Privacy Policy

Last updated: 30 August 2026

Koshio is a game about claiming ground by running. To make it work we have to process your location and a few basic details about you. This page explains what we collect and why, who can see what, and how to delete your data.

1. Who is responsible

Koshio is run by an independent developer. For anything privacy-related, one address: info@koshio.app

2. What we process

We don't ask for or store a personal profile photo. Your avatar is a small generated icon, not a picture of you. A club photo is different: it is uploaded by the club's managers and reviewed by hand before it goes live.

More about location

During a run Koshio records your location in the background too, so your route doesn't break when you pocket your phone. Recording starts only when you start a run and stops when you finish it. Outside of runs, your location is not tracked.

More about live location

If you organised an event, you can choose to share your location for the duration of that event. It is entirely optional and off by default. While it is on you see a banner that doesn't go away. Your location is visible only to club members who said they are coming to that event; not to the rest of the club, not to anyone outside it, and not on the public map. No trail is kept: the server holds only your latest point and overwrites it. When you switch sharing off the record is deleted; if you forget, it deletes itself a few hours after the event ends. Sharing continues in the background while you use other apps, and a permanent notice stays in your notification bar the whole time. Closing the app stops the sharing.

More about visit measurement

To see how many people reach this site we use Cloudflare Web Analytics. It sets no cookies and does not follow you across sites: it keeps only aggregate counts such as how often a page was opened, which country visitors came from and which browser they used. Individuals are not identified, no profiles are built, and none of it is used for advertising. This is on the marketing site only; there is no tracking inside the app.

More about the launch list

If you leave your email in the notify me form on the site, we keep it for one purpose only: sending you a single email when the app launches. We send nothing else, share it with nobody, and never use it for advertising. The only other thing stored beside it is which language page you signed up from, so the announcement reaches you in the right language. Want off the list? Write to info@koshio.app and we will delete it.

More about bug reports

If something goes wrong you can write to us with Report a bug in your profile. Along with your text we automatically send the app version, platform, OS version and device model. Without these we cannot tell which version or device the problem is on. The report screen lists exactly what is sent. You may also attach a screenshot; this is entirely optional. Only app admins can see a screenshot, deleting the report deletes the file, and in any case it is removed within 60 days. Mind any personal details visible in the frame before you attach one.

More about notifications

To send notifications to your phone we store a notification address for your device. It belongs to the device, not to you, and is deleted when you sign out. For a notification to reach the phone it has to pass through Google's notification infrastructure (Firebase Cloud Messaging). On Android there is no other route. Our notification text is deliberately short: the content of an announcement or comment is not put into it. You can turn notifications off with the switch on the Notifications screen.

More about details given when joining a club

Some clubs ask people who want to join for their full name and phone number. The club owner chooses this when creating the club; not every club asks. When you apply to a club that asks, you enter those two details. In a club that does not ask, you are never asked and nothing is stored.

Only the OWNER of that club can see these details. Not the club's admins, not the other members. They are collected so club events can be more trustworthy: so the owner knows who is coming and can reach the people who attend.

If you got something wrong, you can correct it. Use “Edit the details you gave” on the club page, either while your application is pending or after you have joined. When you leave the club or are removed from it, these details are deleted and the club no longer has them. If you want them erased completely, leaving the club is enough.

3. What others can see

Other users can only see:

• Your username, avatar and territory colour
• Your total XP and your place in rankings
• The shape and size of your territories on the map
• In clubs you belong to: your announcements and comments, your event answer and attendance , to that club's members only

What no one but you can see:

• Your email address
• Your height, weight, birth year or sex
• The points, durations or speeds of your routes
• Your social media handle: only the managers of a club you ask to join can see it
• Your live location: only if you turn it on, and only people coming to that event

This split isn't a promise, it's enforced in the database: personal fields are simply absent from the view exposed to other users, and automated tests verify this on every release.

4. Reports and moderation

You can report inappropriate content or a person. Your report reaches the managers of the club as a notification, but they are not shown who reported. The app's developers (app admins) see the report queue; there the reporter's username is visible, because abuse of the reporting mechanism is itself a problem and can only be handled there. An admin can delete inappropriate content and, if necessary, freeze an account.

5. Who we share with

We don't sell your data and we don't give it to advertising networks. There are no ads and no third-party tracking in the app. We use these providers to run the service:

6. How long we keep it

Your data is kept for as long as your account exists; run history only means something if it accumulates. When you delete your account, your runs, territories, notifications, friend connections, club posts and social media handle go with it. Three things are kept far shorter: live location deletes itself a few hours after the event ends, and the device notification address is deleted when you sign out, and the name and phone number you gave when joining a club are deleted when you leave that club.

7. Your rights

Most of them you can exercise yourself, without asking anyone:

• Correction: change your profile any time (Profile → Edit profile).
• Freeze: Settings → freeze account. You disappear from the map, the rankings and friend search; nothing is deleted. Signing in again restores it automatically.
• Permanent deletion: Settings → delete account. Irreversible; all your data goes with it.
• Access and portability: for a copy of your data, write to info@koshio.app.

If you are in the European Union your GDPR rights apply, and if you are in Türkiye your KVKK rights apply; use the same address.

8. Children

Koshio is not directed at children under 13 and we don't knowingly collect data from them. In the European Union the applicable age can be up to 16 depending on the country. If you notice your child has an account, write to us and we'll delete it.

9. Security

Connections are encrypted (HTTPS) and your session is stored encrypted on your phone. The database enforces row-level rules so each user can only reach their own data. That said, no system is one hundred percent secure and we don't claim otherwise.

10. Changes

If we update this text we'll change the date at the top. For significant changes we'll also tell you inside the app.