Privacy Policy
Last updated: 12 November 2026
Church ("we", "us") is run by Keith Dmonte, an individual based in Virar, Palghar district, Maharashtra, India. This policy explains what personal data we collect, why, and your rights.
1. Data We Collect
| Data | Why | Required? |
|---|---|---|
| Phone number | Sign-in via one-time password | Yes |
| Name, photo, bio | Your public profile on leaderboards and teams. The photo comes from your camera or photo library, only when you choose one | Name yes, others optional |
| Birth year | Check you are 13 or older and turn on teen mode for under-18s. Never shown to anyone | Yes |
| Home area pin | Rounded area (~1 km): nearby leaderboard. The exact pin is used only to work out that area | Yes for nearby board |
| GPS location during recording | Measure distance, pace and route of your activities | Yes to record |
| Live position and route so far, while recording (live sharing) | Show your approved followers where you are on a live map | Off until you say yes. We ask the first time you start recording; change it any time in Settings |
| Activity data (distance, time, pace, route, splits) | History, leaderboards, challenges, streaks, badges | Yes |
| Team and challenge membership | Team features | Optional |
| Follows, follow requests and blocks | Let you follow people you approve and block others | Optional |
| Account type (private or public) | Decide who sees your activities | Private unless you change it |
| Kudos and comments you give or write, and comments you report | Social feed: cheer and talk about activities; review reported comments | Optional |
| People, teams, challenges and activities you report, with the reason you pick | Review reports and remove content or accounts that break the Terms | Optional |
| Your contacts' phone numbers, only if you tap "Check my contacts" | Show which of your contacts use the App. Numbers are turned into a code (hashed) on your phone before they are sent, compared once, and not stored or logged. A hash is not encryption: a phone number can be worked out from it, so we treat these codes as phone numbers | Optional |
| Push notification token | Send notifications you enabled | Optional |
| Review requests ("This was real") and the note you add | Re-check an activity our automatic checks did not count | Optional |
| Whether GPS readings came from a fake-location app (Android marks these) | Keep leaderboards fair | Yes to record |
| Device and crash data (device model, OS, app version, crash logs), linked to a random account ID | Fix bugs. Our crash tool does not store your IP address | Yes |
| IP address and device details in our server logs | Keep the service secure and fix problems | Yes |
| Usage analytics (screens viewed, features used, plus device model, OS, app version, language and time zone), linked to a random account ID | Improve the app. No phone number, name or location is sent, and IP addresses are discarded. Deleted with your account | On by default; turn off in Settings → Privacy → Share usage stats (applies to that phone) |
Outside a recording, the App uses your location only on your phone: to show where you are on a map and to get GPS ready before you press Start. It is sent to us only once if you set your home area (see section 2). While a map shows your position, the map provider (Google Maps or Apple Maps) handles it. We do not track or store your location when you are not recording, and we do not sell personal data.
Website waitlist. If you join the waitlist on our website we store your name and email to send you launch news, plus a coded (hashed) form of your IP address to stop abuse; your IP itself is not stored. The form uses Cloudflare Turnstile to check you are human, which processes your browser and IP data under Cloudflare's privacy policy. We keep waitlist details until we stop sending launch news, or sooner if you ask at [email protected]. The website is hosted by Cloudflare and loads fonts from Google Fonts; both see your IP address when you visit.
2. Location
- We store your location only from recordings (and your rounded home area, if you set one). Recording keeps working when your screen is locked; Android shows a notification the whole time.
- Your exact home pin is never shown to anyone. It is used only to work out your rounded home area.
- Your routes are stored whole, including any part near your home. Who sees them depends on your account type:
- Private account (the default): only you and the followers you approved see your activities, including the route map. Approve only people you are comfortable with.
- Public account: anyone signed in to the App (except people you blocked or who blocked you) can see your activities and route maps. Routes often start and end near home, so a public account shows roughly where you live. You choose this in Settings → Who sees my activities, and we warn you before you switch.
- If you share a route or medal card, the route on the card (often starting and ending at home) is visible to whoever you share it with.
- On the nearby leaderboard, others can see that you are in a roughly 1 km area. They never see your exact home or your routes.
- The nearby leaderboard is off unless you turn it on. You can turn it off any time in Settings.
- Live sharing is off until you say yes. The first time you start recording we ask, with "Share live" and "Not now" equally easy. If you say yes, while you record people you approved as followers see your current position, the route so far, your name and photo, and whether you are running or walking, on a live map. They see it from the start of the activity, including near your home; there is no hidden zone around home. The live map does not show your distance, pace or time, but each point of the route has a time, so a follower could work out roughly how long and how fast you have been going.
- People whose follow request you have not approved, people you blocked or who blocked you, and everyone else never see your live position.
- To stop live sharing, turn off Settings → Privacy → Share live runs with followers. If you turn it off during an activity, you disappear from followers' maps within about 15 seconds. You can also remove or block a follower at any time.
- Your live position is deleted as soon as you stop or discard the activity. If your phone loses connection, followers stop seeing you after 2 minutes and it is deleted after 10 minutes. The saved activity follows the rules above.
3. Who Can See What
| Data | Visible to |
|---|---|
| Name, photo, bio, badges, streak | Other users |
| Weekly distance and rank | Other users nearby (only if you turned on the nearby leaderboard); your team and challenge members |
| Your verified activities: route map, distance, time, pace, splits | Private account (default): you and your approved followers. Public account: any signed-in user. Not people you blocked or who blocked you. Plus anyone you send a share card to |
| Activities the App flagged as not counted | Only you |
| Kudos you give, comments you write | Everyone who can see that activity |
| Comments you report | The comment's author and readers are not told who reported it; we see your report |
| People, teams, challenges and activities you report | Nobody is told who reported it; we see your report and reason |
| Account type (private / public) | Other users |
| Your live position and route so far, while you record | Your approved followers, only if you said yes to live sharing (a LIVE badge shows while it is on) |
| Your follower and following counts | Other users |
| Your followers, who you follow, your follow requests | Only you. The person you follow or send a request to sees that you did |
| People you blocked | Only you. A blocked person is not told |
| That you use the App (name and photo) | People who search for your name, open your follow link, or have your phone number in their contacts and check them. People you blocked never see you this way |
| Phone number | Only us. Contact matching never shows your number to anyone |
| Exact home pin | No one (used by our servers only) |
4. Service Providers (Data Processors)
| Provider | Purpose | Location of processing |
|---|---|---|
| Supabase | Database, auth, file storage | India (ap-south-1, Mumbai) |
| MSG91 (Walkover Web Solutions) | Sending OTP SMS | India |
| GitHub | Storing weekly encrypted backups (only we hold the key) | USA |
| Expo (650 Industries) | Delivering push notifications and app updates | USA |
| Apple / Google | Push notification delivery, app distribution | USA / global |
| Sentry | Crash reporting | EU (Germany) |
| PostHog | Product analytics | EU |
| Google Maps / Apple Maps | Displaying maps, including your position while a map shows it | Global |
| Cloudflare | Website hosting, the website's bot check, forwarding email sent to [email protected] | Global |
| Google (Gmail) | Our support inbox: emails you send us | Global |
| Meta (Instagram) | Only if you tap "Share to Instagram Story": the sticker image you chose | Global |
Some processors are outside India. Transfers follow the DPDP Act and any restrictions notified by the Government of India.
5. Legal Basis and Consent
We process your data with your consent, given when you sign up and when you grant permissions (location, notifications, contacts). Live sharing has its own question the first time you record; nothing is shared until you say yes. You can withdraw consent at any time by turning off a permission, turning off the nearby leaderboard or live sharing, or deleting your account. Withdrawal does not affect processing done before it.
Automatic checks. To keep leaderboards fair, the App checks each activity automatically (for example speed, travel by vehicle, fake GPS). Stretches faster than 25 km/h that last longer than about 10 seconds are left out and we tell you (if most of an activity is that fast, it does not count); activities that fail a check stay in your history but don't count on leaderboards. You can ask a person to review it ("This was real"). Limits on how often you can do things (for example comments per hour) stop spam and abuse.
6. Retention
| Data | Kept |
|---|---|
| Account, profile, activities | Until you delete them or your account |
| GPS readings from a recording | Deleted from your phone once uploaded. Our server keeps the processed route (about one point per second, with times) until you delete the activity or your account |
| Follows, follow requests, blocks | Until you remove them or delete your account. A declined request is deleted |
| Kudos and comments | Until you take them back or delete them, the activity's owner deletes the comment or the activity, or either account is deleted |
| Comment reports | Until the comment is deleted, either account is deleted, or 1 year, whichever is first |
| Other reports | Until the reported item is deleted, the reporter's account is deleted, or 1 year, whichever is first |
| Usage counts for limits (kudos, comments, follow requests, name searches, team creation, home area changes, contact checks, wrong invite codes) | Only the number, not what you did; deleted within 2 days |
| Moderation log (actions we take on reported content or accounts, with the account ID) | 1 year |
| Server logs (IP address, device details) | Up to 7 days |
| Review requests ("This was real") | Until the activity or your account is deleted, or 1 year after we decide, whichever is first |
| Backups | Daily backups kept 7 days; weekly encrypted backups kept 90 days. Deleted data disappears from backups when they expire |
| Your follow link code | Until you make a new one or delete your account |
| Contact numbers you check | Not kept. Compared in a single request, then discarded |
| Name searches | The search text is not kept; only a count (see usage counts) |
| Live position and route (live sharing) | Until you stop or discard the activity; at most 10 minutes after the last update if the connection drops |
| Notifications sent to you (text and time) | 90 days |
| Crash logs | 90 days |
| Analytics | 12 months |
| OTP logs at SMS provider | As kept by the SMS provider under its own policy |
7. Your Rights
Under the DPDP Act you can:
- Access a summary of your data and how it is processed: email [email protected] from or about your account's phone number
- Correct and update your data (Profile and Settings screens)
- Erase your data: Settings → Delete account, or https://churchrun.app/delete-account. Deletion is completed within 30 days, except where law requires us to keep something. Copies in backups disappear when those backups expire (at most 90 days)
- Nominate a person to exercise your rights in case of death or incapacity: email us their name and contact details
- Raise a grievance with us (below), and then with the Data Protection Board of India
8. Children
Church is for people aged 13 and over. We ask for your birth year at sign-up and refuse anyone under 13. If you think a child under 13 has an account, contact us and we will delete it.
Accounts of people under 18 run in teen mode, set by the birth year:
- the account is always private (you approve each follower)
- live sharing is off and can't be turned on
- no usage analytics are collected once you enter your birth year (before that step, only anonymous app-open and screen counts that are not linked to you)
- nobody can find you from their phone contacts, and you can't check your contacts
- you can still record activities, join teams and challenges, and appear on leaderboards with your name and photo
9. Security
Data is encrypted in transit (HTTPS) and at rest. Access is restricted by per-user database rules. Sign-in tokens are stored in the phone's secure storage. No system is perfectly secure; we will notify you and the Data Protection Board of a personal data breach as required by law.
10. Changes
We will notify you in the app before material changes take effect.
11. Contact and Grievance Officer
Keith Dmonte, Grievance Officer
Email: [email protected]
Address: Virar, Palghar district, Maharashtra, India
We acknowledge complaints within 24 hours and resolve them within 15 days.