Privacy Policy

Last Updated: November 2026

Who Is Responsible for Your Data

The controller of your personal data is TerriRun. For any privacy matter you can write to privacy@terrirun.app.

Data We Collect

Account Data

• Email address and username
• Password, stored hashed with bcrypt so we can never read it
• City and country you choose when signing up
• Avatar image, if you upload one
• If you sign in with Google: your Google identifier, email and name
• If you enable two-step verification: the secret key, stored encrypted, and the backup codes, stored hashed with bcrypt

Activity and Location Data

• GPS coordinates (latitude, longitude, time and accuracy) while you record an activity, also with the screen locked if you allow it
• Distance, duration and speed of each activity
• Game progress: visited and conquered cells, points, achievements, streaks, clans and challenges

We do not collect your location when you are not recording an activity.

Technical Data

• IP address and request data sent to our servers, used for security, to limit abuse and to diagnose errors

Why We Use Your Data and on What Legal Basis

• Creating and managing your account and providing the service (recording activities, conquering cells, achievements, clans and ranking): performance of the contract you accept when signing up
• Using your location during activities: your consent, given when you grant the location permission and which you can withdraw in your phone settings
• Sending you emails required by the service, such as password reset codes: performance of the contract
• Protecting the service, detecting cheating (for example, activities in a vehicle) and preventing abuse: legitimate interest in keeping the game fair and safe

We do not send marketing emails and we do not sell your data.

What Other Users Can See

TerriRun is a competitive game, so part of your information is visible to other players:

• Your username and avatar
• Your position and totals in the ranking (points, cells, distance and number of activities), including your city's ranking
• The cells you own on the map and their points
• Your clan membership and your points contribution

Your email, your full GPS routes and your password are not visible to other users.

Providers That Process Data on Our Behalf

To provide the service we use these providers, which only process data following our instructions:

• Amazon Web Services: servers, database, technical logs and email delivery, in the United States (Ohio region)
• Cloudflare: image storage (avatars and clan images), DNS and forwarding of the email we receive
• Google: Google sign-in, if you use it, and handling of support email
• Expo: delivery of app updates

Some of these providers process data outside your country, mainly in the United States.

How Long We Keep Your Data

• While your account is active, we keep your data to provide the service
• If you delete your account, we immediately remove your account, activities and GPS points, cells, achievements, clans and sessions from our database
• If you also want us to delete an image you uploaded, write to privacy@terrirun.app
• Password reset codes expire after 15 minutes and are deleted by the next day at the latest
• Technical logs are kept for a limited time

Your Rights

You can exercise these rights at any time:

• Access and portability: download all your data in JSON format
• Rectification: correct your username, city, country or avatar
• Erasure: delete your account and your data
• Objection and restriction: object to processing based on legitimate interest
• Withdrawing consent: for example, by disabling the location permission

How to Exercise Your Rights

1. Open the TerriRun app
2. Go to Profile → Settings → Data & Privacy
3. Choose "Download My Data" or "Delete My Account". If your account has a password, we will ask for it to confirm the deletion

You can also write to privacy@terrirun.app. If you believe we have not handled your data properly, you can file a complaint with the data protection authority in your country.

Security

• Passwords are stored hashed with bcrypt
• All communication with our servers is encrypted with HTTPS
• We use session tokens that are revoked when you log out or change your password
• You can enable two-step verification
• We limit login and password reset attempts

Children

TerriRun is not intended for children under 16 and we do not knowingly collect data from children under that age.

Changes to This Policy

If we change this policy in an important way, we will let you know in the app.

Contact Us

• Privacy: privacy@terrirun.app
• Support: soporte@terrirun.app
• In-app: Profile → Settings → Data & Privacy