Welcome to RunReward. This Privacy Policy explains how Sunny Bhadana ("I", "me", or "the developer"), the individual developer of the RunReward mobile application ("App"), collects, uses, and protects your information when you use the App.
By using RunReward, you agree to the practices described in this policy. If you do not agree, please do not use the App.
Short version: RunReward collects your phone number to create your account,
your GPS location only while you are actively running, and basic profile data you provide
(name, age, weight). This data is used to power your running stats, the leaderboard, and
territory features. It is never sold.
Contents
1. Information We Collect
1.1 Information You Provide
| Data | When Collected | Purpose |
|---|---|---|
| Phone number | Registration / login | Account identity and authentication via Firebase OTP |
| Name | First-time profile setup | Display on leaderboard and territory map |
| Age | First-time profile setup | Optional personalisation of run stats |
| Body weight (kg) | First-time profile setup | Calorie estimate during runs |
| Fitness goal | First-time profile setup | App personalisation |
1.2 Information Collected Automatically During Use
| Data | When Collected | Purpose |
|---|---|---|
| GPS location (latitude/longitude) | Only while an active run is in progress | Distance calculation, route map, territory zone assignment |
| Step count (accelerometer) | Only while an active run is in progress | Run statistics |
| Run metrics (distance, duration, pace, calories, max speed) | End of each run | Run history, leaderboard, milestones, rewards |
| Device ID (randomly generated UUID) | App installation | Session security — ensures your login token cannot be replayed from another device |
| IP address | Each API request | Rate limiting, fraud prevention, security audit logs |
| App version | Each API request | API compatibility |
Important: GPS location is collected only while you have an
active run in progress. The App does not track your location in the background or when
the run screen is closed.
2. How We Use Your Information
Your information is used solely to operate and improve RunReward:
- Account management — creating and securing your account using your phone number.
- Run tracking — recording your route, computing distance, pace, calories, and step count.
- Rewards and milestones — crediting coins when you complete runs and reach distance milestones.
- Leaderboard — displaying your name and total km on the weekly and all-time leaderboards.
- Territory Control — assigning and displaying ownership of map zones based on where you run.
- Security — preventing unauthorised access, rate-limiting, and detecting fraud.
- App improvement — understanding how features are used (no third-party analytics SDK is present).
3. Third-Party Services
RunReward integrates the following third-party SDKs and services. Each has its own privacy policy that governs how they handle data.
Firebase Authentication (Google LLC)
Handles phone number OTP verification. Your phone number is sent to Google's servers to deliver and verify the SMS code.
firebase.google.com/support/privacy →
Google Maps SDK for Android (Google LLC)
Renders the live run map and the territory control map. Google may receive your approximate location and device information when the map is displayed.
policies.google.com/privacy →
Google Mobile Ads / AdMob (Google LLC)
Serves optional rewarded and banner advertisements. See Section 4 for full details on advertising data.
policies.google.com/technologies/ads →
4. Advertising (Google AdMob)
RunReward displays advertisements powered by Google AdMob. Watching rewarded ads is entirely optional and earns you in-app coins. Ads may be personalised based on your interests as described in Google's Ads Policy.
AdMob may collect the following data on Google's behalf:
- Advertising ID (Android Ad ID)
- Device type, OS version, and language
- Approximate location (if permission is granted)
- Ad interaction data (views, clicks)
You can opt out of personalised ads at any time through your Android device settings: Settings → Google → Ads → Opt out of Ads Personalisation.
RunReward does not direct ads at children and has not configured the App for child-directed treatment.
5. Data Sharing
Your personal data is never sold. It is shared only in these limited circumstances:
| Recipient | What is shared | Why |
|---|---|---|
| Other RunReward users | Your display name and km totals | Leaderboard and territory ownership display |
| Google (Firebase) | Phone number | OTP delivery and verification |
| Google (Maps SDK) | Map viewport coordinates | Rendering map tiles |
| Google (AdMob) | Device advertising ID, ad interactions | Ad delivery (see Section 4) |
| Legal authorities | Minimum necessary data | Only if required by applicable law |
No analytics, crash reporting, or marketing platforms are integrated beyond those listed above.
6. Data Retention
Your data is kept for as long as your account is active. Specifically:
- Account data (phone number, name, profile) — retained until you request deletion.
- Run GPS traces — stored on our servers to compute territory zones; retained for the lifetime of your account.
- Run statistics — retained for the lifetime of your account to power history, milestones, and leaderboards.
- Security logs (IP address, device ID, token usage) — retained for up to 90 days for fraud prevention.
- Territory data — weekly ownership resets automatically every Monday. Historic data is anonymised after 12 months.
To request deletion of your account and all associated data, contact us at the address in Section 11.
7. Security
We take reasonable technical and organisational measures to protect your data:
- All data is transmitted over HTTPS / TLS.
- Authentication tokens are bound to your device ID so they cannot be replayed from another device.
- Sensitive values (tokens, keys) are stored in Android Keystore via Flutter Secure Storage.
- API endpoints are rate-limited to reduce abuse and enumeration attacks.
- No plaintext passwords are stored — authentication is entirely phone-number OTP based.
Despite these measures, no method of transmission over the internet is 100% secure. If you discover a security issue, please contact us responsibly at the address in Section 11.
8. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
-
👁Access Request a copy of the personal data we hold about you.
-
✏️Correction Update your name, age, weight, or goal at any time via the app's profile settings.
-
🗑Deletion Request deletion of your account and all associated data by emailing us.
-
🚫Opt out of personalised ads Via Android device settings → Google → Ads at any time.
-
📦Portability Request your run history in a machine-readable format by contacting us.
To exercise any of these rights, contact us at sunnybhadana44@gmail.com. We will respond within 30 days.
9. Children's Privacy
RunReward is not directed at children under the age of 13 (or the applicable minimum age in your country). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.
10. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we will provide notice within the App. Your continued use of RunReward after any update constitutes acceptance of the revised policy.
We recommend reviewing this page periodically.
11. Contact Us
If you have any questions about this Privacy Policy, wish to exercise your rights, or want to report a concern, please reach out:
sunnybhadana44@gmail.com
Sunny Bhadana — Individual Developer, RunReward