PRIVACY POLICY

1. Introduction & Data Controller

Runigo ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use the Runigo application ("App").

The data controller responsible for your personal data is:
James Halligan (trading as Runigo)
14A Deebanks, Chester, CH3 5UX, United Kingdom
Email: hello@runigo.app

This policy applies to all users of the App and is governed by applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR), the EU General Data Protection Regulation (EU GDPR), and the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), where applicable. By using the App, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Account & Identity Information

When you create an account, we collect your email address and the username you choose during setup. If you sign in with Apple, we receive your full name. If you sign in with Google, we receive your profile photo URL. We also store account creation and update timestamps.

2.2 Precise Location Data

Runigo is a location-based game. We collect the following location data to enable core gameplay:

• Home Base location — the GPS coordinates you set as your starting point, stored in our database.
• Run route paths — a detailed GPS trail (latitude, longitude, timestamp, and accuracy) recorded throughout every run and stored in our database.
• Background location — when you start a run, the App continues recording your location even when the App is not on screen. We request "Always On" location permission for this purpose. You can disable background location at any time in your device settings, though this will prevent run tracking from working correctly.

2.3 Health & Activity Data

We collect running and activity data, including:

• Distance, duration, pace, and score for each run.
• Cumulative statistics: total runs, total distance, personal bests, and daily/weekly streaks.
• Points of Interest and flags captured during runs.
• Step count — we read your daily step count from Apple Health (covering the past 7 days) solely to display your activity within the App. This data is never transmitted to our servers and remains on your device.

2.4 Social & Friends Data

If you use social features, we collect:

• Your friends list (linked by user IDs and usernames) and friend requests (sender, recipient, and timestamp).
• Reactions you give to friends' runs (High Five, On Fire).
• Your friends' recent run summaries, including their run statistics and GPS route data.

2.5 Challenges & Competition Data

When you participate in challenges, we collect:

• Challenge names, types, dates, and settings you create or join.
• Your scores, distances, and rankings within each challenge, and challenge outcomes (winner, completion status).
• Virtual Home Base customisation settings (colours, initials).

2.6 Onboarding Preferences

During setup, we collect your running frequency, running style (solo, friends, club, or business), motivation, weekly running target, and how you found the App (referral source). This information is used to personalise your experience.

2.7 Bug Reports

If you submit a bug report, we collect your device model (e.g. iPhone 15), iOS version, App version, and a free-text description of the issue.

2.8 Usage & Analytics Data

We automatically collect basic app usage events via Firebase Analytics, including app open events and sign-up/login events (including the method used: email, Google, or Apple). We do not use advertising identifiers (IDFA) and do not show ads.

3. Legal Basis for Processing

We process your personal data on the following legal bases under the UK GDPR and EU GDPR:

• Contract performance — processing of your account information (name, email, profile), gameplay data, and leaderboard standings is necessary to provide the App and its features as described in our Terms of Service.
• Consent — we process your precise location data, health and fitness data, and send marketing or promotional communications only with your explicit consent. You may withdraw consent at any time through the App settings or by contacting us, without affecting the lawfulness of processing carried out before withdrawal.
• Parental consent — where the account holder is a child below the digital age of consent in their country (16 in the UK and much of the EU, 13 in some member states), the consent described above must be given, and can be withdrawn, by the holder of parental responsibility, as required by Article 8 of the UK and EU GDPR. See Section 11.
• Legitimate interests — processing of device information, usage data, and crash data is necessary for our legitimate interests in analysing usage patterns, improving the App, detecting abuse, and ensuring security. We balance our interests against your rights and freedoms and do not use this basis where it would be overridden by your interests.
• Legal obligation — we may process your data where necessary to comply with applicable laws, regulations, or legal proceedings, such as responding to a court order or regulatory request.

4. How We Use Your Information

We use the information we collect to:

• Create and manage your account (email, name, username).
• Track and record your runs (GPS route, distance, pace, duration).
• Generate location-based Points of Interest using your Home Base location.
• Display your activity stats, streaks, and step count (run data; step count stays on-device).
• Enable social features including friends and reactions.
• Run challenges and leaderboards (scores, distances, usernames).
• Process in-app subscriptions via RevenueCat (user ID, purchase history).
• Show weather conditions for running via Apple WeatherKit (current location).
• Send push notifications about run results, Points of Interest captures, and reactions from friends.
• Investigate bugs and improve the App (bug report data, device info).
• Analyse usage patterns and improve the App experience (Firebase Analytics).

5. Third-Party Services

We share data with the following third-party services to operate the App. By using the App, you acknowledge that your data may be processed by these providers under their own privacy policies.

Firebase (Google LLC)

We use Firebase for user authentication, our cloud database (Firestore — which stores all account, gameplay, and GPS route data), and basic analytics. Firebase also powers push notifications (Cloud Messaging) and performance monitoring.
Privacy Policy: policies.google.com/privacy

Google Sign-In

If you choose to sign in with Google, your Google account identity is passed to Firebase for authentication.
Privacy Policy: policies.google.com/privacy

Apple Sign-In

If you choose to sign in with Apple, we receive your name and email address (you control whether a real or relay address is shared). Apple does not share tracking information with us.
Privacy Policy: apple.com/legal/privacy

RevenueCat, Inc.

We use RevenueCat to manage in-app subscriptions and purchases. RevenueCat receives your user ID and App Store transaction data to verify and manage your entitlements. We do not directly collect or store your payment card details.
Privacy Policy: revenuecat.com/privacy

Apple WeatherKit

We use Apple's WeatherKit service to display current weather conditions for running. Your current location is sent to Apple to fulfil this request.
Privacy Policy: apple.com/legal/privacy

Apple Maps (MapKit)

Maps, map tiles, and route display within the App are provided by Apple Maps. Apple receives the map region you are viewing in order to serve it.

Privacy Policy: apple.com/legal/privacy

Apple HealthKit

We read your daily step count from Apple Health on-device to display your activity within the App. This data is never sent to our servers or any third party.

Privacy Policy: apple.com/legal/privacy

Apple Push Notifications

We use Apple's push notification infrastructure to deliver alerts about run results, Points of Interest captures, and reactions from friends. Notification payloads may contain Points of Interest names, player usernames, and track names.

Privacy Policy: apple.com/legal/privacy

6. Data Sharing & Third Parties

We do not sell your personal data. We may share information with:

• Google / Firebase — we use Google's Firebase platform for hosting, authentication, database, analytics, cloud messaging, and performance monitoring. Google's privacy policy is available at policies.google.com/privacy.
• Apple — maps and map tiles are provided by Apple Maps (MapKit), weather by WeatherKit, push delivery by Apple Push Notifications, and payments by the App Store. See Section 5.
• Diagnostics — crash and performance data is shared with Firebase as described in Section 2.10.
• Other users — your username, profile, gameplay stats, and run routes are visible to your friends via leaderboards and other social features.
• Legal requirements — we may disclose information if required by law or to protect the rights and safety of Runigo, our users, or the public.

7. International Data Transfers

Your personal data may be transferred to, stored, and processed in countries outside the United Kingdom or the European Economic Area (EEA), including the United States, where our service providers (such as Google/Firebase) operate. Where such transfers occur, our service providers maintain appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission or the UK Information Commissioner's Office.
• Transfers to countries that have been deemed to provide an adequate level of data protection.

8. Data Retention

We retain different categories of data for different periods, based on necessity and legal requirements:

• Account data (name, email, profile) — retained for as long as your account is active. Deleted or anonymised within 30 days of account deletion.
• Location data — retained for the duration of your account to support gameplay history and leaderboards. Deleted or anonymised within 30 days of account deletion.
• Health & fitness data — retained for the duration of your account. Deleted or anonymised within 30 days of account deletion.
• Analytics & usage data — retained in aggregated or anonymised form and may be kept beyond account deletion for the purpose of improving the App. This data cannot be used to identify you.
• Transaction records — may be retained for up to seven (7) years after account deletion where required for tax, accounting, or legal compliance.

Where we are required by law to retain certain data beyond these periods, we will do so only for as long as legally necessary and with appropriate safeguards in place.

To delete your account and all associated data, you can use the account deletion option within the App, or contact us at hello@runigo.app. We will process your request within 30 days.

9. Your Rights

Depending on your location and applicable law (including the UK GDPR, EU GDPR, and CCPA), you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request correction of inaccurate data.
• Deletion — request deletion of your personal data.
• Portability — request your data in a structured, commonly used, and machine-readable format.
• Restriction — request that we restrict the processing of your personal data in certain circumstances.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
• Opt-out — opt out of non-essential data collection and marketing communications.

To exercise any of these rights, contact us at hello@runigo.app. We will respond to your request within one month (or as required by applicable law). You also have the right to lodge a complaint with a supervisory authority, such as the UK Information Commissioner's Office (ICO).

10. California Privacy Rights (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA):

• Right to know — you may request details about the categories of personal information we have collected about you in the preceding twelve (12) months, the purposes for collection, and the categories of third parties with whom we share your information.
• Right to correct — you may request correction of inaccurate personal information we hold about you.
• Right to delete — you may request deletion of your personal information, subject to certain legal exceptions.
• Right to opt-out of sale or sharing — we do not sell or share your personal information for cross-context behavioural advertising. If this changes, we will provide a clear opt-out mechanism.
• Right to limit use of sensitive personal information — you may request that we limit our use of sensitive personal information (such as precise location and health data) to what is necessary to provide the App.
• Right to non-discrimination — we will not discriminate against you for exercising your privacy rights.

To exercise your CCPA/CPRA rights, contact us at hello@runigo.app. We will verify your identity before processing your request and respond within forty-five (45) days as required by law.

11. Children's Privacy

Runigo is rated 4+ and children may use it, with the protections set out in this section. Runigo is a game played outdoors in real places, and it records precise location, so we ask parents and guardians to read this section in full.

11.1 Parental consent

Where the account holder is below the digital age of consent in their country — 16 in the United Kingdom and much of the European Economic Area, 13 in some EU member states and in the United States — we obtain verifiable consent from a parent or legal guardian before we collect any personal data from that child. The parent or guardian may withdraw that consent at any time, which will end the child's use of the App and trigger deletion of their data under Section 8.

11.2 How child accounts are treated differently

• Location is off by default. Location collection on a child account is not enabled until a parent or guardian turns it on, and it can be turned off again at any time.
• No profiling and no analytics profiles. We do not build behavioural profiles of children and do not use a child's data for analytics beyond what is needed to keep the App working and safe.
• No advertising. Runigo carries no advertising for any user, and does not use Apple's advertising identifier.
• Social features are limited. Friends must be mutually accepted, and a parent or guardian can review a child's friends list, challenges, and shared runs at any time.
• No nudges toward weaker privacy. We do not use design techniques that encourage a child to turn off a protection or share more data than the App needs.

11.3 Rights of parents and guardians

A parent or legal guardian may, at any time, ask us to review the personal data we hold about their child, correct it, provide a portable copy, stop further collection, or delete the child's account and data. Contact us at hello@runigo.app and we will respond within one month. We may need to verify your identity and your relationship to the child before acting on the request.

If you believe a child has created an account without the consent of a parent or guardian, contact us and we will suspend the account and delete the data.

11.4 Safety

Deciding whether, where and with what supervision a child uses Runigo is a decision for their parent or guardian. Content or behaviour from other players can be reported and players can be blocked, as described in Section 8 of our Terms of Service. Reports involving a child's safety are treated as urgent.

12. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls, and regular security reviews. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes at least thirty (30) days before they take effect, by posting the updated policy within the App, sending you a notification, or by other reasonable means. Where required by law, we will seek your consent to material changes. If you do not agree with the revised policy, you may stop using the App and request deletion of your account before the changes take effect. Your continued use of the App after the updated policy takes effect constitutes your acceptance of the revised policy.

14. Governing Law

This Privacy Policy is governed by the laws of England and Wales. If you are located in the EU or UK, nothing in this policy affects your rights under applicable data protection legislation.

15. Our Website

Sections 1 to 14 describe the Runigo app. This section covers runigo.app, the website you are reading now. We do not ask you to create an account or submit personal data to use the website.

• Analytics. The website loads Google Firebase Analytics, which records page views and basic device and browser information, and stores an identifier in your browser to recognise repeat visits. We use this only to understand which pages are read.
• Fonts. The website loads typefaces from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Making that request discloses your IP address to Google.
• Hosting. The website is hosted on Firebase Hosting, which logs requests, including IP addresses, for security and reliability.
• Browser storage. Beyond the analytics identifier above, the website stores nothing on your device, and we do not use advertising or cross-site tracking cookies.

The analytics described here are not strictly necessary to deliver the website, and we do not currently ask for your consent before they load. You can prevent them by blocking scripts from firebase.googleapis.com and google-analytics.com in your browser or with an extension, or by using your browser's private browsing mode. Doing so does not affect any part of the website.

Google is the processor for the analytics, fonts and hosting described above. Its privacy policy is at policies.google.com/privacy. The transfer safeguards in Section 7 and the rights in Section 9 apply to this data too.

16. Contact

If you have questions about this Privacy Policy or wish to exercise your data protection rights, please contact us:

• Email: hello@runigo.app
• Post: James Halligan (trading as Runigo), 14A Deebanks, Chester, CH3 5UX, United Kingdom

We aim to respond to all data protection enquiries within one month of receipt. If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority, such as the UK Information Commissioner's Office (ICO).