SyncRun Privacy Policy

Item	Detail
Document version	v1.13
Effective date	11 November 2026
Last amended	4 November 2026

This English text is a translation provided for your convenience. The Korean version is the authoritative original. If the two differ, the Korean version governs. Article numbers match the Korean original so that references line up across both versions.

SyncRun Labs (the "Company") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act of the Republic of Korea, in order to protect the personal information of data subjects and to handle related grievances promptly.

This Policy applies to the iOS and Android running application SyncRun (the "Service") provided by the Company.

The Company's business information is set out in Article 27 of the Terms of Service, and matters concerning the location-based service business filing in Article 16 of the Location-Based Services Terms. Enquiries and requests concerning personal information protection are received at contact@syncrunlabs.com.

Article 1 Purposes of Processing Personal Information

The Company processes personal information for the following purposes. Personal information processed is not used for purposes other than these, and where the purpose of use changes, the Company takes the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

Membership registration and management: identification and authentication for membership-based use of the Service, maintenance and management of membership, prevention of misuse, various notices and communications, and handling of grievances

Service notices: announcements of amendments to the terms and this Policy, service inspections, and material changes to the Service (using the email address; no advertising information is sent)

Measurement, storage and synchronisation of run records: measurement and storage of distance, time, pace, cadence, elevation, route and the like, synchronisation of records across multiple devices on the same account, and creation of run cards

Formation and conduct of group runs: group formation by tapping phones together (UWB proximity determination), connection between users waiting nearby to bump (finding a partner), real-time relay of location, distance and pace among participants of the same session, and assembly of group run results

Sending notifications: push notifications necessary for the conduct of a run, such as the last-runner alert and inactivity check

Recording health and exercise information: measurement of heart rate during a run and its reflection in run records, and calculating, displaying and giving voice guidance on heart rate zones

Ensuring service stability: responding to service failures, backup, and responding to security incidents

Providing paid services: checking subscription status, restoring purchases, providing features according to the subscribed service, and prompting updates of unsupported app versions

Running crews: forming and joining crews (including join requests through invite links and their approval), recording attendance at crew sessions, posting run results to the crew dashboard, and providing crew recaps and rankings

10.

Importing and exporting run records: importing and saving run records from other apps or files chosen by the user, and exporting the user's own run records as files

Article 2 Items of Personal Information Processed

The Company processes the following items of personal information in order to provide the Service.

1. Items collected and processed on membership registration

Category	Item	Method of collection	Required
Account	Apple sign-in identifier	Provided by Apple when using Sign in with Apple	Required
Account	Google sign-in identifier (sub)	Provided by Google when using Sign in with Google	Required
Account	Email address	Provided by Apple only on the first Sign in with Apple, and by Google when using Sign in with Google	Required
Account	User ID (UUID issued by the server)	Generated automatically by the server on joining	Required
Account	Device identifier (UUID generated by the app)	Generated automatically by the app on first launch	Required
Profile	Name (entered by the user; default "Runner")	Entered by the user	Required
Profile	Profile photo	Registered at the user's option	Optional

The device identifier is a UUID generated by the app itself and is not Apple's advertising identifier (IDFA) or Google's advertising ID. The Company does not collect advertising identifiers.

Members sign in with an Apple account or a Google account. An account signed in with Apple and an account signed in with Google are separate accounts and are not linked into one, even where the email address is the same. Because there is no path for signing up or signing in with an email address and password, the Company does not collect passwords. The email address is merely the value Apple or Google provides on sign-in; it is not used as a means of signing in, and an account cannot be accessed by email.

The Company uses the email address it retains only for service notices — announcements of amendments to the terms and this Policy, service inspections, and material changes to the Service. Because the Company does not obtain consent to receive advertising under Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, it does not send advertising information.

Where a user selects "Hide My Email" when using Sign in with Apple, a private relay address created by Apple (@privaterelay.appleid.com) is provided instead. The Company retains and uses it in the same way as any other email address, and in that case cannot know the user's actual email address.

2. Items generated and collected in the course of using the Service

Category	Item	Method of collection	Required
Run record	Distance, time, pace, cadence, elevation gain, 1 km splits, start time	Generated automatically from device sensors and GPS during a run	Required
Run record	Measurement samples taken every 5 seconds during a run (elapsed time, cumulative distance, cadence, altitude)	Generated automatically from device sensors and GPS during a run	Required
Run record	Route (normalised 0–1 coordinates)	Location measured during a run, normalised on the device	Required
Run record	Route coordinates (latitude and longitude passed during the run, with the time of each point)	Generated automatically by device GPS during a run	Required
Run record	Place name (neighbourhood level, result of reverse geocoding)	Reverse geocoding of the run location	Required
Run record	Run title	Generated automatically and editable by the user	Required
Location information	Live latitude and longitude during a run	Collected automatically by device GPS	Required
Location information	Latitude and longitude while waiting to bump (while the group formation screen is open)	Collected automatically by device GPS	Required
Run record	Run card background photo	Chosen by the user in the Photos app or the device's photo picker, or taken by the user with the camera	Optional
Sensitive information	Heart rate (samples every 5 seconds during a run, and the average)	Collected via HealthKit from Apple Watch or heart-rate-capable earbuds	Optional
Technical information	Push token (APNs device token or FCM registration token)	Collected automatically when notification permission is granted	Optional
Usage record	Consent history (item consented to, document version, time of consent or withdrawal)	Recorded automatically on the consent screen	Required
Usage record	App settings (voice guidance, privacy defaults, step-distance calibration factor, notices read, list sorting and statistics period)	Set by the user and calculated automatically during runs	Required
Subscription information	Subscription product, purchase time, expiry time, original transaction identifier (the original transaction ID on the App Store, the purchase token on Google Play), purchase environment (production or test)	Collected when a paid service is purchased or renewed, from transaction information signed by the app marketplace operator (App Store), or from purchase information that the Company's servers look up from the app marketplace operator with the purchase token (Google Play)	Required when using a paid service
Technical information	App version, platform (iOS or Android)	Sent automatically when the app makes requests to the server	Required
Crew information	Crews belonged to, role in the crew (crew leader, deputy leader or member), time of joining and leaving, attendance records for crew sessions, crew name and regular run schedule (entered by the crew leader), crew join requests (the crew asked to join and the time of the request)	Generated automatically when the user accepts joining a crew, asks to join through an invite link or uses a crew; entered by the crew leader	Required when using crews
Run records	Imported run records (workouts and routes from the Health app, contents of GPX or TCX files chosen by the user)	When the user runs an import	Optional
Usage records	Maximum heart rate or year of birth (to calculate heart rate zones)	Entered by the user	Optional

The route of a run record is stored in two forms: normalised 0–1 coordinates used to draw the card and the list, and the actual route coordinates (latitude and longitude with the time of each point) used to redraw the map. The actual route coordinates are kept with the record so that its map can be restored when the user changes phones or reinstalls the app; they are provided only to the user and never to other users. Map images are not stored on the server; each device draws the map from the coordinates. Place names are recorded only at the neighbourhood (dong) level, and users cannot lower this standard in settings.

The measurement samples taken every 5 seconds during a run are the raw data for showing how pace, cadence and altitude changed over the run in the record detail. They are kept as part of the run record; whether heart rate is included depends on the consent for the sensitive information item below.

A run card background photo is collected only where the user chooses one in the Photos app or the device's photo picker, or takes one with the camera, and is kept with that run record. The purpose is to keep the card intact if you change device or delete and reinstall the app. If you do not choose or take a photo, none is collected, and not choosing or taking one places no restriction on any other feature.

Consent history records, item by item, which version of which legal document you consented to, or withdrew consent from, and when. It is retained in order to confirm that the consents required by the Personal Information Protection Act and the Act on the Protection and Use of Location Information were actually obtained, and to determine who must be asked for what again when the documents are amended. Entries accumulate rather than being overwritten, so withdrawals of consent are also retained.

Subscription information is obtained, on the App Store, from transaction information signed by Apple and, on Google Play, from purchase information that the Company's servers look up from Google Play with the purchase token passed on by the app. It is used to confirm which account a purchased subscription belongs to and to provide features according to the subscribed service. Changes in subscription status such as renewal, cancellation and refund are received through notifications that the app marketplace operator sends to the Company's servers. At purchase, the app also passes to the app marketplace operator a random identifier created for each account to link the purchase to the member's account; this value cannot be used to identify the member. Because payment is processed by the app marketplace operator, the Company does not collect payment method information such as card numbers, and payment and receipt records are kept by the app marketplace operator.

Crew information arises only where the user personally accepts joining a crew or personally asks to join through an invite link. A join request is deleted when the crew leader or deputy leader approves or declines it, or 14 days after it is made. It does not arise if the user does not join a crew, and not joining a crew places no restriction on the use of other features. The crew dashboard does not show information about people who ran along but are not crew members (guests); it shows only their number.

Imported run records are collected only where the user personally runs an import, and are saved as the user's own run records. Imported records are not used for crew attendance or crew rankings. Where an imported workout contains heart rate, it is processed according to the consent for the sensitive information item below. Exporting run records as files only creates a file on the user's device, and the Company collects no new information by doing so.

Maximum heart rate or year of birth is collected only where the user enters it in order to use heart rate zones, and is used only to calculate heart rate zones.

The step-distance calibration factor is a multiplier updated each run in order to reconcile the distance measured by steps with actual distance travelled where the location signal has been lost. The value itself is a number between 0.75 and 1.25 and is not used as body-related information.

3. How live location information is processed

The Service uses live latitude and longitude in two cases — during a run and while waiting to bump — each processed on a limited basis as follows. In both cases the data exists only in server memory, is not stored in a database, and coordinates are not written to logs.

During a run, the data is processed as follows.

Relayed through the server to participants of the same session, only during the run and only within the session that has been formed.

Erased when the session ends; nothing remains on the server.

The only route retained in the archive after a run is a normalised, low-resolution line.

Users can turn off live location sharing at any time in the app settings and on the map screen during a run.

While waiting to bump (while the group formation screen is open), the data is processed as follows.

To form a group by tapping phones together, the server must confirm that the two users are near each other, so latitude and longitude are sent to the server only while the group formation screen is open.

This location is used only to find users waiting nearby to bump, and is not provided to other users as coordinates or as a distance. The only items passed to nearby users are display name and profile photo (Article 4).

It is deleted immediately on leaving the screen or starting a run, and deleted automatically within 45 seconds if updates stop. It is also deleted if the app is closed or the connection drops.

If location access is not granted or location collection is paused, bump partners cannot be found and group formation does not occur; solo running can still be used normally.

Detailed matters concerning the collection, use and provision of location information are set out in the separate Location-Based Services Terms, and the Company complies with the Act on the Protection and Use of Location Information.

4. Processing of sensitive information

The Company processes the following as sensitive information under Article 23 of the Personal Information Protection Act.

Sensitive item	Purpose	Retention and use period	Basis for collection
Heart rate (health information)	Storing the average heart rate of a run record and heart rate samples taken every 5 seconds during the run, showing heart rate changes in the record detail, displaying metrics and heart rate zones during a run, voice guidance, storing heart rate from imported workouts	Until withdrawal of membership	Separate consent of the data subject

Heart rate is collected only where the user connects an Apple Watch or heart-rate-capable earbuds and grants Health (HealthKit) access, or allows the heart rate of a workout to be read when importing workouts from the Health app.

Heart rate is optional; there is no restriction on using other features of the Service if the user has no heart rate device or declines the permission.

The server stores, as part of the run record, the average heart rate value and the heart rate samples taken every 5 seconds during the run. Samples are taken only while the run is in progress, not while it is paused.

Users may withdraw Health access at any time in the device settings.

5. Unique identifying information

The Company does not process any unique identifying information under Article 24 of the Personal Information Protection Act, such as resident registration numbers, passport numbers, driver's licence numbers or alien registration numbers.

Article 3 Period of Processing and Retention of Personal Information

The Company processes and retains personal information within the retention and use period prescribed by law, or the period consented to by the data subject at the time of collection.

The processing and retention periods are as follows.

Item	Retention and use period
Account information (Apple or Google sign-in identifier, email address, user ID, device identifier)	Until withdrawal of membership
Profile information (name, profile photo)	Until withdrawal of membership
Run records (distance, time, pace, cadence, elevation, splits, start time, 5-second measurement samples, normalised route, actual route coordinates, place name, title)	Until withdrawal of membership or deletion of that record
Run card background photos	Until withdrawal of membership, deletion of that record, or removal of the photo by the user
Consent history (item, document version, time)	Until withdrawal of membership
App settings (including the step-distance calibration factor)	Until withdrawal of membership
Subscription information (subscription product, purchase time, expiry time, original transaction identifier, purchase environment)	Until withdrawal of membership
Heart rate (average and 5-second samples)	Until withdrawal of membership or deletion of that record
Crew information (membership, role, time of joining, attendance records, crew name, regular run schedule)	Until leaving the crew, deletion of the crew, or withdrawal of membership
Crew join requests	Until approved or declined, or 14 days after the request (or until withdrawal of membership, if earlier)
Imported run records	Until withdrawal of membership or deletion of that record
Maximum heart rate or year of birth	Until withdrawal of membership or deletion by the user
Push token (APNs or FCM)	Until withdrawal of membership or withdrawal of notification permission
Live latitude and longitude during a run	Erased immediately when the session ends (held only in server memory, not stored in a database)
Latitude and longitude while waiting to bump	Erased immediately on leaving the group formation screen; erased automatically within 45 seconds if updates stop (held only in server memory, not stored in a database)
Records confirming use and provision of location information	Six months (Article 16(2) of the Act on the Protection and Use of Location Information)

Where preservation is required under the following laws, the information is retained for the corresponding period.

Legal basis	Item preserved	Preservation period
Article 16(2) of the Act on the Protection and Use of Location Information	Records confirming use and provision of location information	Six months
Act on Consumer Protection in Electronic Commerce	Records on consumer complaints or dispute handling	Three years
Protection of Communications Secrets Act	Service use log records	Three months

Article 4 Provision of Personal Information to Third Parties

The Company processes personal information only within the scope specified in Article 1, and provides personal information to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the consent of the data subject or under a specific provision of law.

The Company provides personal information to third parties as follows.

Recipient	Purpose	Items provided	When and how	Retention and use period
Participants of the same running session	To see one another's location and progress during a group run	Live location (latitude and longitude), distance, pace, name and profile photo during the run	Relayed in real time while the group run session is in progress	Provision stops when the session ends
Users waiting nearby to bump	To identify each other as bump partners and, where automatic formation does not occur, to request and accept joining	Display name and profile photo (location and distance are not provided)	While both users have the group formation screen open	Provision stops immediately on leaving the screen
Members of the same crew	Running the crew (checking attendance, crew recaps and rankings)	Display name, profile photo, role in the crew, attendance at crew sessions and the average distance of all attendees of that session, rank, attendance count and distance where the user is in the top 10 of the crew recap ranking, the attendance count where the user has the most attendance, and, to the other person only, the number of crew sessions run together where the two have run the most crew sessions together (results of individual sessions, routes and locations are not provided)	On the crew dashboard and recap, from when the user accepts joining the crew	Provision stops on leaving the crew or deletion of the crew
Crew leader and deputy leader of the same crew	Managing the crew (correcting attendance, deciding which crew a session run by more than one crew belongs to)	The items provided to crew members above, together with a summary of run results for each crew session (distance, time, pace) and crew attendance count (routes and locations are not provided)	On the crew dashboard, from when the user accepts joining the crew	Provision stops on leaving the crew or deletion of the crew
Crew leader and deputy leader of the crew the user asked to join	Deciding whether to approve the join request	Display name, profile photo, and whether the user has finished a group run with that crew leader or deputy leader	On the crew management screen, from when the user asks to join through an invite link	Provision stops on approval or decline, or 14 days after the request (once approved, provision continues as provision to crew members above)
People who open an invite link given out by the crew leader or deputy leader	Confirming which crew the invitation is for	Display name of the crew leader or deputy leader who created the link, crew name, number of crew members	When the link is opened, from when the crew leader or deputy leader creates the link and gives it out	Provision stops when a new link is created, the link is turned off, or 14 days after the link is created

The above provision to third parties is limited as follows.

Live location and metrics during a run are provided only to participants of a session formed by tapping phones together, and not to users outside the session.

They are provided only while the run is in progress, and stop immediately when the session ends.

Display name and profile photo while waiting to bump are provided only to nearby users who, like the user, have the group formation screen open. Nothing is provided if only one side is waiting, and location and distance are never provided. Provision stops immediately on leaving the screen.

Users can turn off sharing of live location and metrics at any time in the app settings or on the map screen during a run. Doing so does not affect the measurement and saving of their own run records.

The display name and profile photo of a user who asks to join through an invite link are provided only to that crew's leader and deputy leader. Until the request is approved, crew members' information is not provided to the requesting user, and the requesting user's information is not provided to other crew members.

Information is provided to crew members only for crews the user has accepted joining, and only results run in that crew's sessions. Runs outside the crew and imported records are not provided, and nothing is provided after the user leaves the crew.

Run results for each crew session (distance, time, pace) and crew attendance counts are provided only to the crew leader and deputy leader, who need them to correct attendance and manage the crew, and are not provided to other crew members. Other crew members see the average distance of all attendees for each session.

Where the Company provides personal location information to a third party, it notifies the subject of personal location information of the recipient, the date and time, and the purpose of provision, in accordance with Article 19(3) of the Act on the Protection and Use of Location Information.

The Company does not provide or sell users' personal information to third parties for advertising or marketing purposes.

Article 5 Entrustment of Personal Information Processing

The Company entrusts personal information processing tasks as follows in order to provide the Service smoothly.

Trustee	Entrusted work	Server location	Retention and use period
Google Cloud Korea, LLC	Operation of server infrastructure (application server, database and image store) and data storage	Republic of Korea (Seoul)	Until withdrawal of membership or termination of the entrustment agreement
Apple Inc.	Sending push notifications (APNs), Sign in with Apple authentication	United States	Until withdrawal of membership or termination of the entrustment agreement
Google LLC	Sign in with Google authentication, sending push notifications (FCM)	United States	Until withdrawal of membership or termination of the entrustment agreement

When concluding an entrustment agreement, the Company specifies in the contract or other document, in accordance with Article 26 of the Personal Information Protection Act, matters such as the prohibition on processing personal information beyond the purpose of the entrusted work, technical and administrative safeguards, restrictions on sub-entrustment, supervision of the trustee, and liability including compensation for damage, and supervises whether the trustee processes personal information safely.

Where the content of the entrusted work or the trustee changes, the Company will disclose this without delay through this Privacy Policy.

Article 5-2 Transfer of Personal Information Abroad

The Company entrusts sign-in authentication and the sending of push notifications to the overseas providers set out in paragraph 2 in order to provide the Service, and the corresponding items are therefore transferred abroad for processing. The server infrastructure and database are located in the Republic of Korea (Seoul).

Details of the transfer abroad are as follows, by recipient.

Item	Detail
Recipient	Apple Inc.
Contact	https://www.apple.com/legal/privacy/contact/
Country of transfer	United States
Time and method of transfer	Transmitted from time to time over the information and communications network (HTTPS) at the time of sign-in and of sending notifications
Items transferred	Apple sign-in identifier, push token (APNs device token)
Purpose of use	Sign in with Apple authentication, sending push notifications
Retention and use period	Until withdrawal of membership or termination of the entrustment agreement

Item	Detail
Recipient	Google LLC
Contact	https://support.google.com/policies/contact/general_privacy_form
Country of transfer	United States
Time and method of transfer	Transmitted from time to time over the information and communications network (HTTPS) at the time of sending notifications
Items transferred	Push token (FCM registration token)
Purpose of use	Sending push notifications
Retention and use period	Until withdrawal of membership or termination of the entrustment agreement

The above transfer abroad constitutes entrustment of processing and storage of personal information necessary for the performance of a contract concluded with the data subject under Article 28-8(1)3 of the Personal Information Protection Act, and is made without separate consent by disclosing its content in this Policy in accordance with that subparagraph and Article 29-8 of the Enforcement Decree of that Act.

You may refuse the transfer abroad. However, because sign-in authentication is a precondition for using the Service, refusing the transfer made for authentication restricts membership registration and use of the Service; existing members may stop the transfer by withdrawing their membership. The transfer for push notifications can be refused individually by withdrawing notification permission in the device settings, in which case other features remain fully usable. Refusals are received at the contact in Article 11.

When transferring personal information abroad, the Company takes measures necessary to ensure safety, such as encryption, in accordance with Article 28-8(4) of the Personal Information Protection Act, and reflects in its contracts that the recipient must not process personal information beyond the stated purpose.

Article 6 Procedure and Method of Destroying Personal Information

Where personal information becomes unnecessary — because the retention period has elapsed, the purpose of processing has been achieved and the like — the Company destroys it without delay.

1. Destruction procedure

The Company uses the device (local storage) as the primary store, and servers as a store for backup, multi-device synchronisation and assembly of group run results.

On withdrawal of membership, the account and data on the server are deleted first, followed by the profile, profile photo, run records and synchronisation metadata stored on the device.

Deletion of an individual run record is handled by a soft delete followed by the creation of a deletion marker (tombstone) propagated to all devices on the same account, so that a record deleted on one device does not reappear on another.

A run card background photo is deleted from the store immediately, even where the record itself remains as a deletion marker. The same applies where the user removes the photo from the card and on withdrawal of membership. The photo store keeps no earlier versions and no retention window from which a deleted object could be restored.

Information that must be preserved for a period under the law is moved to a separate database or location, retained for the preservation period, and then destroyed.

2. Destruction method

Information in electronic file form is permanently deleted using technical methods that make the records unrecoverable.

Personal information recorded and stored on paper is destroyed by shredding or incineration.

Article 7 Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

Data subjects may exercise the following rights concerning personal information protection against the Company at any time.

Request for access to personal information

Request for correction where there are errors

Request for deletion

Request for suspension of processing

Withdrawal of consent (including withdrawal of membership)

Rights may be exercised as follows.

Directly in the app: changing the profile name and photo, viewing, editing and deleting run records, changing location sharing settings, and withdrawing membership can all be done in the Me tab of the app.

In writing or by email: requests may be made to the personal information protection officer named in Article 11. The Company will act on them without delay.

Device settings: the app access permissions in Article 14 can be changed or withdrawn at any time in the device settings.

Where a data subject requests correction or deletion on account of an error in personal information, the Company does not use or provide that personal information until the correction or deletion is complete.

Rights may be exercised through a representative, such as the data subject's legal representative or a duly authorised person. In that case a power of attorney in the form of Annex 11 of the Public Notice on Methods of Processing Personal Information must be submitted.

Data subjects must not infringe, in violation of the Personal Information Protection Act or other relevant laws, the personal information or privacy of themselves or others that the Company processes.

When a request for access, correction, deletion or suspension of processing is made, the Company verifies whether the person making it is the data subject or a duly authorised representative.

Article 8 Measures to Ensure the Safety of Personal Information

In accordance with Article 29 of the Personal Information Protection Act and Article 30 of its Enforcement Decree, the Company takes the following measures.

1. Administrative measures

Establishment and implementation of an internal management plan

Minimising the number of personnel handling personal information and managing their access rights

Regular training for personnel handling personal information

Designation of a personal information protection officer and a location information manager

2. Technical measures

Encryption in transit: all communication between the app and the servers is encrypted using HTTPS/WSS.

No passwords held: because sign-in is by Sign in with Apple or Sign in with Google only, the Company does not hold users' passwords.

Minimisation of location information: live latitude and longitude during a run and while waiting to bump exist only in server memory and are not stored in databases or logs. The actual route coordinates kept in a run record are provided only to the owner of that record and never to other users or third parties, and place names are stored only at the neighbourhood level.

No advertising identifiers collected: the advertising identifier (IDFA or advertising ID) is not used as a device identifier.

Differentiated access rights to the personal information processing system, and access control

Retention of access records and prevention of forgery or alteration

Installation of security programs and periodic inspection and updating

3. Physical measures

Servers are located in data centres operated by the cloud hosting provider (Google Cloud Korea, LLC), and that provider's physical access control policies apply.

The servers on which personal information is stored, and their backups, are located in the Republic of Korea (Seoul). Matters concerning transfer abroad are governed by Article 5-2.

Article 9 Installation and Operation of Devices that Automatically Collect Personal Information, and Refusal Thereof

The Company does not install or operate devices that automatically collect user information, such as cookies or web beacons.

The Service is provided as a mobile application and does not use online behavioural advertising tools or third-party advertising or analytics SDKs that collect users' behavioural information. Accordingly, there is no separate method of refusing automatic collection devices.

Article 10 Processing of Personal Information of Children Under 14

The Service is intended for users aged 14 or over.

The Company does not permit children under the age of 14 to join, and does not provide a path for joining with the consent of a legal representative.

The Company checks on registration whether the applicant is under the age of 14, and restricts registration where they are confirmed to be under 14.

If the Company becomes aware that the personal information of a child under 14 has been collected, it destroys that information and deletes the related account without delay.

If you believe that the personal information of a child under 14 has been collected, please inform the personal information protection officer named in Article 11.

Article 11 Personal Information Protection Officer

The Company designates a personal information protection officer as follows, who has overall responsibility for work concerning the processing of personal information and for handling data subjects' complaints and providing remedies in relation to personal information processing.

Item	Detail
Name	Changmok Lee
Position	Representative
Email	contact@syncrunlabs.com

Data subjects may direct enquiries, complaints and requests for remedies concerning personal information protection to the contact above. The Company will answer and deal with them without delay.

Article 12 Department Receiving and Handling Requests for Access to Personal Information

Data subjects may make requests for access to personal information under Article 35 of the Personal Information Protection Act to the department below. The Company will endeavour to process such requests promptly.

Item	Detail
Responsible	SyncRun personal information access request desk
Email	contact@syncrunlabs.com

Access to, correction and deletion of the profile and run records, and withdrawal of membership, can be done directly in the Me tab of the app; other access requests are received at the email address above.

Article 13 Remedies for Infringement of Rights

Data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Privacy Infringement Report Centre of the Korea Internet & Security Agency and the like, in order to obtain relief from infringement of personal information. For other reports of and consultation on privacy infringement, please contact the bodies below.

Body	Role	Telephone	Website
Personal Information Dispute Mediation Committee	Applications for personal information dispute mediation and collective dispute mediation (civil resolution)	1833-6972 (no area code)	www.kopico.go.kr
Privacy Infringement Report Centre (KISA)	Reports of and requests for consultation on privacy infringement	118 (no area code)	privacy.kisa.or.kr
Cybercrime Investigation Division, Supreme Prosecutors' Office	Investigation of privacy infringement cases	1301 (no area code)	www.spo.go.kr
Cyber Investigation Bureau, National Office of Investigation, Korean National Police Agency	Investigation of privacy infringement cases	182 (no area code)	ecrm.cyber.go.kr

In addition, a person whose rights or interests are infringed by a disposition or omission of the head of a public institution in respect of a request under Article 35 (access), Article 36 (correction or deletion) or Article 37 (suspension of processing) of the Personal Information Protection Act may request an administrative appeal as prescribed by the Administrative Appeals Act.

Central Administrative Appeals Commission: 110 (no area code), www.simpan.go.kr

Article 14 Guidance on App Access Permissions

In accordance with Article 22-2 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Company designates as mandatory only the minimum access permissions necessary to provide the Service, and designates other permissions as optional so that users can use the basic features of the Service even without granting them.

1. Mandatory access permissions

Permission	Purpose
Location	To measure distance and route during a run, to share live location with participants within a group run session, and to find users waiting nearby to bump
Motion and physical activity	To read steps and movement in order to measure pace and cadence, and to measure by steps the distance travelled where the location signal has been lost

2. Optional access permissions

Permission	Purpose	If not granted
Notifications	Sending notifications needed during a run, such as the last-runner alert and inactivity check	Those notifications cannot be received; other features work normally
Health	Reading heart rate; reading workouts and routes to import run records	Heart rate is not recorded and workouts cannot be imported from the Health app, but runs can still be measured on the basis of distance and pace. Heart rate is not a prerequisite for any feature
Photos	Setting the profile photo and run card background, and saving run card images	The profile photo and card background cannot be set, and cards cannot be saved to the Photos app
Camera	Taking a photo to use as a run card background	A card background cannot be taken with the camera, but a saved photo can still be chosen
Nearby Interaction	Precise distance determination (UWB) when tapping phones together to form a group	Automatic bumping is unavailable. A group can still be formed by requesting to join a nearby waiting user

The Health and Nearby Interaction permissions are requested only on iOS. On Android, photos are chosen with the device's photo picker, so the Photos permission is not requested.

3. Processing of photos

Of the images loaded through the Photos permission or the device's photo picker, or taken with the camera, only those the user sets as a profile photo or as a run card background are kept on the servers. A profile photo is kept so that it can be restored on reinstallation or re-sign-in and shown to companions; a card background photo is kept so that the card survives a change of device or a reinstallation. No other image leaves the device.

A card background photo is provided only to the person who created that record, and not to other users. If the user removes the photo from the card, it is also deleted from the store.

4. How to withdraw permissions

Users may change or withdraw each access permission at any time in the device settings (iOS: Settings > Privacy & Security, or Settings > SyncRun; Android: Settings > Apps > SyncRun > Permissions).

Article 15 Changes to this Privacy Policy

This Privacy Policy applies from 11 November 2026.

Where content is added, deleted or amended in response to changes in laws, policies or security technology, the Company will give notice through the in-app notices and this document from seven days before the change takes effect (30 days before, where the change is unfavourable to users).

The revision history of this Policy is as follows. If you need the full text of a previous version, you may request it from the contact in Article 11.

Version	Effective date	Notes
v1.13	11 November 2026	States that a run card background photo is also collected when the user chooses it in the device's photo picker or takes it with the camera
v1.12	3 November 2026	Reflects the collection method of subscription information for Google Play subscription sales (purchase token look-up and status-change notifications) and the passing of an account-linking identifier, adds the camera permission (taking run card backgrounds), and states which permissions are requested on each platform
v1.11	30 October 2026	Reflects crew invite links — join requests received through a link (crew information items and retention period), and provision to the crew leader and deputy leader of the crew asked to join and to people who open the link, and includes the content of v1.10, which it replaced before that version took effect
v1.10	Replaced by v1.11 before taking effect	Narrows what is provided to members of the same crew — results of individual crew sessions and attendance counts go only to the crew leader and deputy leader, rankings show only the top 10, and the most frequent running pair is shown only to those two people (announced 20 October 2026; absorbed into v1.11 before its effective date)
v1.9	20 October 2026	Reflects running crews (crew information items and provision to members of the same crew), importing run records (reading workouts and routes from the Health app) and heart rate zone calculation (maximum heart rate or year of birth)
v1.8	17 October 2026	Reflects the processing purpose, subscription information items and retention period for paid services (in-app subscriptions), the purpose of using app version information, and the start of recording of records confirming use and provision of location information
v1.7	30 September 2026	Reflects the retention of actual route coordinates (to restore maps) and 5-second measurement samples in run records, the extension of heart rate processing from the average to samples, and the discontinued saving of workouts to the Health app
v1.6	20 September 2026	Reflects the items collected, trustees, transfers abroad and app access permissions arising from Google sign-in and the Android app, and includes the content of v1.5, which it replaced before that version took effect
v1.5	Replaced by v1.6 before taking effect	Reflects the retention in the account of run card background photos, consent history and app settings (announced 17 September 2026; absorbed into v1.6 before its effective date)
v1.4	16 September 2026	Change of server infrastructure trustee and country of storage (Seoul, Republic of Korea); correction of transfer-abroad details
v1.3	10 September 2026	Statement of the operating entity and business information, and the name of the personal information protection officer
v1.0–v1.2	6 August 2026 – 28 August 2026	Establishment and amendments during the free beta test period

Addendum

This Privacy Policy takes effect on 11 November 2026 and replaces the previous Policy (effective 3 November 2026).

SyncRun Labs Sole proprietorship · Representative Changmok Lee · Business registration number 656-09-03142 32 Daehak-ro 8-gil, Gyeongsan-si, Gyeongsangbuk-do, Republic of Korea Contact: contact@syncrunlabs.com

Terms & policies