Privacy Policy
XVVX is operated by Techcon Solution Limited. This policy covers our iOS and Android apps and xvvx.app. Contact [email protected] for privacy questions.
Information we use
- Account and profile: Apple or Google account identifiers, the email/name you choose to share, nickname, avatar, optional profile photos, gender and pace preferences. Existing password accounts remain available for existing users and app review. Adding friends does not require address-book access. Optional contact picking lets you select one contact and confirm one email or international phone number for matching against runners who have explicitly enabled contact discovery. Selected identifiers are processed for that request; we do not build or retain an address-book database, upload all contacts, or send invitations automatically. Only verified account identifiers can match; Apple hidden email may not match your contact.
- Location and running: with permission, GPS routes, distance, pace, run times and optional motion/step information. Active runs can continue recording when the app is in the background. Nearby discovery and live visibility use location according to your choices.
- Social content: posts, selected photos, captions, likes, comments and replies, unread notification status, friend/block relationships, shared routes, consented group links and reports.
- Events and rewards: registrations, check-in/return status and offer redemptions. Participation and any organizer-facing live sharing are separate choices. Organizers may see the information necessary to manage the event and your enabled sharing; this is not an emergency monitoring service.
- Technical information: app/OS version, platform, language, push token if notifications are enabled, product interactions and diagnostics. Product events can be linked to your user ID. Earlier test builds may have uploaded GPS diagnostics with separate consent; production releases do not offer that field-test upload feature.
Friend discovery and event contact choices
Username and nickname discovery, friend suggestions and contact matching are optional. Existing accounts are not automatically opted into discovery. Requests require recipient acceptance; blocking withdraws the relationship. Public profile settings expose only routes you deliberately share as public, and do not publish your private records, gallery or live position.
You may provide an optional event-registration email. It stays with XVVX / Techcon Solution Limited and is not given to event clients. Consent to XVVX running-event news, offers and promotional emails is separate, optional and off by default. Withdraw an individual event email consent in the event page, or all marketing consent in Me → Privacy → Stop XVVX promotional emails. Registration-only contact records are removed within the scheduled cleanup after 90 days from the event end; independently opted-in marketing contact records remain until withdrawal or account deletion. Every promotional email we send must also provide a way to unsubscribe. App push reminders can be turned off per event or in device notification settings.
Your location and photos
Saving a run does not automatically publish its full route or diary. Friends posts, publicly recommended routes and live visibility have separate controls. Ghost mode hides your presence from other runners; it does not stop your own recording. Shared routes mask at least 500 metres around both endpoints, including revisits; short or looping routes may be unsuitable for sharing. Your configurable home privacy zone can reduce the precision of shared live locations. These controls do not make recognizable photo content anonymous.
We access photos you select and the camera only when you use that feature. Available capture times may be used for a diary association you confirm. Photos may reveal places or people even when a shared run summary omits location fields. Do not share information you want to keep private. Logos are added to separate exported share images, not your original photo. Private photo access uses short-lived links; withdrawing sharing prevents new links, while previously issued links can remain usable until they expire. Copies saved by other people or posted to another social service must be removed there.
Safety and moderation
Use in-app reporting and blocking to flag harmful content or unwanted contact. We review reports and may restrict content or accounts. Moderators can access reported content needed to resolve a report. We do not currently send your photos to a separate AI provider for moderation. A saved private diary is not automatically published.
Service providers and purposes
- Supabase: authentication, database, private media storage and server functions. Our project is hosted in Singapore.
- Apple and Google: account authentication and the information you authorize them to share.
- Mapbox: maps and related service operation. Its SDK may process location, device/network information, usage events and randomly generated identifiers for functionality, billing, security and map improvement/analytics. We do not send Mapbox your XVVX account name or email. Use the map information control for telemetry options. Mapbox Privacy Policy.
- Expo: app update distribution where enabled and push-notification delivery, including optional social activity notifications and 7-, 3- and 1-day event reminders. Google Firebase Cloud Messaging: delivery of Android push notifications using an app-installation identifier and push token. XVVX uses Supabase for app authentication and data; this push service does not move your app account or running records to Firebase Authentication. Cloudflare: website hosting and security.
We use information to provide the app, secure accounts, prevent abuse, respond to support and improve reliability. We do not sell your personal information or provide your location to advertisers. XVVX has no paid advertising placements. A social app you choose from the system share menu processes the information you choose to send under its own policy.
Retention and deletion
Account information, runs and chosen content are retained while needed for your account and the service. You can remove shared content or request permanent account deletion in Me → Delete account. A network or provider failure can require a retry; a failed attempt is not confirmation that deletion finished.
Deletion requests cover your account/profile, runs, uploaded content and associated social/event records. If you cannot complete deletion in the app or content remains accessible after a request, contact support so we can investigate and complete removal. We may retain limited, minimized records where required for legal obligations, security or abuse handling; they are not used to continue showing your profile or runs. Provider backup, security-log and external-platform retention may differ from active app data. We do not promise an unverified fixed backup-deletion period. If you cannot access the app, use our deletion request page.
Your choices and rights
You can change profile information, visibility and sharing choices, block/report users, and request access, correction or deletion by contacting support. Revoke location, motion, camera, photos or notification permission in device settings. Features relying on that permission may become unavailable; you can still decline a permission. XVVX is intended for people aged 16 or older.
Public event spectator links
For an event that offers public broadcasting, the updated registration flow explains public sharing before you choose “Join & share live publicly”. Your nickname and optional bib appear on that event’s spectator page. During the event, while you record a run, anyone with its link can see your approximate position, distance, running time and pace, including reports sent while your screen is locked. The link can be shared before the event; it does not start GPS or reveal a pre-event location. Your email, phone number, account identifier, private photos and private run history are not included.
Existing registrations are not automatically made public. You can stop public sharing without cancelling registration; Ghost mode, withdrawal and cancellation prevent further public reports. Old reports are marked unavailable when stale, and event closure hides positions and metrics. Organizers can disable or replace a spectator link. This is not an emergency or rescue monitoring service. Other people may save or screenshot information you deliberately make public; disabling a link cannot recall those copies.
Changes
We update this page when our practices change. We will provide an additional notice or obtain consent where required for a material change.
