Privacy

Account: your sign-in email, plus the name, photo, title and short bio you add in onboarding. If you sign in with Google or Apple, we receive your email and name from them.

Room: your room link name (slug), an access key used to open the room, and — if you set one — a hashed version of your room password. We never store the password itself in plain text.

Run data: while you are live, position, pace and distance samples. Heart rate and cadence only if you connect them and turn them on.

Courses: GPX files you or our admins upload, used to draw the route and elevation.

Room traffic: how many people have a room open at the same time, so we can enforce viewer limits. These records are short-lived and are not tied to an identity.

SOS: when you hold SOS we record the time you started and cancelled it, so viewers can see it. Your emergency contact's name and number stay on your phone and are never sent to us.

Anyone holding your room link sees your photo, name, title, bio and next race. While you are live they also see your position, pace and distance on the map. When you are not live they see only a “not live right now” message. Viewers do not need an account and we do not store anything about them. If you set a room password, they need it too.

To show your run live, to render your room page, to protect password- and link-only rooms, and to stop abuse (rate limits, viewer caps, moderation of race requests and uploaded courses). We do not sell your data or use it for advertising.

Nothing is broadcast unless you start a session in your room. Stop or pause the session and the live map stops updating for viewers. Location is the most sensitive thing we handle, so sharing it is always an action you take, never a default.

Our database and file storage are hosted by Supabase. If you sign in with Google or Apple, that provider handles the sign-in itself. Map tiles are loaded by your browser from the map provider when a course or live map is shown. Those parties process data only to deliver the service to us and to you.

Your profile and room stay until you delete them. Live run samples are kept only as long as needed to show the run and its recent history. Viewer-traffic records expire on their own. Ask us and we will delete your account, room and uploaded files.

Every table is access-restricted so a user can only read or write their own rows. Passwords are hashed. Room access keys and your secret credentials are never exposed to other users. Uploaded photos and GPX files sit in private storage buckets and are only handed out through time-limited links.

You can see, correct, export or delete your data, and withdraw location sharing at any time by stopping your session. Write to berei.gabor1@gmail.com and we will act on the request. If you are in the EU or UK you also have the usual GDPR rights, including complaining to your data-protection authority.

Cheerzone is for people 16 and over. If we learn a child under 16 has an account with a room that broadcasts location, we disable it.

If this page changes in a way that matters to you, we will say so in the app. The date above always shows the current version.