1. Data We Collect

Email address (required for registration) Password (stored encrypted, never visible to us) Name (optional) Gender (optional) Login method: Email, Google, or Apple Sign-In GPS coordinates to detect your current position and generate routes Location is only accessed while the app is actively in use We do not track your location in the background Saved and favorite routes Distance traveled, time taken, elevation Activity type selected (running, cycling) Saved and favorite routes Distance traveled, time taken, elevation Activity type selected (running, cycling) Subscription tier selected (Free, Premium) Payment processing is handled by RevenueCat and Apple/Google Pay We do NOT store your credit card number or payment details

2. Data We Do NOT Collect

Photos or images from your camera or gallery Contacts or phone book Call history or SMS Health or biometric data (heart rate, sleep, etc.) Precise health records

3. Purpose & Legal Basis for Processing (GDPR)

Purpose Account creation and management — Legal basis: Contract performance (Art. 6(1)(b) GDPR) Route generation using GPS — Legal basis: Contract performance (Art. 6(1)(b) GDPR) Analytics and app improvement — Legal basis: Legitimate interest (Art. 6(1)(f) GDPR) Subscription management — Legal basis: Contract performance (Art. 6(1)(b) GDPR) Displaying advertisements — Legal basis: Consent (Art. 6(1)(a) GDPR) Legal compliance — Legal basis: Legal obligation (Art. 6(1)(c) GDPR)

4. Third-Party Services

Google Firebase / Supabase — Authentication, database (firebase.google.com/support/privacy) RevenueCat — Subscription management (revenuecat.com/privacy) Google AdMob — Advertising (policies.google.com/privacy) Mixpanel — Analytics (mixpanel.com/legal/privacy-policy) OpenRouteService — Route generation API (openrouteservice.org/privacy-policy) Google Directions API — Fallback routing (policies.google.com/privacy) Apple Sign-In / Google OAuth — Authentication

5. Data Retention

Account data: Retained as long as your account is active Route history: Last 10 routes stored per user Analytics data: Retained for up to 24 months Deleted accounts: All personal data erased within 30 days of account deletion

6. Your Rights under GDPR (EU Users)

If you are located in the European Union or European Economic Area, you have the following rights: Right of Access — Request a copy of your personal data Right to Rectification — Correct inaccurate or incomplete data Right to Erasure — Request deletion of your data ("right to be forgotten") Right to Data Portability — Receive your data in a machine-readable format Right to Restrict Processing — Ask us to limit how we use your data Right to Object — Object to processing based on legitimate interests Right to Withdraw Consent — Withdraw consent for ads or analytics at any time To exercise any of these rights, email us at: moveguide@mail.de We will respond within 30 days. You also have the right to lodge a complaint with your local Data Protection Authority (DPA).

7. Your Rights under CCPA (California Users)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act (CCPA): Right to Know — Know what personal information we collect, use, and share Right to Delete — Request deletion of your personal information Right to Opt-Out — Opt out of the sale of your personal information Right to Non-Discrimination — Equal service regardless of exercising your privacy rights We do NOT sell your personal data to third parties. To submit a CCPA request, contact us at: moveguide@mail.de We will respond within 45 days.

8. How to Delete Your Account & Data

You can delete your account and all associated data at any time: In-App: Go to Settings > Account > Delete Account After deletion, all your personal data will be permanently removed from our systems within 30 days. Note: Some anonymized analytics data may be retained but will not be linked to your identity.

9. Children's Privacy

Move Guide is not directed at children under the age of 13 (or under 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at moveguide@mail.de and we will delete it immediately.

10. Children's Privacy

All data is transmitted using SSL/TLS encryption Passwords are stored using industry-standard hashing (never in plain text) Access to personal data is restricted to authorized personnel only We use Firebase/Supabase which maintains SOC 2 and ISO 27001 certifications

11. Contact Us

If you have any questions about this Privacy Policy, please contact us:

Email: moveguide@mail.de