Privacy Policy

What we collect

• Account: your email address. If you use a password, we store only a salted hash of it, never the password itself.
• Google sign-in: if you sign in with Google, we receive your Google account ID and email address. We never see your Google password and we don't access your contacts, files or any other Google data.
• Game data: your character's name, portrait, skills, items, progress, friends, guild and arena results.
• Workouts you upload: the original file (FIT, GPX or TCX) and the data we read from it: activity type, start time, duration, distance, average and maximum heart rate and your effort rating. These files can also contain your GPS route and device details.
• Strava connection (optional): your athlete ID, access tokens and the workout data described under "Strava data" below.
• Guild chat: the messages you send in your guild's chat.
• Technical data: your IP address, used briefly to block abuse (rate limiting) and recorded in server logs.

How we use it

• To run the game: sign you in, turn your workouts into Energy and XP, and save your progress.
• To show your character to other players (name, portrait, levels and game results). Your email, workout files, routes and heart rate are never shown to other players.
• If you're in a guild, every workout you log is posted automatically to the guild chat as a card: activity type, date (no time of day or route), duration, distance, Energy, XP and the device that recorded it. Workouts that came from Strava only become a "Trained" card with the XP and Energy, with no workout details. Chat messages can be read only by guild members. They're stored encrypted, and the moderation team can open a message only after a member reports it.
• To keep the service secure and answer your support requests.
• We don't show ads, we don't sell your data and we don't share it for marketing.

Google user data

We use Google Sign-In only to authenticate you, with the basic scopes openid, email and profile. We store your Google account ID and email address to link them to your game account, and use them for nothing else. We don't transfer this data to anyone. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Strava data

If you connect Strava, we receive your Strava athlete ID and access tokens (stored encrypted) and, for each workout from the last 30 days and every new one: sport, start time, duration, moving time, distance, average and max heart rate, whether it was logged manually and the device name. We don't read your GPS route. We use this only to turn your workouts into Energy and XP. Strava workout details are shown only to you: in guild chat and on your public profile, other players only see that you trained and the XP and Energy it earned in the game. If you disconnect, or revoke access on Strava, we delete the tokens and the Strava details (distance, heart rate, device); the workout stays in your game history with its type, date, duration and the rewards already earned. We don't use Strava data to train AI models.

Who processes your data

The game runs on Amazon Web Services (servers, database and file storage, in the United States). If you connect Strava, we talk to the Strava API only to fetch your workouts and to revoke access when you disconnect: we don't send game data to Strava. We only disclose data beyond that if required by law.

Cookies

• zwpx_session: keeps you signed in (30 days).
• zwpx_lang: remembers your language (1 year).
• zwpx_oauth: protects the Google sign-in step (10 minutes).
• zwpx_strava: protects the Strava connect or sign-in step (10 minutes).
• We don't use advertising or tracking cookies.

Health data

Heart rate and workout data are health-related. We use them only to calculate your in-game rewards. Respect your limits: the game is no substitute for professional guidance.

Retention and your rights

We keep your data while your account exists. You can ask us to access, correct, export or delete your data at any time by emailing the address below. When your account is deleted we erase your profile, game data and uploaded files within 30 days. Guild chat messages are deleted automatically after 180 days, except messages still under review for a report. You can disconnect Strava at any time under Training (or in Strava's own settings): the tokens and the Strava workout details are deleted right away. Server logs are kept only for a limited period.

Depending on where you live (for example, the LGPD in Brazil or the GDPR in the European Union), you have these rights by law, as well as the right to withdraw consent and to complain to your data protection authority.

Security

Traffic is encrypted in transit (HTTPS/TLS), the database and its backups are encrypted at rest, passwords are hashed and workout files are kept in private storage. Guild chat is stored encrypted with a key per guild (protected by AWS KMS): the server decrypts it only for guild members and, for moderation, only reported messages, and every access to the keys is logged. Strava tokens are also stored encrypted, with a key protected by AWS KMS. It isn't end-to-end encrypted. No system is perfectly secure, but we work to protect your data.

Children

The game is not directed to children under 13, and we don't knowingly collect their data.

Changes

If we change this policy we'll update the date above, and let you know in the game about important changes.

Contact

Questions or requests about your data: development@gladino.com