Privacy policy

Who is responsible

ROND is operated by Nateetorn Chawana. This policy covers the ROND iOS app, its online community service and rond.win. For privacy questions or requests, contact support@rond.win.

Apple Health and your virtual journey

With your permission, ROND reads supported activity information from Apple Health to calculate your virtual journey on your iPhone. Original Health samples and workout routes are not uploaded to ROND. Steps are displayed separately and do not add extra distance. Change read permissions in Health, your profile, Apps, ROND. Revoking access stops future reads; it does not erase data already saved in ROND.

When you sign in using an app version that supports website progress sync, ROND saves a private display summary to your online account. It includes your level and XP, season and mission progress, collected rewards, coin balance and title, special day progress, virtual journey and passport, personal goal and available monthly movement summaries. The website shows the latest saved summary only to your authenticated account. These summaries contain no original Health samples or recorded GPS routes. They do not change competitive scores, award rewards or go to advertising or payment services.

Optional Strava connection

You can sign in with Strava or connect it to your existing ROND account. When you connect Strava, ROND stores your Strava athlete identifier and encrypted access and refresh credentials on its server to manage the connection. On the website, ROND keeps a private encrypted temporary cache of your activity summaries so revisiting your activities does not repeatedly request the same data from Strava. Cached summaries include activity name, date, type, distance, duration, provider location labels and available summary map previews. The cache is accessible only through your authenticated account and current Strava connection. Cached summaries and saved history pages expire no later than seven days after their original Strava fetch. Reads do not extend this expiry. Expired records are never displayed and scheduled cleanup removes them. The website also keeps a bounded display snapshot in per-tab browser storage to restore loaded activity pages and filters after it verifies the same account and current Strava connection. This snapshot retains the original expiry and is cleared on logout, session expiry, connection changes or when the tab closes. While cached summaries remain valid, the website can display them immediately and check for updated activities in the background. Changes reported by Strava invalidate the cache. ROND can also request your Strava name and profile image URL to identify your connected account privately in the website header and on the activities page. These profile fields are processed temporarily and are not saved to your ROND profile. A bounded copy of your profile image can be kept in the same session-bound browser tab storage for up to six hours so a hard reload can restore it without downloading the image again. It is cleared on logout, session expiry or provider removal. Loading the profile image sends an image request to Strava’s image provider without a page referrer. For movement sync, ROND stores derived daily totals and temporary import progress. It keeps provider activity identifiers for up to 400 days to recognize newly imported activities without repeating notifications. These identifiers do not contain activity names, routes or locations. Private sync notifications contain only the number of new activities, sync time and read status. The website keeps your latest 30 notifications for up to 90 days.

When you choose Replay for an activity, ROND requests that activity’s recorded GPS coordinates and timing from Strava and processes them temporarily on its server and in your browser memory. Replay route data is not saved by ROND, placed in browser persistent storage or shared publicly. Map tile providers receive requests for the map area you view.

Supported recorded Strava activity from the current calendar year can contribute to country rankings, including activity recorded before you connected ROND. Activity before your first country selection is attributed to that first country. Later country changes use your membership dates. Previous years are kept separately. Challenges count only activity recorded during your participation. When Apple Health and Strava provide totals for the same team, UTC day and activity category, ROND uses the higher daily total instead of adding both. Public movement follows your profile and competition visibility settings; activity routes remain private.

You can disconnect in ROND or remove ROND from Strava Applications. Starting a disconnect clears the activity cache, stored activity identifiers and sync notifications immediately. Disconnecting revokes the provider connection and removes its stored credentials, movement ledger and sync progress. Movement supplied independently by Apple Health remains available. If revocation cannot be confirmed, encrypted credentials are retained for a removal retry and the app explains any required recovery action. Account deletion requires connection cleanup before local online account data is removed. Strava processes authorization requests under its own privacy policy.

Location and saved preferences

A nearby-city suggestion uses an optional one-time location request and the city catalog on your device. ROND saves the selected city rather than your device coordinates. It does not continuously track your physical location. Your virtual traveler is separate from your real location. Personal journey data, travel preferences, character choices and local challenges are stored on your device. Account session credentials use the iOS Keychain. Local movement summaries and pending uploads use iOS file protection and are excluded from backup.

Online accounts and derived movement

Sign in with Apple creates an online account associated with an account identifier and your ROND display name. Online features store country membership, friendships, invitations and challenge participation. When you sync online, daily distance totals by activity, time windows and synchronization metadata are sent to the ROND service and linked to your account. ROND does not send original Health records, workout routes or device location with these contributions.

Public profiles and competition

Country rankings use combined movement and activity statistics. Before joining or changing an online country team, or creating or joining a group challenge, you enter a ROND public name and explicitly confirm publication. Your ROND name and profile identifier become visible on team and country rankings. This setup does not automatically copy your Strava name or profile image. You can use a nickname and keep using your personal journey without a public profile. Existing private memberships and scores remain anonymous until you publish your ROND profile. Turning public visibility off hides your identity but does not remove previously synchronized contributions or your friendships. To start new team or group challenge participation after hiding your profile, you must complete public profile setup again. A chosen country is a team identity rather than verified citizenship or physical location.

Community safety reports and blocks

Reports store the reported name or challenge title, your reason and optional details, related identifiers and review status. We use this information to investigate abuse and protect travelers. Reports are retained for up to 90 days, including when an associated account is deleted; direct account relationships are cleared on deletion. Blocks store the account identifiers needed to prevent unwanted connections and hide blocked identities. Contact support@rond.win for urgent safety concerns.

Analytics and service providers

Selected interface events are sent to AppsFlyer to understand product use. These events contain no properties with Health values, distance, account identity, country choices or location. The SDK processes technical device and session information. Advertising identifiers, IDFV collection, Apple Ads attribution, SKAdNetwork and partner sharing are disabled in the app configuration. Health-derived milestones are not sent as remote analytics events. ROND does not sell Health data or use it for advertising targeting.

Cloudflare hosts the website and online service and processes the network information needed to deliver and protect them. Apple handles sign-in and any available App Store purchases. RevenueCat receives your ROND account identifier and Apple-signed purchase and subscription events to help verify and analyze App Store billing. These events may include the product, transaction, purchase time, renewal, expiration or refund status. No Health records, activity routes, movement totals, email address or profile details are sent to RevenueCat. When web membership is available, Stripe processes payment details, invoices and recurring billing. ROND stores billing identifiers, plan, membership status and verification times linked to your ROND account. ROND does not receive full card numbers. No Health records, activity routes or movement totals are sent to Stripe. Stripe may process and retain transaction information according to its privacy policy and legal obligations. MET Norway receives coordinates of your virtual city for weather, rather than your device location. Apple Maps and website map providers process requests needed to display map content under their own privacy policies. These services may process information outside your country.

Website use and support email

The website displays anonymous public rankings and profiles that travelers have opted to make public. Browser appearance preferences may be stored locally. Requests to hosting and map services include ordinary network information such as an IP address. Emailing support provides your email address and the information you choose to include. We use those messages to answer your request and handle related support or privacy matters. Do not send raw Health records, passwords or precise location unless essential to your request.

ROND news and offers

Receiving ROND news and promotional emails is optional and is off by default. If you opt in, we use the email address verified by Sign in with Apple and records of the days you visit ROND while signed in to send welcome messages, product tips and available offers. Visits from supported signed-in surfaces count once per UTC day. We do not use Apple Health records, movement totals, workouts or location to select marketing recipients. Contact addresses and reusable email preference links are encrypted in our server database. Emailit processes the recipient address and email content to deliver messages. Email open and click tracking are disabled.

You can turn off emails in your ROND account settings or use Unsubscribe in an email. Account deletion removes contact, visit and campaign records; a hashed email suppression record can remain to preserve an unsubscribe request. Recent visit-day records are retained for up to 30 days.

Retention and deletion

Local journey information remains on your device until you clear it or remove the app. Clear local journey in Settings removes the saved journey, local challenge, local event history and pending uploads. It does not delete Apple Health records or your online account.

Delete account in the ROND account settings removes your online account and associated country memberships, contributions, private website progress summaries, friendships and challenge participation; your personal journey remains until separately cleared. Exported files and content you shared remain wherever you saved or sent them. Online account information is retained while the account exists. The latest private app progress summary replaces the previous summary. Signing out or clearing local journey data does not by itself delete a previously synced online summary; account deletion removes it.

Service providers may retain operational records or recovery copies according to their retention processes. Support correspondence is retained for handling the request and related operational or legal needs. Contact support for access, correction, deletion or other applicable privacy rights.

Security and choices

ROND uses authenticated online requests, protected local storage and restricted public-profile access. You can change Health permissions, public visibility and online participation, and request help exercising applicable privacy rights. Data transmission and storage cannot be guaranteed completely secure. ROND is a virtual movement experience and is not a medical service or physical navigation system.

Policy updates

We will publish changes on this page and update the effective date. Material changes affecting permissions or data use will also be explained through the relevant app flow.