Privacy policy
This page says what Kadam keeps about you, why, who else handles it, for how long, and what you can do. It is meant to be read.
1. Who is responsible
Kadam is run by [[TODO: legal name of the person or company that runs Kadam]], [[TODO: business address or address service]], Amsterdam, the Netherlands, [[TODO: KvK number]]. Under the GDPR that is the “controller”.
Questions about your data: privacy@getkadam.com.
2. What we keep, and why
| What | Why | On what basis |
|---|---|---|
| Your email address, first name and date of birth | To sign you in without a password, to check you are 18 or over, and to show your age (never your date of birth). | Contract |
| Your mobile number | To check that people on Kadam have a real number, so that the person you meet is not free of consequences. It is never shown to anyone and is not part of your profile. If you change it, we keep the day you did and never what it was or what it became, so that two changes in a month can be the most; that record goes when you close your account. | Contract, and our interest in people’s safety |
| Your training: sport, pace band, usual distances, sessions a week, when you can train, where you train, and what you are training for | To match you with plans and partners, and to show your match card. This counts as health-related data under the GDPR (Article 9). | Your explicit consent, asked on its own screen. You can withdraw it in Settings at any time. |
| Your gender, if you choose to give it | Only for the setting “train with people of my own gender”. Never shown on your card and never readable by another account. | Your choice |
| Plans you post or join, and whether people came | To run the product, and to know that a session happened, which is what makes matching honest. | Contract |
| Runs you suggest to someone, requests to join a plan, and the setting that says who may suggest a run to you | To put a plan in front of a person who might want it, to let a host choose who joins, and to hold the limits that stop it being used to pester people. The person asked is told. The person who asked is never told that the answer was no, and nobody is told who chose what. | Contract, and our interest in people’s safety |
| Invite codes you make or use, and who they joined you with | So that a code works once, can be taken back and stops working after 30 days, and so that the two people it joins are training partners: always in each other’s People, and a run together is two taps. The person who made a code sees the first name of the person who used it, unless one has blocked the other. People you have run with twice become partners without a code. Nobody is asked, and nothing is shown to anyone else. A code typed wrongly is counted for an hour, and kept for a day, so that codes cannot be guessed. | Contract |
| Who you have stepped back from | So that a partner you have stepped back from does not appear in your People, your list or your board, and a run they suggest does not reach you. It is yours alone: they are not told, nothing changes for them, and it is in the file you can download. | Contract |
| The place you asked us to open, if you asked | So that we can tell you when it opens and know which city to open next. It is a city from our list or a town you typed, and when you asked. It is never shown to anyone, and a counter only shows a number once ten people have asked. | Your choice, and our interest in knowing where to open |
| A plan you shared with someone you trust, if you do | So that the person you tell can see where you meant to be and until when: your first name, the first names of the others on it and whether their phone is verified, the place, the meeting point and the times, for three hours after it ends. They need no account and see no number, photo or location. A link works only with its passcode, five wrong ones lock it, and you can stop it at any time. We keep that you shared it, and when, and nothing that would let the link be rebuilt. [[TODO: keep this row, and settle the lawful basis for showing other people's first names, only when plan sharing is switched on (SPEC-0045); until then delete it]] | Your choice, and our interest in people’s safety |
| Private notes after a session (“something felt off”), and cheers | To keep people safe, and to let someone say well done. Notes are never shown to the other person and are not a report. | Our interest in people’s safety |
| Messages in session chats and groups | To deliver them to the people in that chat. | Contract |
| Your photos | So people know who they are meeting. A person checks each photo before anyone else sees it. Photos are small, and never a background. | Your consent, each time you upload |
| How you trained before, and what a club did not give you | One answer, asked once after a first run and skippable: on your own, with friends, or in a club or group, and what a club did not give you. It tells us who the product is for. It is shown to nobody, and it is in the copy you can download. | Our interest in building the product for the people who use it |
| Blocks and reports | To keep people safe and to keep the legal records the EU Digital Services Act asks for. | Legal obligation, and our interest in people’s safety |
| A message that held a word we do not carry | To keep a plan’s chat free of solicitation and threats. A message that holds a word on our list is not sent. We record that it happened, which word of the list it was and when, and never what you wrote. | Our interest in people’s safety |
| Your notification settings and your phone’s push token | To send the reminders you asked for. What was sent, and the token it was sent to, is kept for thirty days so that a notification that did not arrive can be looked into, and is then deleted. | Your consent (the phone asks you) |
| A notice by email, if your phone cannot be sent a push | So that a run called off, or a request answered, reaches you when your phone is not set up to receive notifications. We send the words a notification would hold to the address you signed in with, never more than six in a day, and keep which notice was sent, and when, for thirty days. [[TODO: keep this row, name the sending provider in the list of who receives your data and settle the lawful basis with the lawyer (SPEC-0136), only when email notices are switched on; until then delete it]] | Our contract with you, and what you chose in Settings, under Notifications |
| What you agreed to, when, and to which version | So that we can show that you agreed, and to ask again if the wording changes. | Legal obligation |
| Crash reports, only if you turn them on | To fix what breaks. A report holds the error and the screen it happened on, with no name, email, phone number or message text. The switch is in Settings, under Privacy, and is off until you turn it on. | Your consent |
3. What we do not do
- We do not show ads, and we do not sell or rent your data.
- We do not use your training data for anything except matching you with training partners and showing your match card.
- We do not put analytics or advertising trackers in the app or on this website. This site sets no cookies.
- We do not make decisions about you by software alone. Matching follows rules you can see (pace, place, days). A person decides whether an account is removed.
- We do not use your precise location. Places are chosen from a list of known parks, tracks and gyms, and the map shows that one place and nobody else.
4. Who else handles it
These companies process data for us, under contracts that restrict them to doing what we ask.
| Who | For what | Where |
|---|---|---|
| Supabase | The database, sign-in and photo storage. Everything above is stored here. | European Union (Frankfurt) |
| Twilio | Sending the one text message with your verification code. It receives your mobile number and the code, and nothing else. | United States |
| Expo and Apple | Delivering push notifications to your phone. They receive a push token and the notification. | United States |
| Apple | Distributing the app (TestFlight, the App Store). | Worldwide |
| Apple Maps | Drawing the small map on a place's page and on a plan you are on. Apple's map is asked for the area around that one place, as it is by any app that shows a map, so Apple sees that request from your phone. It is not sent your account or who you are going with, and the app never asks your phone where you are. | Worldwide |
| Sentry | Receiving crash reports, only from people who turned them on. | European Union (Germany) |
| Email delivery | Sending your sign-in link. [[TODO: name the sending provider once custom email is set up]] | [[TODO: region]] |
| Website hosting | Serving this site. It keeps no record of you. [[TODO: name the host]] | [[TODO: region]] |
We may also have to give information to the police or a court when the law requires it.
5. Data that leaves the European Economic Area
Your mobile number and the verification code go to Twilio in the United States, and a push token goes to Expo and Apple. [[TODO: the transfer mechanism for each, confirmed with the lawyer: EU-US Data Privacy Framework or standard contractual clauses]]
6. How long we keep it
- While you have an account. Delete your account and it goes at once: your profile, your training data, the plans you posted, your messages, your photo records and your consent history. Nothing waits for a grace period. The image files themselves are removed from storage by a clean-up that runs after the account is closed: [[TODO: say 'within two days' once purge-photo-files is deployed and scheduled (SPEC-0061 T3); until then image files are NOT removed when an account closes]]
- Suggestions and requests to join are removed ninety days after they were made: long enough for a moderator to see a pattern if somebody reports one, short enough that a relation between two people is not kept because somebody once asked.
- Messages in a plan’s chat are removed thirty days after they were written. A plan that repeats has one chat, which the people on it read from the day they joined the plan, and people who have not been on it for thirty days are not in it. A message somebody reported is kept with the report, as it was when they reported it.
- Session-day statuses (“on my way”, “running late”) are removed two days after the session ends.
- The note that a message was not sent because it held a word on our list is removed ninety days after.
- If you have reported someone, the report stays after you leave, without your name, so that it can still be looked at.
- If we remove an account for breaking the community rule, we keep the reason we gave (the law requires it), and a one-way fingerprint of the email address and mobile number, so that the removal holds. An ordinary deletion keeps no such fingerprint.
- Backups of the database are kept for [[TODO: backup retention: seven days if point-in-time recovery is set to seven]] and then overwritten, so a deleted account leaves them as they expire.
- Accounts nobody has opened for [[TODO: the number: the operator's inactive_months, SPEC-0139, twelve is recommended]] months are written to once, at the address you signed in with, and are closed thirty days later if they have not been opened: everything in them is deleted, as it is when you delete your account. Opening the app and signing in is all it takes to keep one.
7. Your rights
You can ask to see what we hold, to correct it, to delete it, to limit how we use it, to take it elsewhere, and to object. You can withdraw a consent whenever you like, as easily as you gave it.
- Correct your details in your profile.
- Delete your account in Settings. See how deletion works.
- Withdraw consent for your training data in Settings. Because matching cannot work without it, that deletes the data and closes the account.
- Take a copy of what we hold in Settings, under Download my data. It is made on your phone from your account, shown to you first, and kept nowhere else.
- Everything else: write to privacy@getkadam.com. We answer within one month.
If you think we have handled your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would like to hear first, so that we can put it right.
8. Age
Kadam is for people who are 18 or over. If we learn that someone is under 18, we remove the account.
9. Changes
When this policy changes in a way that matters, the version above changes and the app asks you again where it needs your consent. Earlier versions are available on request.