Privacy policy
1. Who is responsible for your data
StrideRaid is published by Alex Chen, the controller of your data. Contact: contact@strideraid.app.
2. What we collect, and why
- Email address: to sign you in (one-time code). Legal basis: the contract (terms of use).
- Username, country, confirmation that you are 16 or older: game profile, leaderboard, minimum age. Legal basis: the contract.
- Your runs, read from Apple Health: date and time, duration, total distance, distance and heart rate summarised minute by minute, app and device model that recorded them, whether manually entered, whether indoors. To compute your damage to the boss and check that runs are real (anti-cheat). Legal basis: your explicit consent (health data, article 9 GDPR), asked separately and withdrawable at any time.
- Your damage, ranks and badges: to run the game. Legal basis: the contract.
- Reports sent, disputes: to fight cheating. Legal basis: our legitimate interest in a fair game.
- History of your consents: to prove your agreement. Legal basis: legal obligation.
We never read your GPS route, your other sports activities or any other Health data. We never write anything to Health. Your notification settings stay on your phone.
3. What we do not do
- No advertising, no sale of data.
- Your health data is never used for marketing or advertising and never shared for those purposes.
- No health data is stored in iCloud.
- No health data in our technical tools (logs, error tracking, analytics).
4. Who sees what
- Other players see your public profile: username, country flag, badges, damage, bosses fought and defeated, best rank, weekly streak. Never your exact kilometres, number of runs or run details. Your damage and distance badges (10 km, 50 km…) are computed from your runs and give an idea of the distance you ran: your consent covers their public display.
- The StrideRaid team (administrators) may look at the details of a run checked by hand: suspicious, reported by players, in a week's top 10, or disputed by you.
5. Run checks (anti-cheat)
Each run is checked automatically (speed, consistency, manual entry, source app…). It may be rejected or put on hold for a human check; you always see its status and the reason, and you can dispute a rejected run within 7 days: a team member reviews it. These decisions only have effects within the game.
In case of repeated cheating, the team may limit an account in the game (its runs no longer count against the boss and it no longer appears in other players' leaderboards). You are informed in the app, with the reason and how to dispute it (EU Digital Services Act, article 17).
6. Where your data is, and who helps us
- Supabase: database and account hosting, in the European Union (Frankfurt, Germany).
- Resend: sending sign-in emails (your email address only), in the United States; transfer covered by the EU–US Data Privacy Framework (Resend is certified) and the European Commission's standard contractual clauses.
- Apple: reading Health and notifications, on your phone.
- Cloudflare: the strideraid.app website and forwarding of messages sent to contact@strideraid.app, in the United States; transfer covered by the EU–US Data Privacy Framework.
- Google (Gmail): receiving messages sent to contact@strideraid.app.
- Sentry: app error reports (device model and system, app version, technical details of the error; no IP address, identity or health data), stored in the European Union; US company certified under the Data Privacy Framework.
Each provider is bound by a data processing agreement (article 28 GDPR), except Google: messages sent to contact@strideraid.app arrive in a standard Gmail inbox, subject to Google's terms.
7. How long
- Run details (minute by minute, heart rate, device): 24 months, then deleted automatically. Date, distance and status remain, as they support your badges and leaderboard history.
- Account and profile: as long as your account exists.
- Account deletion: everything is deleted immediately (profile, consents, runs, damage, reports). Hit points already taken from bosses are not recalculated.
- Backups: a full, encrypted copy of the database, kept for 4 weeks; deleted data therefore also disappears from backups within 4 weeks at most.
8. Your rights
From the app (Profile › Settings):
- Access and portability: "Export my data" (full file).
- Rectification: country; username (under the game's conditions).
- Withdrawing health consent: reading stops and your runs are deleted from the server; your account remains.
- Erasing a run: long-press the run in the Runs tab › "Delete": its details (minute by minute, heart rate, device) are erased; the date, distance and damage already dealt remain.
- Erasure: "Delete my account", immediate.
For any other request (objection, restriction, question): contact@strideraid.app. You may also lodge a complaint with your data protection authority (in France, the CNIL: www.cnil.fr).
9. Minimum age
StrideRaid is reserved for people aged 16 or older, confirmed at sign-up.
10. Changes
Any significant change will be shown to you in the app; if it concerns your health data, your consent will be asked again.
Last updated: 27 September 2026.