Privacy Policy

We know nobody really reads privacy policies. We tried to write this one differently: clearly, in plain language, without jargon.

Konquo is a gamified running app: capture territories, progress through an RPG, join clubs and challenge a community of runners. It is developed and operated by SEAPALM, a company registered in France.

SEAPALM, SAS (Société par Actions Simplifiée, French simplified joint-stock company) with a share capital of €5,000

SIREN: 978 557 312; SIRET: 978 557 312 00011

VAT no.: FR25 978 557 312

39 rue Flamandière, 59190 Hazebrouck, France

[email protected] · konquo.com

The controller of your personal data is SEAPALM SAS, represented by its president Corion Gauthier.

Given the size of our organization and the nature of the processing, SEAPALM is not required to appoint a Data Protection Officer (DPO) within the meaning of article 37 of the GDPR. All requests about your personal data, your rights or this policy are handled by the same dedicated point of contact:

• GDPR email: [email protected] (subject: GDPR)
• Mail: SEAPALM, 39 rue Flamandière, 59190 Hazebrouck, France

We acknowledge receipt within 48 business hours and answer any request within one month.

Here is a clear overview of each category of data.

When you create a Konquo account, we ask for a username, an email and a password (stored hashed, never in plain text). You can also add a profile picture and a bio so other runners can recognize you.

You can also sign in with your Google, Apple, Facebook or Discord account. In that case, we receive your identifier, your verified email and, depending on the service, your name and profile picture; nothing else.

If you add a phone number (SMS sign-in or two-factor authentication), we keep it to send you verification codes.

This is the heart of Konquo: when you start a run, we use your device's GPS in real time to trace your route, calculate distance and elevation, and capture the hexagonal territories you cross.

We never track your location outside a run. GPS turns on only when you tap "Start" and stops when you finish. The quality of the GPS signal is analyzed to check that your runs are valid and to prevent cheating.

Distance covered, duration, elevation, pace, speed, calories and, when available, heart rate; all of this feeds your statistics, your progression and the rankings. It is what drives the game.

Level, XP, chosen RPG class (Titan, Saboteur or Guardian), powers, energy, quests, achievements, rankings; all this data brings the game to life and is used only for that purpose.

We record your balance of Coins (earned in the game) and Gems (purchased), as well as the history of your shop transactions and gacha draws. Banking details are handled exclusively by Apple or Google; we never see them. We only store transaction identifiers and receipts for verification.

Posts, comments, follows, clubs, votes on feedback; this is data you create and share voluntarily with the community. It is deleted if you delete your account.

If you accept push notifications, your device receives a technical identifier (FCM token) that lets Konquo send you alerts (new message, territory stolen, quest completed...). You can turn them off at any time in your phone settings.

Like any app, Konquo generates technical logs: IP address, device type, OS and app version, application errors and crash reports. We use this information only to detect problems, prevent abuse and improve the service. This data is accessible only to the technical team.

Notification preferences, units of measurement, privacy settings; we store them so your experience stays consistent from one session to the next.

• To run the app: runs, territories, progression, shop
• To authenticate you securely
• To power the rankings and competitive features
• To send you relevant notifications
• To prevent fraud and detect anomalies (GPS spoofing, excessive speed)
• To improve the quality of the service
• To meet our legal obligations

• Performance of the contract (Terms of Use/Terms of Sale): providing the service, managing the account, transactions
• Legitimate interest: security, fraud prevention, improving the service
• Consent: GPS geolocation, push notifications, access to health data (Apple Health, Health Connect)
• Legal obligation: retention of connection data, account deletion logs

We never sell your data. Ever. We do not hand it over to advertisers, data brokers or third parties for commercial purposes.

However, Konquo relies on technical providers without which the app could not work:

• Google: OAuth sign-in and push notifications through Firebase Cloud Messaging (FCM)
• Apple: OAuth sign-in and validation of in-app purchases
• Facebook: OAuth sign-in
• Discord: OAuth sign-in and account linking (roles on the Konquo Discord server)
• Twilio: sending verification codes by SMS (phone number)
• Mapbox: displaying some base maps (IP address, map area displayed)
• Cloudflare: routing and protection of the website and the API (all traffic goes through Cloudflare, encrypted, including the data received from fitness services), and anti-spam protection of the contact form (Turnstile)
• Apple App Store / Google Play Store: payment of subscriptions and in-app purchases
• Hosting: SEAPALM servers in France and servers rented from Hetzner Online GmbH (Germany), all located in the European Union. They host the app, your data and photos, and the tracking of errors and crashes
• OVHcloud (France): sending emails (email address and message content)

All these providers are bound to SEAPALM by contracts that require them to protect your data. Those based in the United States operate under the safeguards provided by European law (Data Privacy Framework, standard contractual clauses).

If you link your Konquo account to a third-party service (Strava, Garmin, Polar, Fitbit and Google Health, Suunto, Wahoo, Coros, Huawei Health, Oura), we import your sports activities through their official API, with your explicit consent through OAuth.

We use this data only to create your runs in Konquo, to capture territories and to calculate your statistics and progression. As with a run recorded in the app, the territories you capture and your place in the rankings are visible to other players.

You can revoke this connection at any time from the Konquo settings or from the service itself, which stops future imports. Runs already imported stay in your profile: you can delete them one by one, and they are erased along with your account.

The case of Garmin: with the consent you give on Garmin Connect, we receive for each activity its type, times, distance, duration, calories, elevation gain, your heart rate, the watch name and the GPS route. This data is processed only by SEAPALM and by the technical providers listed above that host and route it (Hetzner, Cloudflare). When you disconnect Garmin in Konquo or delete your account, we also withdraw the authorization at Garmin. You can also withdraw it from Garmin Connect, in the connected apps of your account.

The special case of Strava: in accordance with the Strava API Agreement (§2.10), data imported from Strava is never shown to other Konquo users. In practice, runs imported from Strava are automatically private: they cannot be published in the social feed, do not appear in public rankings, and their route is not used to render public tiles. They remain usable in your personal profile, however.

These Strava restrictions apply even if you turn on the "public sharing" option in Konquo: only runs that do not come from Strava can be made public. To share a Strava activity in Konquo, record it directly with the app.

If you allow it, Konquo accesses Apple Health (iPhone) or Health Connect (Android). We read your workouts there: activity type, duration, distance, GPS route, calories and heart rate. On Android, reading can happen in the background to import a workout without opening the app.

Konquo can also write your runs there (workout, distance, route, calories) so they appear in your other health apps.

This data is used only to create your runs in Konquo and to calculate your statistics. It is never sold, never used for advertising and never passed on to third parties.

You can remove this access at any time from the settings of Konquo, of the Health app on iPhone or of Health Connect on Android. Data already imported is erased along with your account.

Konquo does not use any artificial intelligence system to process your personal data, your activities or your routes.

Data received from third-party services (Garmin, Polar, Suunto, etc.) and anything derived from it is never used to train, evaluate or improve an artificial intelligence model.

If this were to change, we would say so in this policy and first ask for your explicit consent, which you could withdraw at any time from the settings.

As long as your account is active, so is your data.

If you delete your account:

• Your personal data (profile, runs, posts, progression) is erased immediately.
• Transaction and purchase data: kept for 10 years (accounting obligation).
• Technical logs (IP, connections): 12 months maximum.
• Account deletion log: 3 years (legal traceability).
• Ban data: duration of the ban + 3 years.
• Refresh tokens: 30 days (automatic rotation).

Without going into technical details: all communication between your device and our servers is encrypted (TLS). Your passwords are hashed (bcrypt); we cannot read them. Your data is hosted in the European Union, on SEAPALM's servers in France and on Hetzner Online GmbH's servers. Access to the infrastructure is restricted and monitored.

In the event of a data breach likely to affect you, we will notify the CNIL (French data protection authority) within 72 hours and inform you directly.

Some data is visible to other Konquo users: username, profile picture, public statistics, captured territories, rankings, published posts and comments.

You can set the visibility of some data from the app settings.

The GDPR gives you concrete rights over your data:

• See what we hold about you; write to us and we will send you everything.
• Correct inaccurate information; you can do it directly in the app.
• Delete your account and all your data; from Profile → Settings → Delete my account.
• Receive your data in a portable format; from the legal page of the app or by email.
• Object to processing or ask for it to be restricted; by email.
• Withdraw your consent (geolocation, notifications, health data); at any time in the settings.

We commit to answering any request within a month.

Contact: [email protected]

If you believe your rights are not being respected, you can file a complaint with the CNIL (www.cnil.fr).

The Konquo mobile app does not use cookies.

The web app may use technical cookies needed for it to work (session, authentication). No advertising or tracking cookies are set.

Konquo is available from the age of 13, the minimum age set by article 8 of the GDPR.

For users under 15, we collect the joint agreement of the child and of a holder of parental authority, in accordance with article 45 of the French Data Protection Act (loi Informatique et Libertés). This agreement is requested by email and proof of it is kept.

Until authorization is given, the account works in restricted mode: the username and picture are not shown to other players and community features are disabled. Once authorization is given, and until the user turns 15, the username and picture are visible and the user can post, react, comment, follow other players and join a club. Their profile stays private (only followers they accept see their posts), they appear neither in rankings nor in search, and private messaging, club chat and creating a club remain disabled.

From the age of 15, users consent to the processing of their data on their own.

The data of an account that was refused, or for which parental authorization was not obtained, is erased after forty-five days, which leaves time to request a copy.

For any question about a minor's data, write to [email protected].

We will let you know in the app before any significant change. The current version is always available from the app settings and on konquo.com.

SEAPALM, 39 rue Flamandière, 59190 Hazebrouck, France

[email protected]