VAGG — Privacy Policy

Effective date: 2026-05-06 Last updated: 2026-05-06

This Privacy Policy describes how VAGG (“we”, “our”, “the app”) collects, uses, and shares information when you use our mobile application. By using VAGG, you agree to the practices described here.

VAGG is operated by Diwas Parajuli (sole developer), based in Nepal. Contact: parajuli.diwas101@gmail.com

1. Summary (the short version)

VAGG is a fitness and territory-capturing running app. It tracks your GPS location during runs to award you in-game territory.
We collect your location (including in the background during a run), basic profile info (email, username, avatar), and session data (routes, distance, duration).
We use Supabase (Postgres, Auth, Realtime) as our backend, and Mapbox to render maps.
We do not sell your data. We do not use third-party advertising trackers.
You can delete your account and all your data from the in-app Settings screen, or by emailing us.

2. Information we collect

2.1 Information you provide

Account info: email address and password (the password is hashed by Supabase Auth — we never see it).
Profile info: username and selected avatar.
Optional photo: if you choose to add a background image to a share card, the app accesses your photo library to let you pick one. The image is processed locally and only attached to a share card if you save it. We do not upload your photo library to our servers.
Feedback and suggestions: if you submit post-session feedback or use the suggestion box, we store the text you wrote alongside your user ID.

2.2 Information collected automatically while you use VAGG

Precise location (GPS): while a run session is active, the app records GPS breadcrumbs (latitude, longitude, accuracy, timestamp) every few seconds. This is the core function of the app — without it we cannot determine the territory you’ve captured.
Background location: if you grant the “Allow all the time” permission, location collection continues while VAGG is running in the background or while your screen is off. This is so your run isn’t silently cut off when you put your phone in your pocket. Background location is only collected during an active session, never at rest.
Motion / activity data: the device accelerometer is read during active sessions to help validate that recorded sessions correspond to real physical movement (anti-cheat). This data is processed locally and not transmitted in raw form.
Session metadata: total distance, duration, average pace, calories estimate, captured cell IDs and area, session classification (run vs. area capture).
Network type: whether you’re online or offline, used to decide whether to sync immediately or queue locally.
Device info (minimal): device OS version and app version, used for crash diagnostics and compatibility.

2.3 What we do NOT collect

We do not access your contacts, calendar, microphone, camera (the camera permission is not declared), or SMS.
We do not collect location while you are not in an active run session.
We do not run third-party advertising SDKs.
We do not collect biometric data, financial data, or government IDs.

3. How we use your information

We use the information above to:

Provide the core territory-capture mechanic (GPS → cells → leaderboard).
Maintain your account, profile, sessions, and territory ownership.
Show your stats, recent sessions, and ranked leaderboards.
Display a map of territory you and other players have captured (your username and avatar are visible on the map and leaderboard to other VAGG users).
Detect cheating (e.g. impossible speed, GPS teleportation) to keep the leaderboard fair.
Send you optional notifications related to your activity (you can disable these in your device settings).
Diagnose crashes and improve the app.

We do not use your data for advertising, profiling for third parties, or sale to data brokers.

4. Legal basis (for users in regions that ask)

We process your data on the basis of:

Performance of a contract — running the service you signed up for.
Consent — for sensitive permissions like background location and notifications. You can revoke consent at any time in your device settings or in the app.
Legitimate interest — for fraud / cheat detection and basic crash diagnostics.

We share information only with:

Supabase (our backend infrastructure provider) — stores your account, sessions, cells, profiles, and feedback. Supabase acts as a data processor on our behalf. Their privacy policy: https://supabase.com/privacy
Mapbox (our map tile provider) — when the map renders, your device requests map tiles directly from Mapbox. Mapbox may receive technical data (IP address, approximate region) as part of these requests, governed by their privacy policy: https://www.mapbox.com/legal/privacy
Other VAGG users — your username, avatar, and captured territory cells are visible to other players on the in-app map and leaderboard. Your email, exact GPS trail, and personal stats are not visible to other users.
Legal compliance — we may disclose information if required by law, court order, or to protect rights and safety.

We do not sell or rent your personal information.

6. Data retention

Active accounts: we retain your data for as long as your account exists.
Deleted accounts: when you delete your account (Settings → Account → Delete account, or email request), we delete your profile, sessions, and feedback within 30 days. Captured territory cells become unowned.
Backups: anonymized backups may persist for up to 90 days before being purged.
Aggregated/de-identified data (e.g. “average run distance in Kathmandu”) may be retained indefinitely as it cannot be tied back to you.

7. Your rights

You can:

Access your data — visible in-app via your profile and recent sessions.
Correct your username, avatar, and email at any time in Settings.
Delete your account and all associated data — Settings → Account → Delete account, or email parajuli.diwas101@gmail.com.
Export your data — email us and we’ll send you a JSON dump of your sessions and profile.
Withdraw permissions — turn off location, background location, or notifications in your device’s system settings at any time. Note: turning off location will stop the app from recording runs.
Object or restrict processing — email us with your request.

If you are in the EEA, UK, or California, you have additional rights under GDPR / CCPA — including the right to lodge a complaint with your local data protection authority.

8. Children’s privacy

VAGG is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete it.

9. Security

We use industry-standard measures to protect your data:

All network traffic is encrypted via HTTPS / TLS.
Passwords are hashed by Supabase Auth (we never store plaintext passwords).
Database access is restricted via Supabase Row-Level Security policies.

No system is perfectly secure. If you become aware of a security issue, please email parajuli.diwas101@gmail.com.

10. International transfers

VAGG is operated from Nepal. Our backend (Supabase) and map provider (Mapbox) may store and process data in regions including the United States and the European Union. By using VAGG you consent to your data being transferred and processed in these regions.

11. Changes to this policy

We may update this policy from time to time. The “Last updated” date at the top reflects the most recent change. For material changes, we’ll notify you in the app or by email before they take effect.

12. Contact

Questions, requests, or concerns about this policy or your data:

Email: parajuli.diwas101@gmail.com Developer: Diwas Parajuli, Nepal App package: com.diwasparajuli.vagg