services — create and secure your account, count steps, record workouts, show statistics and history, and sync data across devices.
• Personalise your experience — set goals and recommendations based on your assessment and activity.
• Run engagement features — missions, challenges, coins, rewards, badges, friends and leaderboards.
• Communicate with you — send service notifications, reminders you've enabled, and replies to your support requests.
• Keep the app safe and reliable — detect and prevent fraud, abuse and cheating (for example, on leaderboards), troubleshoot issues and fix bugs.
• Comply with law — meet legal obligations and enforce our Terms & Conditions.

Where laws such as the GDPR apply, our legal bases are: performance of our contract with you; your consent (for example, for health data, location and Health Connect access, which you can withdraw any time); our legitimate interests in securing and improving the Services; and compliance with legal obligations.

6. Sharing & disclosure

We do not sell or rent your personal information. We only share it in these limited cases:

• Service providers who host data or provide infrastructure on our behalf (see Section 7), bound by contract to protect it.
• Other Athlorun users — your display name, profile photo, badges and leaderboard stats may be visible to other users in social features such as leaderboards and friends lists. Your health assessment, precise routes and contact details are not shown publicly.
• Legal reasons — when required by law, court order or government request, or to protect the rights, property or safety of Athlorun, our users or others.
• Business transfers — in connection with a merger, acquisition or sale of assets, subject to this policy.
• With your consent — for example, when you share an achievement to another app using Android's share sheet.

7. Third-party services

Athlorun relies on the following services, each with its own privacy policy:

We do not use third-party advertising SDKs.

8. Data retention

• We keep your account and activity data for as long as your account is active.
• When you delete your account, we delete or irreversibly anonymise your personal data within 30 days. Residual copies in encrypted backups are overwritten within 90 days.
• We may keep limited information for longer when legally required (for example, records of reward redemptions for tax or accounting purposes) or to resolve disputes and prevent fraud. This information is kept securely and only for as long as necessary.
• Accounts inactive for more than 24 months may be deleted after we notify you by email.

9. Account & data deletion

You can delete your account and associated data at any time:

• In the app: Profile → Settings → Delete Your Account → confirm.
• On the web: visit https://iayr1.github.io/athlorun-web/delete-account.html and submit a request — no need to reinstall the app.
• By email: write to support@athlorun.com from the email address linked to your account.

You can also ask us to delete specific data (such as your health assessment or activity history) without deleting your account. Full details of what is deleted and what is retained are on the Account & Data Deletion page.

10. Security

We use industry-standard safeguards to protect your information, including encryption in transit (HTTPS/TLS), encryption at rest provided by our cloud infrastructure, secure on-device storage for credentials, and access rules that ensure each signed-in user can only read and write their own records. No method of transmission or storage is 100% secure, but we work hard to protect your data and will notify you and relevant authorities of any breach as required by law.

11. Your rights & choices

Depending on where you live (including under the GDPR, UK GDPR, India's Digital Personal Data Protection Act 2023, and US state laws such as the CCPA/CPRA), you may have the right to:

• access and receive a copy of your personal data;
• correct inaccurate or incomplete data;
• delete your data;
• restrict or object to certain processing;
• data portability;
• withdraw consent at any time (without affecting prior lawful processing);
• nominate another person to exercise your rights in the event of death or incapacity (where applicable); and
• lodge a complaint with your local data protection authority.

You can also manage permissions in Android settings, turn notifications on or off in the app, and edit or remove profile information at any time. To exercise any right, email support@athlorun.com. We will respond within 30 days and may need to verify your identity first. We will not discriminate against you for exercising your rights.

12. Children's privacy

Athlorun is not directed to children under 13 (or the minimum age required in your country, such as 16 in parts of the EU or 18 in India without verifiable parental consent). We do not knowingly collect personal information from children below that age. If you believe a child has provided us with personal information, contact us and we will delete it.

13. International transfers

Our service providers may process your information in countries other than your own, including India, the United States and the European Union. When we transfer data internationally, we rely on appropriate safeguards such as standard contractual clauses and our providers' certifications.

14. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you in the app or by email before they take effect. The "Last updated" date at the top shows when this policy was last revised.

15. Contact us

For privacy questions, requests or complaints, contact our privacy team:

• Email: support@athlorun.com
• Web: Contact form