1Introduction
Piwi ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Piwi mobile application (the "App").
By using Piwi, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use the App.
2Information We Collect
Information You Provide Directly
When you create an account or use certain features, we collect:
| Data | Required? | Purpose |
|---|---|---|
| Email address | Yes | Account authentication and communication |
| Password | Yes | Account security (stored hashed by Supabase) |
| First name | Yes | Display on your public profile and leaderboard |
| Last name | Yes | Display on your public profile |
| Governorate (region) | Yes | Race discovery and leaderboard filtering |
| Gender | Yes | Leaderboard categorization (male or female) |
| Date of birth | No | Age category calculation for leaderboards |
| Race finish times | No | Personal records and leaderboard rankings |
| Race photos (evidence) | No | Result verification (1-3 images per claim) |
| Bib number | No | Result verification (optional) |
| Instagram, Facebook, Strava links | No | Display on your public profile |
| Push notification token | No | Delivering push notifications (results, follows, social activity). Only stored if you enable push notifications; see "Push Notifications" below |
Information Collected Automatically
When you use the App, we automatically collect:
| Data | Purpose |
|---|---|
| App version | Compatibility and debugging |
| Operating system (iOS/Android) | Compatibility and analytics |
| OS version | Compatibility and analytics |
| Screen views and interactions | Product improvement and analytics |
| Search queries | Product improvement (no personal identifiers attached) |
| Device identifier | Analytics and fraud prevention |
Information from Third Parties
If you sign in with Google, we receive:
- Your name
- Your email address
- Your profile picture (optional)
We use this information only to pre-fill your profile and authenticate you. We do not access any other Google data.
What We Do NOT Collect
We explicitly do not collect:
- GPS location or precise geolocation
- Phone contacts or address book
- Phone number
- Camera access (we use the system photo picker only)
- Microphone access
- Health data beyond race finish times
- Financial or payment information
Push Notifications
If you enable push notifications, we collect and store a device push token (issued by Expo, our push delivery provider) linked to your account. This token is used only to deliver notifications about your results, follows, and other account activity. You can disable push notifications at any time in Settings, which clears the stored token from our servers. In-app notification content (e.g. "your result was approved," "someone followed you") is stored linked to your account so you can view your notification history within the App.
Guest Mode
You can browse parts of the App without creating an account by using Guest Mode. While in Guest Mode, no personal data is sent to or stored on our servers — your guest status is stored only on your device. If you later create an account, this local guest state is cleared and normal account data collection (as described above) begins.
3How We Use Your Information
We use your information for the following purposes:
| Purpose | Data Used |
|---|---|
| Account creation and authentication | Email, password, Google OAuth data |
| Race discovery and recommendations | Governorate, sport preferences |
| Leaderboard display | Name, finish times, gender, age category, governorate |
| Result verification | Evidence photos, bib numbers, finish times |
| Social features | Follow relationships, wishlisted races |
| Push notifications | Push notification token (only if enabled in Settings) |
| App improvement | Anonymous analytics, screen views, search patterns |
| Customer support | Email, account information |
| Security and fraud prevention | Device info, account activity |
4Legal Basis for Processing (GDPR)
If you are in the European Economic Area (EEA), we process your personal data based on:
- Contractual necessity: To provide the App's core features (account, race discovery, leaderboards)
- Legitimate interests: Analytics, fraud prevention, and app improvement
- Consent: For optional features like result claims with photo evidence
5Data Sharing and Third Parties
We do not sell your personal data. We share data only with the following service providers:
| Service Provider | Data Shared | Purpose | Location |
|---|---|---|---|
| Supabase | All user data | Database, authentication, file storage | Cloud (check your Supabase project region) |
| PostHog | Anonymous analytics events, device info | Product analytics and improvement | European Union (eu.i.posthog.com) |
| Name, email, picture (sign-in only) | OAuth authentication | United States | |
| Expo | Build metadata; push notification token (if push is enabled) | App distribution and updates; delivery of push notifications | United States |
All third parties are contractually bound to use your data only for the purposes described above and to protect it in accordance with applicable laws.
6Data Security
We implement appropriate technical and organizational measures to protect your data:
- Encryption in transit: All data transmitted between the App and our servers uses HTTPS/TLS encryption.
- Password hashing: Passwords are hashed using industry-standard algorithms by Supabase Auth.
- Row-level security: Database rules ensure you can only create, modify, or delete your own data. Some data — such as approved race results, leaderboard rankings, and follow relationships — is intentionally viewable by other users or the public, as described elsewhere in this policy.
- Private evidence storage: Evidence photos submitted with result claims are stored in a private location accessible only to you and to Piwi administrators reviewing your claim — they are never publicly accessible, regardless of your claim's status.
- Image compression: Evidence photos are resized to 1200px width and compressed to 80% quality before storage. Profile avatar photos are resized to 400px width and compressed to 80% quality before storage.
- No plaintext storage: Sensitive data is never stored in plain text.
7Data Retention
We retain your data for as long as your account is active or as needed to provide you with the App's services.
| Data Type | Retention Period |
|---|---|
| Account and profile data | Until account deletion |
| Race results and claims | Until account deletion (or as required by race organizers) |
| Evidence photos | Until the associated result claim is deleted |
| Analytics data | 12 months (PostHog default retention) |
| Deleted accounts | 30 days after soft deletion, then permanently erased |
8Your Rights
Depending on your location, you may have the following rights regarding your personal data:
| Right | How to Exercise |
|---|---|
| Access | Contact piwi.support@gmail.com |
| Correction | Update your profile in the App's Settings |
| Deletion ("Right to be Forgotten") | Use the "Delete Account" button in Settings |
| Restriction of processing | Contact piwi.support@gmail.com |
| Data portability | Contact piwi.support@gmail.com |
| Object to processing | Contact piwi.support@gmail.com |
| Withdraw consent | Contact piwi.support@gmail.com |
Account Deletion
1. Go to Settings → Delete Account
2. Confirm the deletion
3. Your account will be soft-deleted immediately and permanently erased within 30 days
When you delete your account:
- Your profile and personal data are marked for deletion
- Your result claims and evidence photos are removed
- Your auth credentials are invalidated
- Your wishlist and follow relationships are deleted
Note: Anonymized race results that have been published to public leaderboards may be retained in aggregated form.
9Children's Privacy
Piwi is not intended for children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe we have collected data from a child under 13, please contact us at piwi.support@gmail.com and we will delete the information promptly.
10International Data Transfers
Your data is primarily stored and processed in the region where your Supabase project is hosted. Analytics data is processed in the European Union (via PostHog's EU infrastructure).
If you are located outside these regions, your data may be transferred to and processed in these locations. We ensure appropriate safeguards are in place for such transfers.
11Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of changes by:
- Updating the "Last updated" date at the top of this policy
- Displaying a notice in the App when significant changes are made
Your continued use of the App after any changes constitutes acceptance of the updated policy.
12Contact Us
Response time: We aim to respond to all inquiries within 48 hours.
13Google Play Data Safety Disclosure
For transparency with Google Play users, here is our Data Safety summary:
Data Collected
| Data Type | Optional? | Purpose |
|---|---|---|
| Name | No | Account, leaderboard |
| No | Authentication | |
| Photos | Yes | Result verification |
| App interactions | No | Analytics |
| Device ID | No | Analytics, security |
| OS version | No | Analytics, compatibility |
| Search history | No | Product improvement |
| Push notification token | Yes | Delivering push notifications |
Data Shared
We do not share personal data with third parties except for the service providers listed in Section 5, who process data on our behalf.
Security Practices
- Data is encrypted in transit
- You can request that data be deleted
- Account deletion is available in-app
- No data is sold to third parties
This Privacy Policy is effective as of August 20, 2026.