Privacy Policy

1. Who We Are

The App is operated by Runiverse Technologies, based in Gujarat, India. For the purposes of the DPDP Act 2023, Runiverse Technologies is the Data Fiduciary and you are the Data Principal.

2. Data We Collect

We collect only the data necessary to provide and operate the App, authenticate your account, and power our core territory-claiming features.

2.1 Account & Profile Information

Basic details you provide when creating an account, including username, email address, password (securely hashed and never stored in plain text), and any optional details you choose to add to your profile (such as display name, avatar, or basic fitness metrics for calorie calculation). If you sign in via Google, we use your authentication ID and never receive your Google password.

2.2 Activity & Fitness Stats

General metrics recorded during your runs, walks, or jogs, including distance, speed, duration, estimated calorie burn, elevation changes, and activity type.

2.3 Location Data (Sensitive Personal Information)

Precise geographical coordinates (GPS) collected only while you are recording an activity to map your routes, determine claimed zones (hexes), and support core features. Under laws like the CPRA, this is classified as Sensitive Personal Information (SPI). You have the right to Limit the Use and Disclosure of this data by disabling location access at any time through your device settings, though this will prevent core app functionality.

2.4 Activity Progression & Session Data

Basic progress metrics (points, rankings, and streaks) and necessary session token indicators to keep your device securely logged in.

2.5 Pseudonymous Territory Processing

Our map-conquest engine is decoupled to process claimed geographical grids pseudonymously, using randomized system identifiers rather than your personal details (like names or emails) to represent map ownership.

3. How We Use Your Data

We use your data to:

• Create and manage your account and authenticate you
• Record activities and calculate your stats
• Run the core territory, leaderboard, ranking, and seasonal features
• Generate shareable activity-summary images at your request
• Verify your email and help you recover your account (via OTPs)
• Maintain security, prevent fraud, and detect cheating (for example, GPS spoofing / teleport detection)
• Improve the App, fix bugs, and understand aggregate usage
• Communicate with you about your account, security, and important updates

We do not sell your personal data.

4. Legal Basis for Processing

We process data on these strict bases:

• Contractual Necessity : processing required to provide the core App functionality, telemetry, maintaining server stability, and executing the terms of service.
• Legitimate Interests : security monitoring, robust anti-cheat enforcement, infrastructure scaling, and essential product analytics.
• Consent : for optional features (e.g., promotional communications, social/friends features).
• Legal obligation : where we must retain or disclose data by law.

At the consent gate we collect your consent separately for each purpose. Some consents are a condition of providing the service (precise location, social/friends features, and community data), alongside a neutral date-of-birth age check. Others are fully optional and never required to use the App (push notifications and marketing). You can withdraw any consent at any time — withdrawal is as easy as granting — and each consent event is logged with a timestamp for our records.

For users in India, we process personal data in line with the Digital Personal Data Protection Act, 2023, primarily on the basis of your consent and to provide the service you requested.

5. How We Share Data

We share data only with:

• Service providers acting on our instructions, including:
  • Authentication providers (e.g., Google Sign-In)
  • Map and routing providers (e.g., Mapbox) for displaying and rendering routes
  • Cloud hosting and database infrastructure providers
  • Email / OTP delivery providers
• Other users, where you choose to make data public
• Authorities, where required by law, court order, or to protect rights, safety, or the integrity of the service

We require service providers to protect your data and use it only for the purposes we specify.

6. Data Retention & Anonymization Rights

We keep your personal data for as long as your account is active. Upon account deletion, we process the removal of personally identifiable information. However, Runiverse Technologies reserves the right to anonymize and indefinitely retain location, activity, and demographic data. This anonymized data (which cannot reasonably identify you) falls outside the scope of privacy laws and is used for our machine learning, mapping improvements, and business analytics.

7. Data Security

We implement reasonable and appropriate administrative, technical, and physical safeguards designed to protect your personal data against unauthorized access, loss, or alteration. However, no internet-based service or electronic storage system is completely secure, and we cannot guarantee the absolute security of your information. By using the App, you acknowledge and accept these inherent risks. Furthermore, because the App is undergoing infrastructure scaling during this Free Trial phase, you should not rely on it as a secure storage system for any data you cannot afford to lose.

8. Your Rights

Subject to applicable law, you may:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and associated personal data
• Withdraw consent (e.g., location, weight, marketing)
• Object to or restrict certain processing
• Request a portable copy of your data
• Lodge a complaint with a data protection authority

India (DPDP Act, 2023): you have the right to access, correction, erasure, grievance redressal, and the Right to Nominate another person to exercise your rights in the event of death or incapacity. You can raise a grievance with our Grievance Officer at runiverse.fit@gmail.com. If unresolved, you have the right to escalate your complaint directly to the Data Protection Board of India.

EU/EEA/UK (GDPR): you may also complain to your local supervisory authority.

California (CPRA/CCPA): you have rights to know, delete, correct, opt out of "sale"/"sharing" (we do not sell your data), and the right to Limit the Use and Disclosure of Sensitive Personal Information (such as precise location).

9. Children's Privacy

The App is intended for users aged 18 and above. At signup we collect a neutral date of birth, and our server computes your age and rejects registration if you are under 18. Under India's DPDP Act, 2023, processing a child's (under-18) data requires verifiable parental/guardian consent, so we do not knowingly collect or process data from anyone under 18. Your date of birth is treated as personal data — it is included in your data export and is erased when your account is anonymized. If you believe someone under 18 has provided us data, contact us and we will delete it.

10. International Data Transfers

We operate from India and may use service providers located in other countries. Where data is transferred across borders, we take steps to ensure it remains protected under applicable law and through appropriate safeguards.

11. Production & Free Trial Notice

12. Changes to This Policy

We may update this Privacy Policy. The "Last updated" date reflects the latest version. Continued use of the App after changes means you accept the updated policy. Material changes will be notified in-app or by email, and we may ask you to re-confirm your consent.

13. Cookies, Analytics & Tracking

On our website we use only essential cookies and privacy-friendly, aggregate analytics to understand page views and general usage. These signals do not include your name, email, or other directly identifying information, and we do not use them for cross-site advertising. In the App, we use standard, secure authentication mechanisms to keep your session active. We honour applicable "Do Not Track" / Global Privacy Control preferences where required by law. We do not sell or share personal data for behavioural advertising.

14. Automated Processing & Anti-Cheat

To protect fair play, platform integrity, and overall security, we run automated checks and heuristic analysis on activity data to detect anomalous patterns and validate data integrity. These automated systems may void an activity, revoke points/territory, or flag/suspend an account. If an automated decision significantly affects you, you may contact us to request human review through the grievance/contact channels below.

15. Data Breach Notification

If a personal-data breach occurs that is likely to affect you, we will notify the relevant supervisory authorities and, where required, affected users within the timelines mandated by applicable law (for example, within 72 hours to the supervisory authority under GDPR, and within the timeframe required by India's DPDP Act, 2023 and CERT-In). We maintain internal procedures to detect, respond to, and record such incidents.

16. Contact & Grievance Redressal

The App is operated by Runiverse Technologies, based in Gujarat, India. For any privacy question, request, or complaint, you can reach the following contacts:

• Grievance Officer (India — DPDP Act, 2023, §13): runiverse.fit@gmail.com — we acknowledge grievances within 48 hours and aim to resolve them within 30 days.
• Data Protection Officer / Privacy Contact (GDPR, LGPD, PIPEDA): runiverse.fit@gmail.com — for access, correction, deletion, portability, or consent-withdrawal requests.

If you are unsatisfied with our response, you may escalate to your applicable data-protection authority — for example, the Data Protection Board of India, your EU/EEA/UK supervisory authority, Brazil's ANPD, or Canada's OPC.