Koshio

Privacy Policy

Last updated: 13 August 2026

Koshio is a game about claiming ground by running. To make it work we have to process your location and a few basic details about you. This page explains what we collect and why, who can see what, and how to delete your data.

In short: your running routes are visible only to you. Other people see your username, avatar, colour, XP and your territories on the map — not your email, not your body measurements, not the points of your route. You can permanently delete your account from inside the app; you don't need to ask us.

1. Who is responsible

Koshio is run by an independent developer. For anything privacy-related, one address: info@koshio.app

2. What we process

Data Why Required
Email address Account identity; sign-in and confirmation Yes
Username, avatar, territory colour Showing you on the map and in rankings Yes
Country and city Scope of the leaderboards Yes
Location (GPS traces) The game itself: territory is computed from your route Yes
Height, weight, birth year, sex Calorie estimates only No — you can leave these empty
Step count Anti-cheat (compared against distance) No (if your device supports it)
Runs, territories, XP Game results and your history Created automatically
Friend connections Friend list and filters Only when you choose

More about location

During a run Koshio records your location in the background too, so your route doesn't break when you pocket your phone and lock the screen. Recording starts only when you start a run and stops when you finish it. Outside of runs, your location is not tracked.

3. What others can see

Other users can only see:

What they cannot see:

This split isn't a promise, it's enforced in the database: personal fields are simply absent from the view exposed to other users, and automated tests verify this on every release.

4. Who we share with

We don't sell your data and we don't give it to advertising networks. There are no ads and no third-party tracking in the app. We use these providers to run the service:

Provider Purpose Where
Supabase Database and authentication Germany (Frankfurt), EU
Google Maps Map rendering Google infrastructure
Resend Account emails EU (Ireland)
DiceBear Avatar images Only an avatar id is sent
Expo / Cloudflare App delivery and this website

5. How long we keep it

Your data is kept for as long as your account exists — run history only means something if it accumulates. When you delete your account, your runs, territories, notifications and friend connections go with it.

6. Your rights

Most of them you can exercise yourself, without asking anyone:

If you are in the European Union your GDPR rights apply, and if you are in Türkiye your KVKK rights apply; use the same address.

7. Children

Koshio is not directed at children under 13 and we don't knowingly collect data from them. In the European Union the applicable age can be up to 16 depending on the country. If you notice your child has an account, write to us and we'll delete it.

8. Security

Connections are encrypted (HTTPS) and your session is stored encrypted on your phone. The database enforces row-level rules so each user can only reach their own data. That said, no system is one hundred percent secure and we don't claim otherwise.

9. Changes

If we update this text we'll change the date at the top. For significant changes we'll also tell you inside the app.

Note: this text was written to be plain and accurate, but it has not been reviewed by a lawyer.