dot run club Privacy Policy

dot run club (the “app”) takes your privacy seriously. This policy explains what we collect, how we use and keep it, and what rights you have. Where the UK/EU General Data Protection Regulation applies, section 10 sets out the legal bases and your rights under it.

1. What we collect, and why

Data	When	Purpose
Account details (name, email, profile picture)	When you sign in with Google or Apple	Identifying and authenticating you; account management
Nickname	You set it yourself	The name shown in rankings, friend lists and to your 1:1 duel opponents
Location (GPS)	While recording a workout — including while you are not using the app (in the background)	Working out your route, distance and pace
Approximate location (coordinates rounded to three decimal places, about 100 m)	When the home screen shows the weather (if location permission is granted)	Looking up current weather and air quality with Open-Meteo. Not stored on our servers
Workout records (distance, time, pace, date, cumulative stats)	When a workout finishes	Saving and backing up your records (including the stops and arrival dates of your journey photo cards — the card photos stay on your device), growing your character, the journey across the Earth, rankings and 1:1 duels
Step count (the daily number only)	Only if you turn step sync on — read from the device motion sensor (CoreMotion) on iPhone, or from Health Connect on Android	Step coins, journey distance and 1:1 duel distance (0.72 m per step). The daily step numbers are also kept in your account backup (readable only by you). Shown to your duel opponent as the distance you walked on each day of that duel. No location or time-of-day detail is sent
1:1 duel information (nickname, character look, this week’s distance, a summary of the last 4 weeks — recorded distance, step distance and total)	When you use 1:1 duels	Finding and offering opponents, deciding the result. Visible to your duel opponents, including people you receive an offer from
GPS problem report (the raw GPS points, accuracy, speed and route of that workout, your account identifier, start time, problem type and description)	Only when you pick a workout and tap “Send GPS problem” yourself	Improving GPS correction. Readable only by you and the operator
Support inquiries (your message, nickname, account identifier)	When you send an inquiry from the app	Answering you (customer support). Readable only by you and the operator
Push notification token (device token, platform, app language)	If you allow notifications and are signed in	Sending duel offer, progress and result notifications. Stored in an area only you can read
Chat messages	When you wrote in open or crew chat — chat is currently closed; only messages written earlier are kept	Letting people talk to each other
Friend 1:1 messages (message text, nickname and level, time sent, last-message preview and unread count)	When you write to someone who is your friend and who has you as a friend	Letting friends talk to each other. Readable only by the two people in the conversation. No location or photos are sent. Blocking someone also removes them from your friends, so no more messages can be sent
Status note	When you wrote one — new notes can’t currently be written; notes written earlier are kept	Shown in friend lists and similar places
Course route coordinates	Only when you tap “Publish course” yourself	Offering the route to other users as a public course
Photos (camera / gallery)	When you take a photo with your character, or set a crew image	Taking the photo, saving it to your device, showing the crew image
Health and fitness data (workout sessions, distance, active calories, workout route)	Only if you turn health sync on yourself — read from, or written to, Apple Health (HealthKit) or Health Connect	Saving finished workouts to your health app; importing past workouts from it

Important notice about location

• The app collects location while the screen is off or you are using another app (in the background). This is needed for an unbroken route and accurate distance. We collect it only while a workout is running and stop the moment you finish.
• We explain this purpose inside the app before the system permission prompt, and only collect it if you agree. You can still use the app if you decline — recording then works only while the app is on screen.
• Detailed routes (precise coordinates) stay on your device and are not sent to our servers. Route coordinates are stripped from the records we store on the server.
• Exception 1. If you tap “Publish course” yourself, a simplified version of that route is made public along with your nickname. Publishing is entirely your choice, and you can delete a published course at any time.
• Exception 2. To calculate elevation gain, to snap the drawn route to roads, and to look up weather and air quality, we may look up coordinates only with external services. No account identifier, nickname or timestamp is sent with them. Weather lookups use coordinates rounded to three decimal places (about 100 m) and are not stored.
• Exception 3. If you pick a workout and tap “Send GPS problem” yourself, after agreeing to the notice, the raw GPS points of that workout are stored on our server with your account identifier. They are used only to improve GPS correction and are readable only by you and the operator. Nothing is sent automatically.
• Exception 4 — route backup (optional). Only if you turn on route backup yourself (Settings → Backup), your workout routes (precise coordinates) are saved to your own Google Drive app folder (appDataFolder). The file lives in your account, does not pass through our servers, and we do not read it. It is off by default; you can turn it off at any time, or remove the app’s access in your Google account settings to delete it.

Notice about health and fitness data

• Health sync is off by default. It works only if you turn it on in Settings and grant the system permission. You can turn it off at any time, or revoke access in your device’s health app.
• We read workout sessions and distance (last 90 days), and on Android, if you turn step sync on, your step count (Health Connect). We write workout sessions, distance, active calories and the workout route.
• Apple Health (HealthKit) data is not sent to our servers. Imported workouts are stored in the record list on this device; what reaches the server (your account backup) is the same shape as any other run (distance, time and so on), with route coordinates stripped. On iPhone, the step count comes from the device motion sensor (CoreMotion), not from HealthKit.
• Android: if you turn step sync on, the step count (a number) read from Health Connect is stored on our server to calculate step rewards and duels, and is shown to your duel opponent as walking distance. No location or time-of-day detail is sent, and it is never used for advertising, sold or shared with third parties.
• On Android (Health Connect), a route recorded by another app is only imported after you approve it once more, for that specific record.
• Data obtained from Apple Health is never used for advertising or marketing, and is never sold or shared with third parties.

Notice about photos

• Photos and videos taken with your character are processed and stored on your device only and are not sent to our servers.
• If you set a photo as your crew image, that image is uploaded to our server (Google Cloud Storage) and is visible to anyone who views the crew. This is your choice, and you can replace or delete it at any time.

2. How long we keep it

• We keep what we collect until you delete your account, and erase it without undue delay when you ask.
• Where law requires us to retain something, we keep it for that period.

3. Sharing and processors

We do not sell or hand your personal data to third parties. We do use the following providers to run the service.

Provider	What they do	Notes
Google Firebase (Google LLC)	Authentication, data storage (Firestore), image storage (Cloud Storage), app integrity (App Check), push notifications (Cloud Messaging)	Data region: asia-northeast3 (Seoul)
Google Play services / Google Sign-In	Sign-in
Apple Inc.	Sign in with Apple, push notification delivery (APNs)	iOS only
Google Maps Platform	Showing maps
Valhalla (public OpenStreetMap server) valhalla1.openstreetmap.de	Snapping the drawn route to roads	Simplified coordinates only. No account or nickname. Used for display, never for distance or your record
Open-Meteo api.open-meteo.com air-quality-api.open-meteo.com	Calculating elevation gain; weather and air quality	Point coordinates only (rounded for weather). No account or nickname. Only the resulting elevation (m) is stored; weather lookups are not stored

4. International transfers

Our data is stored in the Republic of Korea (Google Cloud, asia-northeast3). If you use the app from outside Korea, your data is transferred there. The European Commission has recognised the Republic of Korea as providing an adequate level of protection (adequacy decision of 17 December 2021), which is the basis for transfers from the EEA and the UK. The providers listed above may also process data in other countries under their own safeguards.

5. Your rights and how to use them

• Access and correction: in the app’s profile screen.
• Deletion: Settings → Delete account removes your account and its data (runs, profile, friends, messages you wrote) immediately. If you own a crew, hand it to another member or delete it first.
• Withdrawing consent: revoke location, camera and other permissions in your device settings at any time.

If you cannot use the app, email us from the address below, naming the Google or Apple account you signed up with, and we will delete it for you.

6. Children

The app is not aimed at children under 14 (under 16 in parts of the EEA, where local law sets a higher age), and we do not knowingly collect their personal data.

7. Keeping your data safe

• Sensitive details (email, Google name, profile picture) are kept in an area only you can read.
• Traffic is encrypted (HTTPS), and app integrity is checked (App Check).

8. Changes to this policy

We may revise this policy as the law or the service changes, and will announce revisions in the app or on this page.

9. Contact

For privacy questions, or to ask us to delete your data or account:

Email: easthyun.kim@gmail.com

10. If the GDPR applies to you

Controller. dot run club is operated by Donghyun Kim, an individual developer (there is no separate company or registered business). Contact: easthyun.kim@gmail.com. A postal address is available on request to the same address.

Legal bases.

Data	Basis (Art. 6(1))
Account details, nickname, workout records	(b) performance of the contract — the app cannot record or rank without them
Location, including in the background	(a) consent — asked for in the app before the system prompt, and withdrawable at any time
Publishing a course, setting a crew image	(a) consent — only when you choose it
Chat messages, status notes (kept from before these features closed), friend 1:1 messages, 1:1 duel information, support inquiries	(b) performance of the contract
Step count used for step coins and duels	(a) consent — only after you turn step sync on. On Android the steps come from Health Connect, so Art. 9(2)(a) explicit consent applies as for other health data
GPS problem report, route backup to your own Google Drive, push notification token	(a) consent — only when you choose it or allow notifications
App integrity checks and abuse reports	(f) legitimate interests — keeping the service usable and safe
Health and fitness data (health sync)	(a) consent for Art. 6, and Art. 9(2)(a) explicit consent — this is data concerning health. Sync is off by default and only runs after you turn it on and grant the system permission; withdrawing either stops it

Your rights. You have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time without affecting processing done before you did. Email the address above and we will answer within one month.

What happens when you withdraw consent. Turning off location permission stops collection immediately and no further route is recorded. Turning off health sync stops reading from and writing to your health app immediately; what is already in your health app stays there and is yours to delete in that app. Deleting a course you published removes the route from other users. Deleting your account erases everything we hold, as described in section 5.

Complaints. You may lodge a complaint with your local supervisory authority. In the UK that is the Information Commissioner’s Office (ico.org.uk).

Automated decision-making. We do not make decisions about you by automated means that produce legal or similarly significant effects.