Privacy Policy

1. Personal Data We Collect

① Account: email, nickname/name, social login (Kakao/Google/Apple) identifier and linkage info. ② Profile: gender, age, weight, nationality/region, affiliation (gym), bio, profile/banner image (optional). ③ Activity: workout records and verification-video links, feed/comments/reviews, map pins, achievements, following relationships. ④ Payments: verified transaction identifiers and purchase history provided by the store (sensitive payment data such as card numbers is not collected or stored by the Company). ⑤ Device/technical: device region setting (default nationality), app usage logs, etc. ⑥ Health & fitness data (optional): only if you turn on health sync, we read step count, heart rate, and workout (running) records with their routes (see 2-2). ⑦ Location (optional): precise and approximate location, collected with your permission (see 2-1). ⑧ Gym memberships: membership type/name at a physical gym, start/end dates, total and remaining visit counts, hold periods, membership enrollment/renewal/hold requests and their status. ⑨ Class bookings and attendance: account, gym, class, booking and attendance identifiers; class dates/times; booking/cancellation records and timestamps; per-class check-in timestamps; membership visit deductions and remaining counts.

2. Purpose of Use

Member identification/authentication; providing record, ranking, social, and map features; managing physical gym memberships, checking class eligibility, processing bookings, cancellations and attendance, and providing related notifications; processing payments, subscriptions, and coupons; responding to fraud and sanctions; handling customer inquiries; service improvement and statistics.

2-1. Collection and Use of Location Data

① Run tracking: location data is collected to record your running route, distance and pace. While a run is being recorded, location data is collected even when the screen is off or you are using other apps. This collection happens only after you start a run, stops as soon as you finish the run, and is not used for any purpose other than run tracking. The app does not request "Allow all the time" (background location) access. During a run, Android shows a notification that location is being collected, and iOS shows its location-in-use indicator. ② Nearby & map features: while you use the app, your current location is used to show nearby gyms and map pins, center the map, and find location-based game rooms. ③ Country detection: your current location is used to determine your country for country rankings and flag achievements; only the detected country is saved to your profile. ④ Storage: run route coordinates are stored on your device (a few recent runs). If you post a run to the feed, an image with the route drawn on it is stored as the post. Coordinates of map pins you register and location-based game rooms you create are stored on our servers. ⑤ Sharing: coordinates may be sent to Google Maps Platform to render run-route map images and for maps/geocoding. Location data is never used for advertising or marketing, and is never sold. ⑥ Opting out: location access is optional; you can use the service except location features without it. You can change or revoke the permission at any time in your device settings. ⑦ GPS check-in: when you request a gym check-in, your current coordinates and location accuracy are sent to the Supabase server to verify that you are within the allowed radius of the gym. Raw GPS coordinates are not stored in the attendance record. Account, gym and class identifiers, check-in date/time, distance from the gym (meters), and location accuracy (meters) are stored as attendance information.

2-2. Health & Fitness Data and Wearable (Watch) Integration

① How we connect: on iOS through Apple Health (HealthKit), and on Android through Health Connect. Data that wearables and their apps—such as Apple Watch, Galaxy Watch (Samsung Health) and Garmin (Garmin Connect)—write to Apple Health or Health Connect is read the same way. We do not connect directly to device makers’ server APIs (such as Garmin’s); we only read, on your device, data synced to Apple Health or Health Connect on your phone. On Android, workout routes recorded by other apps (such as Samsung Health or Garmin Connect) are read only after you approve route sharing for that workout in Health Connect. If we add another integration method, we will update this policy with the data collected and how it is handled before it takes effect. ② Data we read (read-only): step count, heart rate, and workout (running) records (start/end time, distance, duration, workout route). The app never writes or modifies health data. ③ Purpose: (a) showing today's step count and your cumulative steps since you connected on the home screen, (b) showing progress toward and unlocking step and maximum-heart-rate achievements, and (c) after you confirm, importing runs recorded on your watch without your phone into the app's run history and drawing them on the map along their workout route (GPS coordinates). ④ Processing & storage: step count and heart rate are tallied on your device only while the app is running, for display and achievement checks. These values are never stored on your device or sent to or stored on our servers; they are read again from the health app whenever needed. Our servers store only the achievements you have unlocked and the date you started health sync. Imported runs (start/end time, distance, duration, route coordinates) are stored in the run history on your device, and route coordinates may be sent to Google Maps Platform to render a map background image. Only if you post a run to the feed is the post content (image with the route drawn on it, route shape, distance, time) stored on our servers. ⑤ Limited use: health data is used only for the purposes above. It is never used for advertising or marketing, never sold or shared with third parties, and never used to determine eligibility for credit, insurance or employment. No person reads it except with your consent, for security purposes, or where required by law. Use of data received from Health Connect complies with the Health Connect Permissions policy, including the Limited Use requirements, and HealthKit data is never stored in iCloud. ⑥ Opting out: health sync is optional and can be turned off at any time in the app settings. You can revoke access in iOS Settings > Health > Data Access & Devices, or in the Android Health Connect app > App permissions.

3. Retention & Destruction

Data is destroyed without delay once its purpose is achieved or upon account deletion. Only payment/subscription transaction evidence (transaction identifiers, product, store, purchase/expiry dates, price/currency and necessary transaction details) is retained separately for five years from the transaction. Profiles, workout records and photos are not retained as transaction evidence. Expired evidence is deleted by a daily cleanup task.

4. Third-Party Processing & Outsourcing

① Backend/authentication/storage: Supabase. ② In-app payments & receipt verification: Apple App Store / Google Play (and the payment-verification provider RevenueCat). ③ Social login: Kakao, Google, Apple. ④ Maps & geocoding: Google Maps Platform. The above providers process data under their own privacy policies, and the Company integrates only to the minimum extent necessary to provide the service. ⑤ Gym operations: gym owners and authorized managers can access and process their gym members’ membership, request, booking, cancellation and attendance information within their assigned management permissions. This information is used for that gym’s membership management, class operations, booking/attendance verification and related notifications.

5. User Rights

Users may request access, correction, deletion, restriction of processing, or withdrawal of consent. Delete your account in the app under [Profile] or on the account deletion webpage (aboardfit.com/delete-account.html). The web flow verifies your registered email and requires final confirmation. Only the transaction evidence described above is retained.

6. Children & Minors

Payments by minors may require the consent of a legal guardian, and protective measures under applicable law are applied.

7. Security

Reasonable safeguards such as in-transit encryption and access control (RLS) are applied. However, absolute security of internet transmission cannot be guaranteed.

8. Inquiries & Data Protection Officer

Privacy inquiries and exercise of rights can be submitted through in-app inquiry or to the data protection officer below. - Data protection officer: Eunwoo Jo (조은우), CEO - Email: aboardfit@naver.com - Phone: +82 10-9703-3740