Privacy Policy

This policy explains what PangoRun collects when you use the app or join the waitlist on our website, why, and the choices you have. PangoRun is operated by Rojen Wairokpam and Ningthem Longjam, based in India. "PangoRun," "we," or "us" means the two of us, operating PangoRun together.

Account information. The name and avatar you set, and — if you create an account — your email address and a unique profile code used to identify you to friends. Signing in with Google or Meta (when enabled) shares the basic profile info those providers give us.

Location. With your permission, PangoRun reads your GPS location while you run to record distance, pace and your route, and — if you grant background location — while the app is backgrounded so a run keeps recording with the screen off. Location is never collected outside an active run.

Motion & fitness data. With your permission, the device's step counter cross-checks GPS distance and shows cadence during a run.

Apple Health & Health Connect. If you turn on health sync — during onboarding or in Settings — each finished run is saved to your device's health store as a workout, including its distance, duration, calories and step count. This is write-only: PangoRun never reads anything back from Apple Health or Health Connect, and requests only permission to write. Health sync is off unless you turn it on, the data written stays on your device rather than being sent to our servers, and you can revoke access at any time in the Apple Health or Health Connect app. Workouts already written remain in your health store, where you can delete them yourself.

Camera & photos. The camera is used only to scan a friend's QR code to add them — no photos are captured or stored from a scan. With your permission, you can pick a photo from your library to attach to a shared run card or a feed post, and save a generated run card back to your photo library.

Social content. If you have an account, each finished run is posted to your activity feed automatically — its distance, time, pace and a simplified version of your route — where the friends you've connected with can see it and react. Nobody else can: a run post is readable only by you and your friends. Also included are photos and captions you add, comments and kudos, chat messages with friends, your friend list, and any route Segment you create — a Segment is shared with the people you race it against, by design.

Purchases. If you subscribe to Premium, our billing processor (RevenueCat) shares your purchase and subscription status with us — PangoRun never receives your payment card details directly.

Diagnostics. If crash reporting is enabled on your build, basic crash and error information is sent to our error-tracking service to help us fix bugs — not used for advertising or profiling.

If you join the waitlist on our website, we collect your email address so we can tell you once — when PangoRun launches. We also record the campaign tags in the link you arrived through (so we know which reel or platform sent you), the country your request came from, and — only if you tap them — which phone you use and which feature you're most excited about.

We use this to send that launch email and to gauge how many people want PangoRun and where they found us. Waitlist emails are stored in a Supabase project kept separate from the app's, are never sold, and are never used for advertising. If you never create an account, we never connect your waitlist email to any app data. Email us and we'll delete it.

To run the app's core features: recording and displaying your runs, showing your streak and progress, connecting you with friends, powering multiplayer races and rooms, moderating reported content, processing subscription purchases, and fixing bugs. We don't use your data to build advertising profiles, and we don't sell your personal information.

After some runs, PangoRun may show you a promo for one of its own features — Ghost Mode, the weekly league, the Couch-to-5K journey, or Premium. These are written by us and shipped inside the app: there is no advertising network, no ad SDK, and no information about you is sent anywhere to select or measure them. Which promo you see is decided on your device from what you already have set up.

We limit how often they can appear, never show them to new runners or during a celebration, and Premium subscribers never see them at all.

PangoRun relies on a small number of service providers to work, each only for its specific purpose: Supabase (account storage, sync, the social/multiplayer backend, and waitlist emails), Vercel (website hosting), MapTiler (map tiles), OpenRouteService and OSRM (route and road-snap directions), Overpass/OpenStreetMap (road-safety data), RevenueCat (subscription billing), Sentry (crash diagnostics), and — only if you choose to sign in that way — Google or Meta for authentication. Each processes only the data needed for its role and is bound by its own privacy terms.

You can get a copy of your data at any time from Settings → Privacy → Export my data, and permanently delete your account and everything tied to it from Settings → Privacy → Delete account (or see Data deletion instructions under Settings → Support). Deleted data is removed from our systems; some information may persist briefly in backups before they naturally expire.

PangoRun asks during onboarding that you confirm you're 13 or older, and the app is not directed at children under 13. We don't knowingly collect personal information from anyone under 13; if you believe a child has created an account, contact us and we'll remove it.

We use industry-standard measures (encrypted connections, access-controlled backend storage) to protect your information, but no method of transmission or storage is perfectly secure, and we can't guarantee absolute security.

If this policy changes materially, we'll update the date at the top of this page and, where appropriate, notify you in the app.

Questions about this policy or your data? Reach us any time at pangorun@gmail.com.