dot run club Privacy Policy

dot run club (the “app”) takes your privacy seriously. This policy explains what we collect, how we use and keep it, and what rights you have. Where the UK/EU General Data Protection Regulation applies, section 10 sets out the legal bases and your rights under it.

1. What we collect, and why

Data	When	Purpose
Account details (name, email, profile picture)	When you sign in with Google or Apple	Identifying and authenticating you; account management
Nickname	You set it yourself	The name shown in rankings, leagues and chat
Location (GPS)	While recording a workout — including while you are not using the app (in the background)	Working out your route, distance and pace
Approximate location	When you use open chat	Grouping you into a nearby chat room
Workout records (distance, time, pace, date, cumulative stats)	When a workout finishes	Saving your records, growing your character, rankings and leagues
Chat messages	When you write in open or crew chat	Letting people talk to each other
Status note	When you write one	Shown in rankings, crew and friend lists
Course route coordinates	Only when you tap “Publish course” yourself	Offering the route to other users as a public course
Photos (camera / gallery)	When you take a photo with your character, or set a crew image	Taking the photo, saving it to your device, showing the crew image
Health and fitness data (workout sessions, distance, active calories, workout route)	Only if you turn health sync on yourself — read from, or written to, Apple Health (HealthKit) or Health Connect	Saving finished workouts to your health app; importing past workouts from it

Important notice about location

• The app collects location while the screen is off or you are using another app (in the background). This is needed for an unbroken route and accurate distance. We collect it only while a workout is running and stop the moment you finish.
• We explain this purpose inside the app before the system permission prompt, and only collect it if you agree. You can still use the app if you decline — recording then works only while the app is on screen.
• Detailed routes (precise coordinates) stay on your device and are not sent to our servers. Route coordinates are stripped from the records we store on the server.
• Exception 1. If you tap “Publish course” yourself, a simplified version of that route is made public along with your nickname. Publishing is entirely your choice, and you can delete a published course at any time.
• Exception 2. To calculate elevation gain and to snap the drawn route to roads, we may look up coordinates only with external services. No account identifier, nickname or timestamp is sent with them.

Notice about health and fitness data

• Health sync is off by default. It works only if you turn it on in Settings and grant the system permission. You can turn it off at any time, or revoke access in your device’s health app.
• We read workout sessions and distance (last 90 days). We write workout sessions, distance, active calories and the workout route.
• Health data is not sent to our servers. Imported workouts are stored in the record list on this device; what reaches the server is the same shape as any other run (distance, time and so on), with route coordinates stripped.
• On Android (Health Connect), a route recorded by another app is only imported after you approve it once more, for that specific record.
• Data obtained from Apple Health is never used for advertising or marketing, and is never sold or shared with third parties.

Notice about photos

• Photos and videos taken with your character are processed and stored on your device only and are not sent to our servers.
• If you set a photo as your crew image, that image is uploaded to our server (Google Cloud Storage) and is visible to anyone who views the crew. This is your choice, and you can replace or delete it at any time.

2. How long we keep it

• We keep what we collect until you delete your account, and erase it without undue delay when you ask.
• Where law requires us to retain something, we keep it for that period.

3. Sharing and processors

We do not sell or hand your personal data to third parties. We do use the following providers to run the service.

Provider	What they do	Notes
Google Firebase (Google LLC)	Authentication, data storage (Firestore), image storage (Cloud Storage), app integrity (App Check)	Data region: asia-northeast3 (Seoul)
Google Play services / Google Sign-In	Sign-in
Apple Inc.	Sign in with Apple	iOS only
Google Maps Platform	Showing maps
Valhalla (public OpenStreetMap server) valhalla1.openstreetmap.de	Snapping the drawn route to roads	Simplified coordinates only. No account or nickname. Used for display, never for distance or your record
Open-Meteo	Calculating elevation gain	Point coordinates only. Only the resulting elevation (m) is stored

4. International transfers

Our data is stored in the Republic of Korea (Google Cloud, asia-northeast3). If you use the app from outside Korea, your data is transferred there. The European Commission has recognised the Republic of Korea as providing an adequate level of protection (adequacy decision of 17 December 2021), which is the basis for transfers from the EEA and the UK. The providers listed above may also process data in other countries under their own safeguards.

5. Your rights and how to use them

• Access and correction: in the app’s profile screen.
• Deletion: Settings → Delete account removes your account and its data (runs, profile, friends, messages you wrote) immediately. If you own a crew, hand it to another member or delete it first.
• Withdrawing consent: revoke location, camera and other permissions in your device settings at any time.

If you cannot use the app, email us from the address below, naming the Google or Apple account you signed up with, and we will delete it for you.

6. Children

The app is not aimed at children under 14 (under 16 in parts of the EEA, where local law sets a higher age), and we do not knowingly collect their personal data.

7. Keeping your data safe

• Sensitive details (email, Google name, profile picture) are kept in an area only you can read.
• Traffic is encrypted (HTTPS), and app integrity is checked (App Check).

8. Changes to this policy

We may revise this policy as the law or the service changes, and will announce revisions in the app or on this page.

9. Contact

For privacy questions, or to ask us to delete your data or account:

Email: easthyun.kim@gmail.com

10. If the GDPR applies to you

Controller. dot run club is operated by Donghyun Kim, an individual developer (there is no separate company or registered business). Contact: easthyun.kim@gmail.com. A postal address is available on request to the same address.

Legal bases.

Data	Basis (Art. 6(1))
Account details, nickname, workout records	(b) performance of the contract — the app cannot record or rank without them
Location, including in the background	(a) consent — asked for in the app before the system prompt, and withdrawable at any time
Publishing a course, setting a crew image	(a) consent — only when you choose it
Chat messages, status notes	(b) performance of the contract
App integrity checks and abuse reports	(f) legitimate interests — keeping the service usable and safe
Health and fitness data (health sync)	(a) consent for Art. 6, and Art. 9(2)(a) explicit consent — this is data concerning health. Sync is off by default and only runs after you turn it on and grant the system permission; withdrawing either stops it

Your rights. You have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where processing relies on consent, you can withdraw it at any time without affecting processing done before you did. Email the address above and we will answer within one month.

What happens when you withdraw consent. Turning off location permission stops collection immediately and no further route is recorded. Turning off health sync stops reading from and writing to your health app immediately; what is already in your health app stays there and is yours to delete in that app. Deleting a course you published removes the route from other users. Deleting your account erases everything we hold, as described in section 5.

Complaints. You may lodge a complaint with your local supervisory authority. In the UK that is the Information Commissioner’s Office (ico.org.uk).

Automated decision-making. We do not make decisions about you by automated means that produce legal or similarly significant effects.