SyncRun Privacy Policy

Item	Detail
Document version	v1.6
Effective date	24 October 2026
Last amended	17 September 2026

This English text is a translation provided for your convenience. The Korean version is the authoritative original. If the two differ, the Korean version governs. Article numbers match the Korean original so that references line up across both versions.

SyncRun Labs (the "Company") establishes and discloses this Privacy Policy in accordance with Article 30 of the Personal Information Protection Act of the Republic of Korea, in order to protect the personal information of data subjects and to handle related grievances promptly.

This Policy applies to the iOS and Android running application SyncRun (the "Service") provided by the Company.

The Company's business information is set out in Article 27 of the Terms of Service, and matters concerning the location-based service business filing in Article 16 of the Location-Based Services Terms. Enquiries and requests concerning personal information protection are received at contact@syncrunlabs.com.

Article 1 Purposes of Processing Personal Information

The Company processes personal information for the following purposes. Personal information processed is not used for purposes other than these, and where the purpose of use changes, the Company takes the necessary measures, such as obtaining separate consent under Article 18 of the Personal Information Protection Act.

Membership registration and management: identification and authentication for membership-based use of the Service, maintenance and management of membership, prevention of misuse, various notices and communications, and handling of grievances

Service notices: announcements of amendments to the terms and this Policy, service inspections, and material changes to the Service (using the email address; no advertising information is sent)

Measurement, storage and synchronisation of run records: measurement and storage of distance, time, pace, cadence, elevation, route and the like, synchronisation of records across multiple devices on the same account, and creation of run cards

Formation and conduct of group runs: group formation by tapping phones together (UWB proximity determination), connection between users waiting nearby to bump (finding a partner), real-time relay of location, distance and pace among participants of the same session, and assembly of group run results

Sending notifications: push notifications necessary for the conduct of a run, such as the last-runner alert and inactivity check

Recording health and exercise information: measurement of heart rate during a run and its reflection in run records, and, where the user chooses, saving workouts to the Health (HealthKit) app

Ensuring service stability: responding to service failures, backup, and responding to security incidents

Article 2 Items of Personal Information Processed

The Company processes the following items of personal information in order to provide the Service.

1. Items collected and processed on membership registration

Category	Item	Method of collection	Required
Account	Apple sign-in identifier	Provided by Apple when using Sign in with Apple	Required
Account	Google sign-in identifier (sub)	Provided by Google when using Sign in with Google	Required
Account	Email address	Provided by Apple only on the first Sign in with Apple, and by Google when using Sign in with Google	Required
Account	User ID (UUID issued by the server)	Generated automatically by the server on joining	Required
Account	Device identifier (UUID generated by the app)	Generated automatically by the app on first launch	Required
Profile	Name (entered by the user; default "Runner")	Entered by the user	Required
Profile	Profile photo	Registered at the user's option	Optional

The device identifier is a UUID generated by the app itself and is not Apple's advertising identifier (IDFA) or Google's advertising ID. The Company does not collect advertising identifiers.

Members sign in with an Apple account or a Google account. An account signed in with Apple and an account signed in with Google are separate accounts and are not linked into one, even where the email address is the same. Because there is no path for signing up or signing in with an email address and password, the Company does not collect passwords. The email address is merely the value Apple or Google provides on sign-in; it is not used as a means of signing in, and an account cannot be accessed by email.

The Company uses the email address it retains only for service notices — announcements of amendments to the terms and this Policy, service inspections, and material changes to the Service. Because the Company does not obtain consent to receive advertising under Article 50 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, it does not send advertising information.

Where a user selects "Hide My Email" when using Sign in with Apple, a private relay address created by Apple (@privaterelay.appleid.com) is provided instead. The Company retains and uses it in the same way as any other email address, and in that case cannot know the user's actual email address.

2. Items generated and collected in the course of using the Service

Category	Item	Method of collection	Required
Run record	Distance, time, pace, cadence, elevation gain, 1 km splits	Generated automatically from device sensors and GPS during a run	Required
Run record	Route (normalised 0–1 coordinates)	Location measured during a run, normalised on the device	Required
Run record	Place name (neighbourhood level, result of reverse geocoding)	Reverse geocoding of the run location	Required
Run record	Run title	Generated automatically and editable by the user	Required
Location information	Live latitude and longitude during a run	Collected automatically by device GPS	Required
Location information	Latitude and longitude while waiting to bump (while the group formation screen is open)	Collected automatically by device GPS	Required
Run record	Run card background photo	Chosen by the user in the Photos app	Optional
Sensitive information	Heart rate (average heart rate)	Collected via HealthKit from Apple Watch or heart-rate-capable earbuds	Optional
Technical information	Push token (APNs device token or FCM registration token)	Collected automatically when notification permission is granted	Optional
Usage record	Consent history (item consented to, document version, time of consent or withdrawal)	Recorded automatically on the consent screen	Required
Usage record	App settings (voice guidance, privacy defaults, step-distance calibration factor, notices read, list sorting and statistics period)	Set by the user and calculated automatically during runs	Required

The route stored on the server as part of a run record consists of coordinates normalised to values between 0 and 1; actual latitude and longitude are not stored on the server. Place names are recorded only at the neighbourhood (dong) level. Users cannot lower these standards in settings.

A run card background photo is collected only where the user chooses one in the Photos app, and is kept with that run record. The purpose is to keep the card intact if you change device or delete and reinstall the app. If you do not choose a photo, none is collected, and not choosing one places no restriction on any other feature.

Consent history records, item by item, which version of which legal document you consented to, or withdrew consent from, and when. It is retained in order to confirm that the consents required by the Personal Information Protection Act and the Act on the Protection and Use of Location Information were actually obtained, and to determine who must be asked for what again when the documents are amended. Entries accumulate rather than being overwritten, so withdrawals of consent are also retained.

The step-distance calibration factor is a multiplier updated each run in order to reconcile the distance measured by steps with actual distance travelled where the location signal has been lost. The value itself is a number between 0.75 and 1.25 and is not used as body-related information.

3. How live location information is processed

The Service uses live latitude and longitude in two cases — during a run and while waiting to bump — each processed on a limited basis as follows. In both cases the data exists only in server memory, is not stored in a database, and coordinates are not written to logs.

During a run, the data is processed as follows.

Relayed through the server to participants of the same session, only during the run and only within the session that has been formed.

Erased when the session ends; nothing remains on the server.

The only route retained in the archive after a run is a normalised, low-resolution line.

Users can turn off live location sharing at any time in the app settings and on the map screen during a run.

While waiting to bump (while the group formation screen is open), the data is processed as follows.

To form a group by tapping phones together, the server must confirm that the two users are near each other, so latitude and longitude are sent to the server only while the group formation screen is open.

This location is used only to find users waiting nearby to bump, and is not provided to other users as coordinates or as a distance. The only items passed to nearby users are display name and profile photo (Article 4).

It is deleted immediately on leaving the screen or starting a run, and deleted automatically within 45 seconds if updates stop. It is also deleted if the app is closed or the connection drops.

If location access is not granted or location collection is paused, bump partners cannot be found and group formation does not occur; solo running can still be used normally.

Detailed matters concerning the collection, use and provision of location information are set out in the separate Location-Based Services Terms, and the Company complies with the Act on the Protection and Use of Location Information.

4. Processing of sensitive information

The Company processes the following as sensitive information under Article 23 of the Personal Information Protection Act.

Sensitive item	Purpose	Retention and use period	Basis for collection
Heart rate (health information)	Calculating and storing the average heart rate of a run record, displaying metrics during a run, voice guidance	Until withdrawal of membership	Separate consent of the data subject

Heart rate is collected only where the user connects an Apple Watch or heart-rate-capable earbuds and grants Health (HealthKit) access.

Heart rate is optional; there is no restriction on using other features of the Service if the user has no heart rate device or declines the permission.

It is stored on the server as the average heart rate value of the run record.

Users may withdraw Health access at any time in the device settings.

5. Unique identifying information

The Company does not process any unique identifying information under Article 24 of the Personal Information Protection Act, such as resident registration numbers, passport numbers, driver's licence numbers or alien registration numbers.

Article 3 Period of Processing and Retention of Personal Information

The Company processes and retains personal information within the retention and use period prescribed by law, or the period consented to by the data subject at the time of collection.

The processing and retention periods are as follows.

Item	Retention and use period
Account information (Apple or Google sign-in identifier, email address, user ID, device identifier)	Until withdrawal of membership
Profile information (name, profile photo)	Until withdrawal of membership
Run records (distance, time, pace, cadence, elevation, splits, normalised route, place name, title)	Until withdrawal of membership
Run card background photos	Until withdrawal of membership, deletion of that record, or removal of the photo by the user
Consent history (item, document version, time)	Until withdrawal of membership
App settings (including the step-distance calibration factor)	Until withdrawal of membership
Heart rate (average heart rate)	Until withdrawal of membership
Push token (APNs or FCM)	Until withdrawal of membership or withdrawal of notification permission
Live latitude and longitude during a run	Erased immediately when the session ends (held only in server memory, not stored in a database)
Latitude and longitude while waiting to bump	Erased immediately on leaving the group formation screen; erased automatically within 45 seconds if updates stop (held only in server memory, not stored in a database)
Records confirming use and provision of location information	Six months (Article 16(2) of the Act on the Protection and Use of Location Information). The time from which these are recorded is set out in Article 5 of the Location-Based Services Terms

Where preservation is required under the following laws, the information is retained for the corresponding period.

Legal basis	Item preserved	Preservation period
Article 16(2) of the Act on the Protection and Use of Location Information	Records confirming use and provision of location information	Six months
Act on Consumer Protection in Electronic Commerce	Records on consumer complaints or dispute handling	Three years
Protection of Communications Secrets Act	Service use log records	Three months

Article 4 Provision of Personal Information to Third Parties

The Company processes personal information only within the scope specified in Article 1, and provides personal information to third parties only where Articles 17 and 18 of the Personal Information Protection Act apply, such as with the consent of the data subject or under a specific provision of law.

The Company provides personal information to third parties as follows.

Recipient	Purpose	Items provided	When and how	Retention and use period
Participants of the same running session	To see one another's location and progress during a group run	Live location (latitude and longitude), distance, pace, name and profile photo during the run	Relayed in real time while the group run session is in progress	Provision stops when the session ends
Users waiting nearby to bump	To identify each other as bump partners and, where automatic formation does not occur, to request and accept joining	Display name and profile photo (location and distance are not provided)	While both users have the group formation screen open	Provision stops immediately on leaving the screen

The above provision to third parties is limited as follows.

Live location and metrics during a run are provided only to participants of a session formed by tapping phones together, and not to users outside the session.

They are provided only while the run is in progress, and stop immediately when the session ends.

Display name and profile photo while waiting to bump are provided only to nearby users who, like the user, have the group formation screen open. Nothing is provided if only one side is waiting, and location and distance are never provided. Provision stops immediately on leaving the screen.

Users can turn off sharing of live location and metrics at any time in the app settings or on the map screen during a run. Doing so does not affect the measurement and saving of their own run records.

Where the Company provides personal location information to a third party, it notifies the subject of personal location information of the recipient, the date and time, and the purpose of provision, in accordance with Article 19(3) of the Act on the Protection and Use of Location Information.

The Company does not provide or sell users' personal information to third parties for advertising or marketing purposes.

Article 5 Entrustment of Personal Information Processing

The Company entrusts personal information processing tasks as follows in order to provide the Service smoothly.

Trustee	Entrusted work	Server location	Retention and use period
Google Cloud Korea, LLC	Operation of server infrastructure (application server, database and image store) and data storage	Republic of Korea (Seoul)	Until withdrawal of membership or termination of the entrustment agreement
Apple Inc.	Sending push notifications (APNs), Sign in with Apple authentication	United States	Until withdrawal of membership or termination of the entrustment agreement
Google LLC	Sign in with Google authentication, sending push notifications (FCM)	United States	Until withdrawal of membership or termination of the entrustment agreement

When concluding an entrustment agreement, the Company specifies in the contract or other document, in accordance with Article 26 of the Personal Information Protection Act, matters such as the prohibition on processing personal information beyond the purpose of the entrusted work, technical and administrative safeguards, restrictions on sub-entrustment, supervision of the trustee, and liability including compensation for damage, and supervises whether the trustee processes personal information safely.

Where the content of the entrusted work or the trustee changes, the Company will disclose this without delay through this Privacy Policy.

Article 5-2 Transfer of Personal Information Abroad

The Company entrusts sign-in authentication and the sending of push notifications to the overseas providers set out in paragraph 2 in order to provide the Service, and the corresponding items are therefore transferred abroad for processing. The server infrastructure and database are located in the Republic of Korea (Seoul).

Details of the transfer abroad are as follows, by recipient.

Item	Detail
Recipient	Apple Inc.
Contact	https://www.apple.com/legal/privacy/contact/
Country of transfer	United States
Time and method of transfer	Transmitted from time to time over the information and communications network (HTTPS) at the time of sign-in and of sending notifications
Items transferred	Apple sign-in identifier, push token (APNs device token)
Purpose of use	Sign in with Apple authentication, sending push notifications
Retention and use period	Until withdrawal of membership or termination of the entrustment agreement

Item	Detail
Recipient	Google LLC
Contact	https://support.google.com/policies/contact/general_privacy_form
Country of transfer	United States
Time and method of transfer	Transmitted from time to time over the information and communications network (HTTPS) at the time of sending notifications
Items transferred	Push token (FCM registration token)
Purpose of use	Sending push notifications
Retention and use period	Until withdrawal of membership or termination of the entrustment agreement

The above transfer abroad constitutes entrustment of processing and storage of personal information necessary for the performance of a contract concluded with the data subject under Article 28-8(1)3 of the Personal Information Protection Act, and is made without separate consent by disclosing its content in this Policy in accordance with that subparagraph and Article 29-8 of the Enforcement Decree of that Act.

You may refuse the transfer abroad. However, because sign-in authentication is a precondition for using the Service, refusing the transfer made for authentication restricts membership registration and use of the Service; existing members may stop the transfer by withdrawing their membership. The transfer for push notifications can be refused individually by withdrawing notification permission in the device settings, in which case other features remain fully usable. Refusals are received at the contact in Article 11.

When transferring personal information abroad, the Company takes measures necessary to ensure safety, such as encryption, in accordance with Article 28-8(4) of the Personal Information Protection Act, and reflects in its contracts that the recipient must not process personal information beyond the stated purpose.

Article 6 Procedure and Method of Destroying Personal Information

Where personal information becomes unnecessary — because the retention period has elapsed, the purpose of processing has been achieved and the like — the Company destroys it without delay.

1. Destruction procedure

The Company uses the device (local storage) as the primary store, and servers as a store for backup, multi-device synchronisation and assembly of group run results.

On withdrawal of membership, the account and data on the server are deleted first, followed by the profile, profile photo, run records and synchronisation metadata stored on the device.

Deletion of an individual run record is handled by a soft delete followed by the creation of a deletion marker (tombstone) propagated to all devices on the same account, so that a record deleted on one device does not reappear on another.

A run card background photo is deleted from the store immediately, even where the record itself remains as a deletion marker. The same applies where the user removes the photo from the card and on withdrawal of membership. The photo store keeps no earlier versions and no retention window from which a deleted object could be restored.

Information that must be preserved for a period under the law is moved to a separate database or location, retained for the preservation period, and then destroyed.

2. Destruction method

Information in electronic file form is permanently deleted using technical methods that make the records unrecoverable.

Personal information recorded and stored on paper is destroyed by shredding or incineration.

Article 7 Rights and Obligations of Data Subjects and Legal Representatives, and How to Exercise Them

Data subjects may exercise the following rights concerning personal information protection against the Company at any time.

Request for access to personal information

Request for correction where there are errors

Request for deletion

Request for suspension of processing

Withdrawal of consent (including withdrawal of membership)

Rights may be exercised as follows.

Directly in the app: changing the profile name and photo, viewing, editing and deleting run records, changing location sharing settings, and withdrawing membership can all be done in the Me tab of the app.

In writing or by email: requests may be made to the personal information protection officer named in Article 11. The Company will act on them without delay.

Device settings: the app access permissions in Article 14 can be changed or withdrawn at any time in the device settings.

Where a data subject requests correction or deletion on account of an error in personal information, the Company does not use or provide that personal information until the correction or deletion is complete.

Rights may be exercised through a representative, such as the data subject's legal representative or a duly authorised person. In that case a power of attorney in the form of Annex 11 of the Public Notice on Methods of Processing Personal Information must be submitted.

Data subjects must not infringe, in violation of the Personal Information Protection Act or other relevant laws, the personal information or privacy of themselves or others that the Company processes.

When a request for access, correction, deletion or suspension of processing is made, the Company verifies whether the person making it is the data subject or a duly authorised representative.

Article 8 Measures to Ensure the Safety of Personal Information

In accordance with Article 29 of the Personal Information Protection Act and Article 30 of its Enforcement Decree, the Company takes the following measures.

1. Administrative measures

Establishment and implementation of an internal management plan

Minimising the number of personnel handling personal information and managing their access rights

Regular training for personnel handling personal information

Designation of a personal information protection officer and a location information manager

2. Technical measures

Encryption in transit: all communication between the app and the servers is encrypted using HTTPS/WSS.

No passwords held: because sign-in is by Sign in with Apple or Sign in with Google only, the Company does not hold users' passwords.

Minimisation of location information: live latitude and longitude during a run and while waiting to bump exist only in server memory and are not stored in databases or logs; only normalised coordinates are stored in the archive; and place names are stored only at the neighbourhood level.

No advertising identifiers collected: the advertising identifier (IDFA or advertising ID) is not used as a device identifier.

Differentiated access rights to the personal information processing system, and access control

Retention of access records and prevention of forgery or alteration

Installation of security programs and periodic inspection and updating

3. Physical measures

Servers are located in data centres operated by the cloud hosting provider (Google Cloud Korea, LLC), and that provider's physical access control policies apply.

The servers on which personal information is stored, and their backups, are located in the Republic of Korea (Seoul). Matters concerning transfer abroad are governed by Article 5-2.

Article 9 Installation and Operation of Devices that Automatically Collect Personal Information, and Refusal Thereof

The Company does not install or operate devices that automatically collect user information, such as cookies or web beacons.

The Service is provided as a mobile application and does not use online behavioural advertising tools or third-party advertising or analytics SDKs that collect users' behavioural information. Accordingly, there is no separate method of refusing automatic collection devices.

Article 10 Processing of Personal Information of Children Under 14

The Service is intended for users aged 14 or over.

The Company does not permit children under the age of 14 to join, and does not provide a path for joining with the consent of a legal representative.

The Company checks on registration whether the applicant is under the age of 14, and restricts registration where they are confirmed to be under 14.

If the Company becomes aware that the personal information of a child under 14 has been collected, it destroys that information and deletes the related account without delay.

If you believe that the personal information of a child under 14 has been collected, please inform the personal information protection officer named in Article 11.

Article 11 Personal Information Protection Officer

The Company designates a personal information protection officer as follows, who has overall responsibility for work concerning the processing of personal information and for handling data subjects' complaints and providing remedies in relation to personal information processing.

Item	Detail
Name	Changmok Lee
Position	Representative
Email	contact@syncrunlabs.com

Data subjects may direct enquiries, complaints and requests for remedies concerning personal information protection to the contact above. The Company will answer and deal with them without delay.

Article 12 Department Receiving and Handling Requests for Access to Personal Information

Data subjects may make requests for access to personal information under Article 35 of the Personal Information Protection Act to the department below. The Company will endeavour to process such requests promptly.

Item	Detail
Responsible	SyncRun personal information access request desk
Email	contact@syncrunlabs.com

Access to, correction and deletion of the profile and run records, and withdrawal of membership, can be done directly in the Me tab of the app; other access requests are received at the email address above.

Article 13 Remedies for Infringement of Rights

Data subjects may apply for dispute resolution or consultation to the Personal Information Dispute Mediation Committee, the Privacy Infringement Report Centre of the Korea Internet & Security Agency and the like, in order to obtain relief from infringement of personal information. For other reports of and consultation on privacy infringement, please contact the bodies below.

Body	Role	Telephone	Website
Personal Information Dispute Mediation Committee	Applications for personal information dispute mediation and collective dispute mediation (civil resolution)	1833-6972 (no area code)	www.kopico.go.kr
Privacy Infringement Report Centre (KISA)	Reports of and requests for consultation on privacy infringement	118 (no area code)	privacy.kisa.or.kr
Cybercrime Investigation Division, Supreme Prosecutors' Office	Investigation of privacy infringement cases	1301 (no area code)	www.spo.go.kr
Cyber Investigation Bureau, National Office of Investigation, Korean National Police Agency	Investigation of privacy infringement cases	182 (no area code)	ecrm.cyber.go.kr

In addition, a person whose rights or interests are infringed by a disposition or omission of the head of a public institution in respect of a request under Article 35 (access), Article 36 (correction or deletion) or Article 37 (suspension of processing) of the Personal Information Protection Act may request an administrative appeal as prescribed by the Administrative Appeals Act.

Central Administrative Appeals Commission: 110 (no area code), www.simpan.go.kr

Article 14 Guidance on App Access Permissions

In accordance with Article 22-2 of the Act on Promotion of Information and Communications Network Utilization and Information Protection, the Company designates as mandatory only the minimum access permissions necessary to provide the Service, and designates other permissions as optional so that users can use the basic features of the Service even without granting them.

1. Mandatory access permissions

Permission	Purpose
Location	To measure distance and route during a run, to share live location with participants within a group run session, and to find users waiting nearby to bump
Motion and physical activity	To read steps and movement in order to measure pace and cadence, and to measure by steps the distance travelled where the location signal has been lost

2. Optional access permissions

Permission	Purpose	If not granted
Notifications	Sending notifications needed during a run, such as the last-runner alert and inactivity check	Those notifications cannot be received; other features work normally
Health	Reading heart rate and saving completed runs as workouts	Heart rate is not recorded, but runs can still be measured on the basis of distance and pace. Heart rate is not a prerequisite for any feature
Photos	Setting the profile photo and run card background, and saving run card images	The profile photo and card background cannot be set, and cards cannot be saved to the Photos app
Nearby Interaction	Precise distance determination (UWB) when tapping phones together to form a group	Automatic bumping is unavailable. A group can still be formed by requesting to join a nearby waiting user

3. Processing of photos

Of the images loaded through the Photos permission, only those the user sets as a profile photo or as a run card background are kept on the servers. A profile photo is kept so that it can be restored on reinstallation or re-sign-in and shown to companions; a card background photo is kept so that the card survives a change of device or a reinstallation. No other image leaves the device.

A card background photo is provided only to the person who created that record, and not to other users. If the user removes the photo from the card, it is also deleted from the store.

4. How to withdraw permissions

Users may change or withdraw each access permission at any time in the device settings (iOS: Settings > Privacy & Security, or Settings > SyncRun; Android: Settings > Apps > SyncRun > Permissions).

Article 15 Changes to this Privacy Policy

This Privacy Policy applies from 24 October 2026.

Where content is added, deleted or amended in response to changes in laws, policies or security technology, the Company will give notice through the in-app notices and this document from seven days before the change takes effect (30 days before, where the change is unfavourable to users).

The revision history of this Policy is as follows. If you need the full text of a previous version, you may request it from the contact in Article 11.

Version	Effective date	Notes
v1.6	24 October 2026	Reflects the items collected, trustees, transfers abroad and app access permissions arising from Google sign-in and the Android app
v1.5	17 October 2026	Reflects the retention in the account of run card background photos, consent history and app settings
v1.4	16 September 2026	Change of server infrastructure trustee and country of storage (Seoul, Republic of Korea); correction of transfer-abroad details
v1.3	10 September 2026	Statement of the operating entity and business information, and the name of the personal information protection officer
v1.0–v1.2	6 August 2026 – 28 August 2026	Establishment and amendments during the free beta test period

Addendum

This Privacy Policy takes effect on 24 October 2026 and replaces the previous Policy (effective 17 October 2026).

SyncRun Labs Sole proprietorship · Representative Changmok Lee · Business registration number 656-09-03142 32 Daehak-ro 8-gil, Gyeongsan-si, Gyeongsangbuk-do, Republic of Korea Contact: contact@syncrunlabs.com

Terms & policies