Privacy Policy

Version: legal-v1.0.0

Effective date: 2026-07-08

Status: Draft for legal review before production publication.

This Privacy Policy explains how Crewa collects, uses, shares, stores, and protects personal information. The final controller/operator identity, registered address, DPO or privacy contact, processors, transfer mechanism, and jurisdiction-specific language must be confirmed before publication.

1. Who We Are

Crewa is a running, fitness, and social progress service. For privacy requests, contact support@crewa.run unless a different privacy contact is published before release.

2. Information We Collect

We may collect account information such as email, name, password credentials, authentication provider identifiers, activation/reset data, and security session metadata.

We may collect profile information such as public code, avatar, biography, city, current level, progress, premium status, social connections, clubs, and public profile visibility.

We may collect activity and fitness information such as running sessions, distance, duration, pace, route/GPS points, privacy zone settings, imported workout identifiers, and related statistics. If connected features support it, this may include health-derived data such as heart rate or calories.

We may collect device and technical data such as IP address, user agent, app version, device model, locale, timezone, install identifiers, push tokens, logs, and diagnostic data.

We may collect referral and anti-fraud data such as referral code, click id, source, device fingerprint, attribution state, and abuse signals.

We may collect support and communications data such as messages, reports, email delivery state, and preferences.

3. How We Use Information

We use information to provide the service, authenticate users, show public profiles, process workouts, operate city progress mechanics, manage referrals, send activation and reset emails, prevent fraud and abuse, improve reliability, provide support, and comply with legal obligations.

4. Public Profiles

If public profiles are enabled, `/u/{publicCode}` may show selected profile and progress information. Privacy controls such as run history visibility, map hiding, hidden details, and privacy zones are applied by the backend before data is returned to public pages.

5. Legal Bases

Depending on the user's region, processing may be based on performance of a contract, consent, legitimate interests, legal obligations, or protection of users and the service. Final legal bases must be reviewed for each region served.

6. Sharing

We may share data with service providers that help us operate hosting, storage, email, security, analytics, support, and app infrastructure. We may also disclose data where required by law, to protect users or the service, or as part of a business transfer.

7. Storage and Transfers

Data may be stored and processed in countries where Crewa or its providers operate. If serving users in Russia or the EEA/UK, localization and transfer mechanisms must be reviewed before launch.

8. Retention

We keep data for as long as needed to provide Crewa, comply with legal obligations, resolve disputes, prevent abuse, and enforce agreements. Account deletion, anonymization, and retention schedules must be finalized before publication.

9. Your Choices and Rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, object to processing, withdraw consent, or appeal privacy decisions. Requests can be sent to support@crewa.run unless a dedicated privacy contact is published.

10. Cookies and Local Storage

Public web pages may use local storage, referral parameters, and basic technical cookies or equivalent technologies to keep referral context, page state, language, and security information.

11. Security

We use technical and organizational safeguards intended to protect data. No system can be guaranteed to be fully secure.

12. Children

Until a dedicated minor and parental consent flow is implemented, Crewa is intended for users who are at least 18 years old.

13. Region-Specific Notices

Additional notices may apply for EEA/UK users, California residents, users in Russia, or other regions. These sections must be reviewed by counsel before publication.

14. Changes

We may update this Privacy Policy. Material updates should be communicated through the app, email, or website where appropriate.