Welcome to Own-it, the GPS territory-capture game where you run and cycle real-world loops to claim zones, compete with rivals, and build your crew. This Privacy Policy explains what personal data we collect, why we collect it, how it is stored, and your rights over it. By using Own-it you agree to this policy.
Own-it is operated by the Own-it development team. If you have any questions at any point, reach us at support@own-it.fit.
Own-it is designed primarily for users in the UAE, Saudi Arabia, Qatar, Kuwait, Bahrain, Oman, and Egypt. We comply with the EU General Data Protection Regulation (GDPR) for users in the European Economic Area, and apply equivalent protections globally.
Contents
- Data We Collect
- Data We Do Not Collect
- How We Use Your Data
- Third-Party Services
- Data Storage & Retention
- Location Data
- HealthKit & Apple Watch
- Google Health (optional connection)
- Profile & Feed Photos
- Saved & Shared Routes
- Push Notifications
- Subscriptions & Payments
- Advertising
- Children
- Your Rights
- Cookies & Analytics
- Changes to This Policy
- Contact Us
Data We Collect
We collect only what is needed to operate the app and provide you with a personalised, competitive experience.
- Email address
- Username (chosen by you)
- Country selection
- Language preference (EN / AR)
- Account creation date
- Apple ID (if signing in with Apple)
- Google account name & profile photo (if signing in with Google)
- GPS route coordinates
- Distance & duration
- Average and max speed
- Pace (cycling mode)
- Zones captured
- Calories (from Watch)
- Average heart rate (from Watch, stored with each run)
- Territory ownership records
- Crew memberships
- Private room history
- Leaderboard rankings
- Attack / defend events
- Profile photo (optional)
- Feed post photos (optional)
- Feed post captions (optional)
- Friends list
- Push notification token
- Apple Watch heart rate
- Apple Watch activity rings
- Pro subscription status
- Subscription tier & renewal date
- (Payment details handled entirely by Apple)
Data We Do Not Collect
We deliberately avoid collecting data that is not necessary for the app to function:
How We Use Your Data
Authentication methods — we offer three ways to sign in:
- Apple We receive your name and email from Apple. Apple may anonymize your email using their Private Relay service.
- Google We receive your name, email, and profile photo from Google.
- Email You can sign in with a password, or with a one-time sign-in link sent to your email via Brevo. Passwords are stored by Firebase Authentication in hashed form, never in plaintext, and we never store them ourselves. Password-reset links are also sent by email.
| Purpose | Data used | Legal basis |
|---|---|---|
| Account creation & authentication | Email, username | Contract performance |
| Magic link email sign-in (email users) | Email address | Contract performance |
| GPS territory capture gameplay | Live GPS coordinates | Contract performance |
| Displaying live positions to other players during runs | GPS coordinates (active run only) | Contract performance |
| Run & cycle stat tracking | Distance, time, speed, pace, GPS path | Contract performance |
| Leaderboard rankings | Username, country, activity stats | Legitimate interest |
| Community feed posts | Username, photo (optional), caption (optional), activity stats | Consent (opt-in per post) |
| Sharing a route you planned (optional) | Username, route name, activity type, route shape (start and end trimmed), stars and reports from other users | Consent (you choose to share each route) |
| Friends & crew features | Username, crew memberships | Contract performance |
| Crew leader stats (shown only to your crew's leader, while you're a member, after an in-app notice) | Username, distance, running pace and cycling speed, weekly distance, approximate climb, zones held and captured. Never your routes, email or account details. | Contract performance |
| Push notifications (zone attacks, streaks, events) | Device token | Consent (system prompt) |
| Pro subscription management | Subscription status | Contract performance |
| Apple Watch integration | Heart rate, activity data | Consent (HealthKit prompt) |
| App improvement & debugging | Anonymised crash reports (via Apple, only if you opted in to share diagnostics with developers) | Legitimate interest |
We never sell your personal data to any third party. Outside of the optional ads described in the Advertising section (free users only, subject to your App Tracking Transparency choice) and the install and purchase measurement for our own advertising campaigns described under Cookies & Analytics, your data is never used for advertising. Your GPS data is used solely to power the game, track your activities, and display territory on the map — never for ads. Your health and fitness data is never used for advertising, marketing, or data-mining under any circumstances.
Third-Party Services
Own-it integrates with the following third-party services. Each operates under its own privacy policy.
| Service | Provider | What data they receive | Purpose |
|---|---|---|---|
| Apple Sign In | Apple Inc. | Name, email (may be anonymized by Apple) | Authentication |
| Google Sign In | Google LLC | Name, email, profile photo | Authentication |
| Google Health (optional) | Google LLC | Only if you choose to connect it: we receive your workouts (type, time, duration, distance, calories), the GPS route of each workout, and heart rate during workouts, read-only. Nothing is sent to Google Health | Importing workouts recorded on a Fitbit or other device linked to your Google Health account |
| Firebase Auth | Google LLC | Email address, auth tokens | Secure user authentication |
| Firebase Firestore | Google LLC | User profiles, game data, feed posts | Database storage |
| Firebase Storage | Google LLC | Profile photos, feed photos | Media file storage |
| Mapbox | Mapbox Inc. | Approximate location for map tile requests | Rendering the map |
| Brevo | Sendinblue SAS (operating as Brevo) | Email address (transactional delivery only) | Transactional email — magic sign-in links & password resets |
| Google AdMob | Google LLC | Device identifiers (free users only, subject to App Tracking Transparency consent) | Advertising — rewarded and interstitial ads shown to free users |
| PostHog | PostHog Inc. (US region) | Your account ID (not your name or email) and a short list of in-app events, such as opening the app, starting or finishing a run (distance and duration, no route), joining a challenge, viewing the upgrade screen, and subscribing | Product analytics — understanding which features are used and where people get stuck |
| Meta SDK | Meta Platforms, Inc. | App-install and app-open signals, basic app and device information the SDK collects automatically, and two events: that an account was registered (and by which method) and that a subscription was purchased (price, currency and product ID). Your advertising identifier (IDFA) only if you allow tracking | Measuring whether Meta ad campaigns lead to installs and purchases |
| RevenueCat | RevenueCat, Inc. | Your account ID and subscription / purchase status | Subscription management and entitlement checks |
| Apple HealthKit | Apple Inc. | Heart rate, calories — processed on device only | Workout stats, saving workouts to Health app |
| Apple StoreKit 2 | Apple Inc. | Subscription receipt (opaque, validated by Apple) | Pro subscription management |
| Apple Push Notification Service (APNs) | Apple Inc. | Device push token | Delivering in-app notifications |
All Google Firebase data is stored in Google Cloud data centers. Google LLC is a certified processor under GDPR. For Firebase's privacy policy visit firebase.google.com/support/privacy. For Mapbox visit mapbox.com/legal/privacy.
Data Storage & Retention
All data is stored on Google Cloud infrastructure (Firebase). Here is how long we retain each category:
| Data category | Retention period |
|---|---|
| Account data (email, username, profile) | Until you delete your account |
| GPS run / cycle data & stats | Until you delete your account or individual runs |
| Territory & game state | Until you delete your account |
| Feed posts & photos | Until deleted by you, or when your account is deleted |
| Routes you chose to share | Until you stop sharing them or delete your account |
| Magic link tokens | 10 minutes (auto-expired in Firestore) |
| Push notification tokens | Until you disable notifications or delete account |
| Subscription status | Until subscription lapses or account is deleted |
| Product analytics (PostHog) and subscription records (RevenueCat) | Until you delete your account, when we ask each provider to delete them |
| Anonymised crash / diagnostic reports | Collected and retained by Apple per your iOS diagnostics-sharing setting |
When you delete your account, we initiate deletion of all personal data from Firebase Firestore and Firebase Storage within 30 days, and send deletion requests to PostHog and RevenueCat as part of the same process. Residual backups may persist for up to 60 days before full purge. Events already shared with Meta for campaign measurement are held under Meta's policies and cannot be recalled by us. See Account Deletion for exactly what is removed and what remains.
Location Data
Location is central to how Own-it works. Here is exactly how we use it:
- Continuous GPS tracking to draw your route
- Territory zone capture detection
- Your live position is shown on the shared map to other active players
- Background location used to continue tracking if you switch apps
- Approximate location to centre the map
- Show nearby territories and zones
- Not sent to other users
GPS coordinates from completed runs are stored as part of your run history in Firebase Firestore. We do not sell or share location history with advertisers. You can delete individual runs or your entire account to remove all stored coordinates.
HealthKit & Apple Watch
If you connect an Apple Watch, Own-it requests access to HealthKit to read heart rate and activity data during workouts, and to save completed runs as workouts in the Health app.
- Heart rate (live, during run)
- Active calories
- Activity ring data
- Workout records (distance, time, calories)
- Saved to your Apple Health app
Raw HealthKit samples are processed on your device and used to display live stats during your run. We do not upload raw HealthKit samples to our servers; a workout summary (average heart rate and calories burned) is stored as part of your run record in Firebase Firestore so your stats stay in sync across your devices. You can remove it at any time by deleting the run or your account.
Health data is never used for advertising. We never use health or fitness data — including heart rate, calories, workout data, or any data obtained through HealthKit — for advertising, marketing, or data-mining. We never disclose it to advertising networks (including Google AdMob), advertising platforms, data brokers, or information resellers, and it is never used to serve, target, or personalise ads.
Google Health (optional connection)
You can optionally connect your Google Health account in Own-it settings, so workouts recorded on a Fitbit or another device linked to Google Health can be brought into Own-it. This is off unless you turn it on, and Own-it works fully without it.
- Workout details: type, start time, duration, distance, pace and calories
- The GPS route of each workout
- Heart rate during workouts
- Write or change anything in your Google Health account
- Read sleep, nutrition, ECG or other health data
- Show your heart rate to other users
How it is used. The workout and its GPS route are used to show your own runs and to work out the territory you capture. Heart rate is shown only to you, on your own run summary.
Disconnecting and deletion. You can disconnect Google Health at any time in Own-it settings. Disconnecting revokes Own-it’s access with Google and deletes the access token we stored. Workouts already brought into Own-it stay in your run history, and you can delete any run yourself. If you delete your account, all of this data is deleted. You can also remove Own-it’s access from your Google Account permissions at any time.
Never used for advertising. Data from Google Health is never sold, never used for advertising, marketing or data-mining, and never shared with advertising networks, data brokers or information resellers.
Own-it’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Profile & Feed Photos
Uploading a profile photo or posting to the community feed is entirely optional.
- Stored in Firebase Storage
- Visible to all Own-it users on the map and leaderboard
- Replaceable or removable any time from Profile settings
- Photo and caption are optional per post
- Stored in Firebase Storage and Firestore
- Visible to all users in the community feed
- You can delete individual posts at any time
Do not upload photos that include identifiable third parties without their consent. By uploading a photo you confirm you hold the rights to share it.
Saved & Shared Routes
Pro members can plan routes in the route builder. Planned routes are private by default.
- Stored on your device, with nothing sent to our servers
- Exporting a GPX file is your choice and goes where you send it
- Road snapping and elevation use Mapbox, which receives the points of the route you are planning
- Shared only when you tap Share on that route, and only with a full account (not guest mode)
- Visible to other signed-in Own-it users with your username, the route name, the activity type and the route shape
- The first and last 200 metres are cut off so your home or start point isn't revealed, and routes shorter than 1 km can't be shared
- Other users can star, copy or report a route. Your username is shown on it, and the app shows other users only the number of stars
- You can stop sharing at any time, and sharing ends if you delete your account
A shared route is a drawn path, not a record of a run. It does not include times, heart rate or your live position. Don't share a route that starts or ends where you live or where you could be at risk.
Push Notifications
Own-it sends push notifications for the following events:
You will be asked for notification permission during onboarding. You can change this at any time in your iPhone's Settings → Own-it → Notifications. Disabling notifications does not affect gameplay — you will still receive in-app alerts.
Subscriptions & Payments
Own-it Pro is available as a monthly or yearly subscription. All payments are processed entirely by Apple through the App Store using StoreKit 2. Own-it never sees, stores, or handles your payment card details.
We receive only a subscription status receipt from Apple (active / expired / trial) to unlock Pro features. Subscription management, refunds, and cancellations are handled through your Apple ID account settings.
If you start a free trial, we send you a one-time reminder before it converts to a paid subscription: a notification on your device or, if notifications are turned off, an email to the address on your account. We use your email address for this reminder only, and we do not send it if you have already cancelled.
Advertising
Free users of Own-it may see ads powered by Google AdMob. There are two kinds: optional rewarded ads, which you actively choose to watch in exchange for in-game rewards (such as bonus points or zone boosts), and occasional interstitial ads, which may appear after you complete a run and, at most once per session, when you open the leaderboard. Ads are never shown during an active run, and we never show banner ads. Pro subscribers never see any ads.
- Optional rewarded ads — you tap "Watch ad" to earn a reward
- Occasional interstitial ads after a completed run or when opening the leaderboard
- No ads during an active run or cycle
- AdMob may collect device identifiers
- No ads of any kind
- AdMob SDK inactive
- No device identifiers collected for ads
AdMob may use device identifiers for ad personalization where permitted by your device settings. You can opt out at any time in Settings → Privacy & Security → Tracking on your iPhone. Opting out means you may still see ads but they will not be personalized to your interests. For AdMob's privacy policy visit policies.google.com/privacy.
Children
Own-it is not directed at children under 13 years of age. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@own-it.fit and we will delete the data promptly.
Users between 13 and 17 should obtain parental consent before creating an account. GPS-based features that share live location with other players require particularly careful parental consideration for minors.
Your Rights
Under GDPR and equivalent regional laws, you have the following rights regarding your personal data. All can be exercised by contacting us at support@own-it.fit or through in-app settings where available:
- Access — request a copy of all personal data we hold about you
- Deletion — delete your account and all associated data from the app
- Export — download your run history and activity data
- Correction — update your username, country, or language preference
- Opt out of feed — choose not to post to or appear in the community feed
- Notification opt-out — disable push notifications via iOS Settings
- Restrict processing — object to processing based on legitimate interest
- Lodge a complaint — complain to your local data protection authority (EU users: your national DPA)
We will respond to all data rights requests within 30 days. For account deletion, use Profile → Settings & More → Danger Zone → Delete Account in the app, or email us and we will action it within 5 business days.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes to the app or applicable law. When we make material changes we will notify you via a push notification or an in-app banner, and update the "Last updated" date at the top of this page.
Continued use of Own-it after the effective date of a revised policy constitutes your acceptance of the changes. If you do not agree with a change, you may delete your account before the change takes effect.
Contact Us
For any privacy-related questions, data requests, or concerns, please reach us at:
Own-it Support Team
Email: support@own-it.fit
We aim to respond to all enquiries within 2 business days. For urgent data deletion requests we will confirm receipt within 24 hours and complete deletion within 5 business days.