Privacy Policy

Flowtr is operated from Portugal. For privacy questions or legal requests, contact support@flowtr.app. We reply by email to formal requests, including the rights described below.

• Account — email, name or nickname and, if you use Google or Apple sign-in, that account identity.
• Precise location (GPS) — collected during runs while the app is in use. On Android, a foreground service displays a visible notification. We do not collect background location outside runs.
• Routes and territories — the path of your runs and the territory polygons you claim are stored with your account.
• Profile photo — if you choose to upload one.
• Game content — nicknames, challenge names, reports and blocks you submit.
• Usage and diagnostics — product events, session replay with all text and images masked, crash and performance reports, device identifiers and notification tokens. Analytics, diagnostics and replay are collected only if you enable them.

The territory polygons you claim are visible to other players on the shared map, associated with your nickname, colour and profile photo. Rankings and challenges show your nickname and game statistics. Keep this in mind before running in places you do not want associated with you, such as around your home.

If you share a run video, it is generated on our AWS servers from that run and remains available at a public URL while it exists. Anyone with the link can view it. You can request removal by email.

• Provide the service (contract) — record runs, calculate territories, rankings, challenges and sharing.
• Security and anti-cheat (legitimate interest) — server-side run validation, reports and blocks.
• Improve the product (consent) — analytics, diagnostics and masked session replay. These are off by default and can be changed in Settings.
• Push notifications (system permission) — you can disable them in device settings.

The website uses Vercel for hosting, aggregate technical metrics and performance monitoring. We do not use advertising cookies or PostHog on the site. If you join the launch list, Resend stores your email so we can send essential availability updates. You can ask us to remove it at any time.

We use Google Firebase for accounts, backend, notifications, crash reporting and analytics; PostHog EU Cloud for product analytics and masked session replay; Mapbox for maps; AWS Lambda and S3 for run-video generation; Cloudinary for profile photos; OpenStreetMap Foundation Nominatim for reverse geocoding; Google and Apple for sign-in; and Vercel and Resend for the website and launch list. Providers process data for us under data-protection terms. Transfers outside the EU rely on applicable safeguards, including European Commission standard contractual clauses where required.

We keep account, run and territory data while your account is active. Product analytics are kept for up to 12 months; masked session replays for up to 30 days; crash reports for up to 90 days; launch-list emails until you unsubscribe or ask for deletion. Run videos remain available until they are automatically removed or you request removal.

You can delete your account in the app. This removes access and starts deletion from Flowtr systems and relevant providers. Limited records may be retained where required for security, fraud prevention or legal obligations.

Under the GDPR, you may request access, correction, deletion, restriction, portability or objection, and withdraw consent at any time without affecting prior lawful processing. Contact support@flowtr.app. You may also lodge a complaint with Portugal's data-protection authority, the CNPD.

Flowtr is intended for people aged 16 or over. If we discover an account belonging to someone under 16, we will delete it.

We may update this policy as the product changes. For material changes, we will notify you in the app or by email before they take effect.