Privacy Policy

1. Information We Collect

We collect information you provide directly or that is collected automatically when using our app:

• Personal Information: name, email address, phone number, date of birth
• Account & Profile Data: avatar, preferred language, preferences, loyalty points balance
• Transaction Data: match and event tickets, bookings, donations, store purchases
• Device Information & Push Tokens: device model, operating system, IP address, push notification tokens
• Walking Step Data (Optional): daily step totals only when you explicitly opt-in to walking challenges — we never collect location data, GPS trails, workout routes, or other health/medical data
• Camera Data (ticket scanning only) — images are processed on-device and never stored or sent to our servers

2. How We Use Your Information

We use the collected information for the following operational purposes:

• Create and manage your account and deliver SMS one-time passwords (OTP)
• Process ticket bookings, store purchases, donations, and digital delivery
• Administer loyalty points, walking challenge milestones, and reward fulfillment
• Send push notifications and challenge reminders for enrolled activities
• Analyze service performance, prevent fraud, and maintain security

3. Optional Background Step Synchronization

Participation in walking challenges and background step synchronization is strictly optional and built with security-first privacy principles (FR-003, FR-006, FR-009, FR-036):

• Disabled by Default: Background step synchronization is turned off by default and requires your explicit, member-controlled opt-in consent in walking challenge settings.
• Daily Step Totals Only: When enabled, the app reads only daily step totals for authorized challenge dates (bounded to at most 7 days) from Apple Health on iOS or Health Connect on Android.
• No Location or Other Health Data: We never collect location data, GPS routes, heart rate, biometric metrics, or unrelated health information.
• Full Foreground Usability: You can participate in walking challenges and manually sync steps upon opening the app without ever enabling background synchronization.

4. Platform-Controlled Timing & Best-Effort Execution

Background synchronization operates strictly within operating system scheduling and power management constraints (FR-004, FR-008, FR-211, FR-036):

• Best-Effort Delivery: Background synchronization operates on a best-effort basis without continuous background polling or real-time sync promises, subject to device battery levels and operating system scheduling.
• iOS Roughly Hourly at Best: On iOS, background step updates are scheduled roughly hourly at best according to Apple battery management policies.
• Android Battery Optimization: On Android, background execution frequency depends on device battery saver policies and Health Connect availability.
• Foreground Catch-Up: Timing is not guaranteed; any remaining steps sync automatically when you open the app in the foreground.

5. Walking Challenge Ending Reminders

For members participating in active walking challenges, we provide server-scheduled reminders to help you track progress (FR-016, FR-019, FR-024, FR-026, FR-036):

• Enrolled Challenge Reminders: Our servers schedule ending reminders (at 10:00 Asia/Riyadh) before a challenge activity window closes for enrolled participants.
• Best-Effort Delivery: Push notifications are delivered on a best-effort basis without guaranteed instantaneous arrival.
• Privacy-Protected Content: Reminder push notifications never contain step counts, health metrics, points balances, or coupon codes.
• Preference Controls: You can toggle walking challenge reminders at any time in Notification Preferences, and disabling global notifications pauses all reminders.

6. Non-Advertising Use & Milestone Rewards Framing

We maintain strict restrictions on health and walking data utilization (FR-036, FR-038):

• Zero Advertising or Profiling: Walking activity data, step counts, and notifications are never used for advertising, third-party marketing, data brokers, credit scoring, or behavioral profiling.
• Personal Fitness Milestones: Challenge rewards, digital badges, and loyalty points are framed exclusively as earned personal physical fitness milestones and do not constitute games of chance, lotteries, or wagering.

7. Information Sharing and Third Parties

We do not sell your personal information or walking data. We share information only with authorized service providers to the extent necessary to operate the application:

• Push notification and analytics service providers
• Certified payment gateways for secure payment processing
• SMS gateway providers for verification code delivery
• Competent government and regulatory authorities when officially required by applicable Saudi laws

8. Data Security

We implement robust technical and organizational safeguards, including HTTPS encryption in transit, secure hardware-backed token storage (iOS Keychain and Android Keystore), and strict role-based access controls.

9. Your Rights, Revocation, and Account Deletion

Under the Saudi Personal Data Protection Law (PDPL) regulated by SDAIA, you have the following rights (FR-014, FR-036, FR-037):

• Access & Data Export: Request access to your personal data; exported records include consent facts and status history without raw device telemetry.
• Revocation of Consent: Disable background sync at any time in app walking settings, or revoke health permissions in device settings, immediately halting background queries.
• Account Deletion: Request account deletion in app settings; after a 30-day grace period, personal profile data and walking consent records are permanently deleted within 90 days, while legally required audit logs are retained in anonymized form.
• Rectification & Objection: Correct inaccurate data and object to non-essential data processing.
• Lodge a Complaint: File a complaint with the Saudi Data and AI Authority (SDAIA).

10. Device Identifiers and Tracking

We use device identifiers and push notification tokens strictly for app functionality. We do not use third-party advertising tracking cookies. Push notifications can be managed via device settings.

11. Children's Privacy

Our service is not directed to children under 13. We do not knowingly collect personal data from children under 13. For users between 13 and 18, parental or guardian consent is required.

12. Data Retention

We retain your data while your account remains active. Upon account deletion, personal data and walking sync consent records are permanently purged, retaining only legally mandated financial and security audit records.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material updates will be communicated through the app with a revised "Last Updated" date. Continued use constitutes acceptance of updated terms.

14. Contact Us

If you have questions regarding this Privacy Policy or wish to exercise your data rights, please contact our Data Protection Office: