Privacy Policy

• We do not store your email address or real name. New accounts get a random name like “Runner123456”.
• We store the GPS track of your runs. Your runs are private until you choose to share them.
• Your username, profile picture and leaderboard positions are public. Don’t use your real name or photo if you don’t want to.
• We never sell data and use no ads or tracking.
• You can download or delete everything in the app under Profile.

The data controller for Flagchase is Eksire AS, organisation number 821 482 372, Kirkegata 37, 4006 Stavanger. Send privacy questions to personvern@flagchase.com.

You can use Flagchase in four ways:

• As a guest. We create an account with no name or email. It only exists on your phone. If you delete the app without linking Google or Apple, you cannot get back into it.
• With Google or Apple. Google or Apple confirms who you are. We only store an internal ID from them, not your email or name.
• With Strava. We store your Strava ID and the profile details Strava sends us (first name, last name, username and a link to your profile picture) to show which Strava account is connected. Other users cannot see these.

Every new account gets a random name like “Runner123456”. You can change your name and username yourself. For each account we store the display name, username, profile picture if you add one, how you sign in and when the account was created. Your sign-in is stored as an encrypted key that lasts 30 days after you last used the app.

• When you look at the map, the app uses your position to show where you are and find routes nearby. The position is sent to us with the search but is not stored.
• During a run, the app records your GPS track (position, accuracy and time), also while the screen is off. We store the track, the start point and where you were when you scanned each checkpoint. We use it to show your run, check that checkpoints were really visited and prevent cheating.
• After the run, no location is collected in the background.
• When you scan a checkpoint with good GPS accuracy, we store the position to make the checkpoint’s location more precise. Only you can see your own location reports.

Your runs are private. If you share a run, other signed-in users see the track without the first and last 200 metres and without times, so it does not show where you live or go to school. Only you can download the full track as a GPX file.

This is visible to anyone, even without signing in:

• Your profile: display name, username, profile picture, when you joined, and how many runs, routes and podium places you have.
• Who you follow and who follows you.
• Your name and time on the leaderboard of routes you have run.
• Routes you have published and runs you have chosen to share.

Others can find you by searching for your display name or username. The creator of a route is notified when someone finishes it. You can block and report other users. There is currently no setting to hide your profile or stay off leaderboards, so use a nickname if you don’t want to appear under your real name.

You must be at least 13 years old to create an account on your own. Children under 13 may only use Flagchase with a parent’s consent, or in an activity a school or club is responsible for. We do not ask for age or collect dates of birth.

For parents: Your child does not need to give a name or email. We recommend a guest account or a nickname, and not uploading a photo. You can ask to see or delete your child’s data by writing to personvern@flagchase.com.

For teachers and coaches: Use private routes for your class, so the checkpoints do not appear on the public map. Pupils can run as guests without signing in. Their runs are private, so you cannot see a pupil’s GPS track unless the pupil shares the run. When a school uses Flagchase in teaching, the school or municipality decides whether pupils should use the app, and [legal review: the school’s role and any data processing agreement].

• To provide the service you asked for: account, runs, results, leaderboards and followers (contract, GDPR art. 6(1)(b)).
• To prevent cheating, abuse and security problems (legitimate interest, art. 6(1)(f)).
• Notifications, Strava and profile pictures only when you turn them on (consent, art. 6(1)(a)). You can withdraw it at any time.

[legal review of the legal bases]

We never sell data. The app has no ads and no analytics tools, and this website uses no tracking cookies. We use these services to run Flagchase:

• Encore Cloud hosts the servers and database ([region to be added]).
• Google and Apple confirm your sign-in if you use them.
• Strava, only if you connect it. We only upload runs when you ask us to, and do not read your other activities. When you disconnect, we revoke access and delete the keys.
• Firebase Cloud Messaging (Google) delivers notifications. We store a notification key for your phone.
• Map tiles come from OpenStreetMap and our own map server (tiles.flagchase.com). They see your IP address and the map area you view.
• Google Fonts may supply fonts to the app and then sees your IP address.

We only disclose data to authorities when the law requires it.

• Your account, runs, GPS tracks and results are kept until you delete your account.
• You can delete abandoned and invalid runs yourself. Runs that are never finished are closed automatically after 24 hours.
• Your sign-in expires 30 days after you last used the app.
• Guest accounts are not deleted automatically. [decision: delete inactive accounts after a fixed period]

When you delete your account, we delete your profile, picture, runs, GPS tracks, results, followers, notifications and Strava connection. Private routes and drafts are deleted. Routes you have published stay so others can still run them, but are no longer linked to you.

You have the right to access, correct, delete and port your data, to restrict or object to its processing, and to withdraw consent.

• Download your data: Profile → menu → Export My Data.
• Delete your account: Profile → menu → Delete account.
• Anything else: write to personvern@flagchase.com. Parents can do this on behalf of their child.

You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or the authority where you live.

If we change this policy in a way that matters to you, we will tell you in the app. This version applies from October 3, 2026.