This policy explains what Aretos collects, why, and what control you have over it. Aretos is a 1v1 running duel app for runners in Köln and Düsseldorf.
Data controller: [Legal name — to be added before launch]
Email: hello@aretos.run
Account info: email address, the runner name and city you set.
Run activity: distance, duration, pace, and activity type for each run you log or track.
Run shape — not your real location: when you track a GPS run, we convert your route into an abstract shape — distances and turns from your starting point, rotated by a random angle — before it ever leaves your device. Your real GPS coordinates are never sent to our servers or stored. We cannot reconstruct where a run actually happened from this data.
Health data (optional): if you connect Apple Health, we read your running workouts to sync them, and write completed GPS runs back to Health. This requires your explicit permission via iOS, granted through a dedicated consent screen before the system dialog appears.
Apple Music (optional): if you connect Apple Music, we read the track titles you played during a run so your opponent can see what you ran to.
Motion & location (during an active run only): while you are actively recording a GPS run, we use your location to measure distance and motion data to verify steps were not faked (e.g. by driving). We do not track your location when you are not running.
Duel & social data: challenges you create or join, duel results, chat messages with opponents, blocks and reports you file.
In-app analytics: basic usage events (e.g. screens viewed) tied to your account, kept for at most 90 days and then automatically deleted.
Push notification token: to deliver challenge alerts and duel results.
Server logs: IP address and timestamps, retained for 14 days for security purposes, then automatically deleted.
| Processing purpose | Legal basis |
|---|---|
| Running the core service — matching duels, scoring runs, showing results | Contract performance (Art. 6(1)(b) GDPR) |
| Preventing cheating and abuse, enforcing community guidelines | Legitimate interest (Art. 6(1)(f) GDPR) |
| Apple Health, Apple Music, push notifications, GPS tracking | Your consent (Art. 6(1)(a) GDPR) — withdrawable at any time via iOS Settings |
| Health data specifically (GDPR Art. 9 — special category) | Explicit consent via dedicated in-app screen before the iOS permission dialog |
Supabase Inc., USA — database and hosting provider, acting as a processor on our behalf. Certified under the EU-US Data Privacy Framework. A Data Processing Agreement (DPA) is in place. supabase.com/privacy
For HealthKit, Apple Music, and push notifications. Your device token is transmitted to Apple solely to deliver notifications. apple.com/privacy
Your runner name, city, run totals, and pace are visible to the person you are in a duel with. Your real GPS location is never shared — only the anonymised route shape described in section 2.
We do not sell your data and do not share it with advertisers.
You have the right to access and download a copy of your data, correct inaccurate data, delete your account and all associated data, object to or withdraw consent for optional processing, and lodge a complaint with your local supervisory authority.
Go to Profile → Settings → Delete Account in the app. In-app deletion is immediate and permanent. If you no longer have the app, use the web deletion request form or email hello@aretos.run with the subject "Delete my account". Email requests are processed within 30 days.
Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (LDI NRW)
ldi.nrw.de
Aretos is not directed at children under 16. We do not knowingly collect data from anyone under that age. If you believe a child under 16 has created an account, email hello@aretos.run and we will delete it promptly.
Data is encrypted in transit. Access to our database is restricted. Account deletion is permanent and irreversible. Real GPS coordinates never reach our servers in the first place.
Material changes will be notified via the email address on your account before they take effect. The date at the top of this page always reflects the most recent version.
Questions about this policy or your data: hello@aretos.run