Privacy policy

Last updated: 3 November 2026

This policy explains what personal data the Run&Win app and the website runandwin.online process, why, for how long, and what rights you have. It follows the Law on Personal Data Protection of the Republic of North Macedonia (aligned with the GDPR).

1. Who is responsible

Data controller: Vancho Gjorgjiev, North Macedonia. Contact for everything about privacy: info@runandwin.online.

2. What data we collect

• Account: email (for login and codes), first name (public), last name (optional, private), birth year (only to check you are 16+, private), city and colour.
• Login: your PIN and logins (tokens) are stored only as protected hashes, never in readable form.
• Runs: while you run, the GPS route is only in your phone's memory. Afterwards it is sent to the server, which uses it only to work out the cells you captured and does not keep it. Only totals are kept: times, distance, duration, mode (walking/bike), cells captured, calories and short anti-cheat counts (no coordinates).
• Territory: the cells you hold on the map (hexagons of about 40 m).
• Home zone (optional): the point you chose, on the server only; nobody else sees it.
• Photos (optional): selfie, shoes and bike stay on your phone. Only if you turn on "Show my photos" are they sent to the server, cleaned of hidden data (e.g. the camera's location).
• Weight (optional): only for your own calories, private.
• Reports: when you report a player: the reason, your description, the mode, the city and the average speed.
• IP address: used at the moment of a request to check that registration and runs come from North Macedonia. To limit attempts (protection from attacks) only a protected (coded) fingerprint of it is kept, for about 2 hours at most, and it never goes into the database backups. We keep no visit logs.

3. Why (legal basis)

• To run the game and your account (contract: the terms of use).
• For security, protection from cheating and abuse, and handling reports (legitimate interest).
• Public photos and weight: only with your consent, which you can withdraw at any time in Settings.

4. What other players see

Your first name, colour, city, level and rank, your territory on the map and your runs as totals (total distance, time, number of runs, a calorie estimate for 70 kg). They see your new territory and runs only after 3 hours, so nobody can tell where you are right now; "last active" is a date only. If you turn photos on, they see those too. They never see your email, last name, birth year, weight, home zone or GPS route.

5. Who we share with

We don't sell data or use it for advertising. The app has no ads and no third-party tracking or analytics. Processors who help us: Contabo GmbH (server, Germany, EU) and Namecheap (email for the codes, USA). To run the service and handle reports, admins see your account details (email, first and last name, birth year, city), run totals and anti-cheat checks, measures and reports, and photos if they are public. They never see your GPS route, home zone or weight. The emails with codes are sent by Namecheap in the USA (only your address and name).

6. How long

• As long as your account exists. An account that is never confirmed with a code is deleted after 24 hours.
• When you delete your account, your data is deleted from the server at once. Backups (encrypted) and the hosting's snapshots of the server keep it for at most 30 days; then it is deleted.
• Photos are deleted from the server as soon as you turn them off.

7. Security

All traffic is encrypted (HTTPS). The login on your phone is kept in Android's secure storage (Keystore). Backups are encrypted (the hosting's snapshots of the whole server are not, but they are kept for at most 30 days). The admin area needs a password and a code from an authenticator app.

8. Your rights

You have the right to access, correct, delete, restrict and move your data, to object, and to withdraw consent. You delete your account yourself in the app (how); for anything else write to info@runandwin.online from your account's email. We answer within 30 days. You can complain to the Personal Data Protection Agency (dzlp.mk).

9. Children

The app is only for people aged 16 and over.

10. Phone permissions

Location (to record a run, only while the run lasts, with a notification on screen), camera (for a selfie, only when you choose) and notifications. No permission is used in the background outside a run.

11. Changes

If we change this policy, the new version will be on this page with a new date; for important changes we will tell you in the app.