Information Collection and Use

For a better experience, while using our Service, we may require you to provide us with certain personally identifiable information, including but not limited to:

• Account Information: Name and Email Address collected when you register or log in using third-party services such as Google Sign-In or Apple Sign-In.
• Location Data: To track your running routes.
• Camera/Photos: To upload profile pictures or activity photos.

The information that we request will be retained by us and used as described in this privacy policy.

Authenticated App Foreground Timestamp

When you use Active 365 while signed in and the app is in the foreground, we send a lightweight heartbeat to Supabase, normally at most once every 15 minutes per device. The server retains only the latest confirmed foreground timestamp associated with your account for authorized account management and user support; it is not a live online status or the time of your last workout. The timestamp is readable only by you and authorized administrators, and is deleted when your account/profile is deleted. Administrators may include it in internal user-list exports, which must be protected and retained only as needed for the approved purpose. Background GPS, step synchronization and locked-screen activity do not initiate these heartbeats. No additional device permission, location data, health data, interaction history or analytics SDK is required for this feature. Device storage holds account-scoped retry/cooldown hints, not an interaction history; hints are ignored after at most 15 minutes or when the device clock changes unexpectedly.

Leaderboard Profiles and Optional Sharing

The leaderboard displays participants' display names, avatars, season rankings, accumulated steps and streaks. Profile drawers show detailed step statistics only for your own account or an accepted friend. Complete activity, friend and achievement counts are shown only where existing account access supports them; unavailable values are marked accordingly. Access to detailed daily step records is enforced by the database for your own account, accepted friends and authorized administrators. Anonymous callers cannot read these records. Friend requests start as pending and only the recipient can accept them. Public leaderboard totals remain available without exposing daily records.

When you select Share ranking, the app opens your device's share sheet with a text summary of the display name, season, ranking, steps and streak already visible on the leaderboard. You choose the receiving app and whether to send it. The summary excludes email addresses, account identifiers, profile links, routes and private profile statistics. The app does not upload or retain a copy of the shared text or add sharing analytics. If you send it, the receiving app's retention, deletion and privacy practices apply. Sharing requests no additional health, location, camera or photo permission.

Password Recovery

We use Supabase to send password reset emails and verify recovery links. The mobile app holds recovery access and refresh tokens temporarily in memory to change your password; it does not persist them as a signed-in app session. These tokens are discarded when you cancel or complete recovery, or when the app process ends. If you close the app before completing recovery, request a new reset email to continue. A reset link does not automatically sign you into the app; after changing your password, sign in with your new password. Recovery tokens and passwords are not added to application logs or analytics.

Community Data and Invitation Links

• Community Data: When you create, administer, or join a community, we process the community details, your membership and role, and related timestamps to provide the community feature and enforce its membership rules.
• Invitation Links: Community invitation links contain an opaque token used to resolve the intended community and validate whether the invitation is active. Opening a link does not automatically join the community; you must sign in and confirm before membership is created.
• Temporary Handoff: If you open an invitation before authentication or onboarding is complete, the app may store the invitation token locally on your device for up to 7 days so the flow can resume. The app removes it after a successful join, a terminal invitation error, expiration of the local handoff, or when you leave the flow.
• Sharing: Treat invitation links as confidential. An authorized community creator or admin may revoke or regenerate a link, after which the previous link can no longer be used.

To provide mapping features and visualize your running routes, we use Mapbox as our third-party map service provider. By using the app's map and tracking features, you acknowledge that your Location Data may be processed by Mapbox in accordance with their privacy policy.

Home Route Preview

The preview's Map information button lets you opt out of optional Mapbox telemetry through the SDK's native setting, or enable it again. This setting applies to Mapbox maps in the app and does not disable activity storage or synchronization. Attribution links open Mapbox or OpenStreetMap only when you select them.

Home displays the most recent recorded GPS session started on the current day in Jakarta time (WIB). Mapbox's mobile SDK renders the map and route locally into a preview image; map loading may process the viewed map area and standard device, connection and SDK usage information through Mapbox. The app does not upload this preview image or send your entire recorded route to a Static Images API. No additional location, photo or gallery permission is requested for this preview.

The app keeps at most one preview image, up to 8 MiB, in its private device cache for up to 24 hours. The cache is scoped to your account and WIB day, is invalidated when the selected route changes or a successful read confirms no route, and is removed when you sign out, switch account or change day while the app is running. Expired files are removed when the cache is accessed; the operating system may clear cache sooner. Cache files are not saved to your photo gallery or uploaded by this feature. When activity data cannot be revalidated, a same-account, same-day cached preview is marked as unverified; it is not presented as a newly confirmed activity. Server activity record retention and deletion are unchanged.

Health Connect, Apple HealthKit, and Fitness Data

Active 365 integrates with Google Health Connect (on Android) and Apple HealthKit (on iOS) to read your fitness data (such as steps, distance, calories, and exercise sessions) from third-party smartwatches like Garmin, Huawei, and Apple Watch.

• Use of Data: This health data is used to synchronize your daily activity into your Active 365 Journal, calculate your fitness progress, and support authorized internal reporting about activity and progress as described below. It is not used for advertising.
• No Third-Party Sharing: We do not sell, rent, or share your health data with any third-party advertising platforms, data brokers, or information resellers.

Internal Activity and Progress Reports

Authorized administrators can view and download internal reports containing user IDs, names and account email addresses for user identification, recorded activity times and fitness totals (including imported fitness sessions), daily steps, and streaks reconstructed from available daily records. Reports can be filtered by date, time, activity type, and reference region. Regional classification uses recorded routes within the existing service and public boundary data; the reporting feature does not send routes or fitness records to an external geocoding service.

Downloaded reports include account email addresses but do not include raw GPS coordinates. Preview results are held temporarily in the administrator's browser memory; downloaded Excel files are stored on the administrator's device and must be protected and retained only as necessary for the approved internal purpose. This reporting feature does not request additional mobile permissions. Sharing identifiable reports outside the service operator requires a separate review of purpose, access, and applicable data-protection requirements.

App Update Checks on iOS

To determine whether a newer public version of Active 365 is available, the iOS app requests public listing information from Apple's App Store lookup service. The request contains the app's public bundle identifier and the Indonesian storefront code. It does not include your Active 365 account, health, fitness, or location data. Apple may process standard connection information, such as an IP address, according to Apple's privacy policy. Active 365 does not retain the response as personal data.

Administrative Coin Grants

Authorized administrators can add regular or bonus virtual coins to an account for rewards or support. These grants are not purchases and are recorded separately from paid top ups. We store the recipient account ID, administering account ID, coin category and amount, reason, server timestamp, balance before/after, bonus expiration where applicable, and a request ID to prevent duplicate grants. Records are stored in our Supabase database and accessible through authorized administrative tools, not used for advertising. Staff should not enter sensitive personal information in grant reasons.

Grant records associated with a recipient are removed when that recipient's account/profile is deleted. When the administering account is deleted, its actor identifier is cleared from other recipients' grant records. An unconfirmed grant request is temporarily retained in the administrator's browser session storage to safely check/retry the same request after a page reload; it is removed after confirmation or a definitive rejection, or when that browser tab's session ends. This feature requests no additional mobile permissions and does not collect payment credentials or purchase receipts.

active365.id Website

When you visit our website, the following information may also be processed:

• Personal Information: We may ask for your name and email address if you choose to contact us, subscribe to our newsletter, or register for information regarding the Active 365 app.
• Usage Data: We automatically collect certain information when you visit the website, such as your IP address, browser type, device type, pages visited, and the time and date of your visit.
• Cookies: We use cookies and similar tracking technologies to track activity on the website and improve your browsing experience. You can instruct your browser to refuse all cookies.
• Community Invitation Token: A community invitation link may contain a random token in its URL. The landing page processes this token only to open the corresponding invitation flow in the Active 365 app. Opening a link does not automatically create a membership, and the landing page does not store the token in cookies or browser storage.

We use website data to provide and maintain the website, notify you about updates or news regarding the Active 365 app, provide customer support, monitor website usage and analyze trends, and hand a community invitation link off to the confirmation flow in the Active 365 app. If you have subscribed to our mailing list and wish to be removed, or want us to delete your personal information from our web database, contact us at infoactive365@gmail.com.

Data Retention

We retain your personal data and fitness records for as long as your account is active. This is necessary to provide you with your historical journal data and analytics. If your account remains inactive for a period of 2 years, we will automatically schedule your data for permanent deletion from our servers.

Data Deletion Policy

You have the full right to request the deletion of your account and all associated personal data at any time. To request data deletion, you can:

1. In-App: Navigate to the “Profile” > “Settings” > “Delete Account” menu within the Active 365 app.
2. Via Email: Send an email to infoactive365@gmail.com with the subject “Account Deletion Request”.

Upon receiving your request, all your personal information, fitness logs, and credentials will be permanently and irreversibly deleted from our database within 7 to 14 business days.

Security

We value your trust in providing us your Personal Information, thus we are striving to use commercially acceptable means of protecting it. However, remember that no method of transmission over the internet, or method of electronic storage is 100% secure and reliable, and we cannot guarantee its absolute security.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

Contact Us

If you have any questions or suggestions about our Privacy Policy, do not hesitate to contact us at infoactive365@gmail.com.