In short
- ✓We collect only what is needed to run the event: your details, payment proof and walk distances.
- ✓Your data is stored in Singapore, encrypted, and seen only by you and authorised organisers.
- ✓Health and Strava data is read only to count your kilometres. It is never sold, shared for advertising, or used to train AI.
- ✓Marketing is optional and off unless you tick it. You can change your mind at any time.
- ✓Your personal data is deleted 6 months after the run ends.
1. Who we are
The app is run by [Organisation legal name] ("we"), the organiser of Muhammadiyah Run SG. For any privacy question or request, contact our Data Protection Officer at dpo@[organisation-domain].
2. What we collect and why
| Data | Why we need it |
|---|---|
| Name, display name, email, mobile number | Your account, event updates, and identifying you at collection |
| T-shirt size and sleeve choice | Ordering and handing out your finisher package |
| Payment proof image and reference | Confirming your donation and package payment |
| Walk, hike and run activities: distance, date, time and source app | Counting your progress towards the target and checking unusual entries |
| Notification token for your phone | Sending you event notifications |
We do not collect heart rate, sleep or other health records, your routes or location history, or your NRIC number.
3. Strava and health data
- We read activity data only after you connect Strava, Apple Health or Health Connect, and only the activity types the run counts.
- It is used only to count your kilometres for this run.
- It is never sold, never used for advertising, and never used to train or run AI systems.
- You can disconnect at any time in the app (Me › Connected). Disconnecting Strava deletes your Strava data from our systems.
4. Who can see your data
- You, in the app.
- Authorised organisers, limited by role. For example, payment approvers see your name, reference and amount, but not your phone number or email.
- Other participants see only your display name and distance on the leaderboard, and only if you allow it.
- Service providers that run the app for us: database and file hosting in Singapore, website hosting, and Apple and Google for push notifications. They may use the data only to provide their service.
We do not sell your data or share it with anyone else unless the law requires it.
5. Marketing (optional)
At sign-up you can choose whether we may contact you about other things, such as future runs, programmes or fundraising. These choices start unticked and are never required to take part. You can change them any time in the app (Me › Marketing), or by using the unsubscribe link in any message. We keep a record of what you agreed to and when.
6. How we protect your data
- Encrypted in transit and at rest, and hosted in Singapore.
- Database access rules make sure each participant can only ever read their own records.
- Payment proofs are kept in private storage and opened only through links that expire after a few minutes.
- Organisers sign in with two-factor authentication, and every organiser action is logged.
- If a data breach is likely to cause you significant harm, we will notify you and the Personal Data Protection Commission as the law requires.
7. How long we keep it
Your personal data and payment proofs are deleted 6 months after the run ends. We keep only anonymous totals, such as the number of finishers and the total distance walked.
8. Your choices and rights
- See and download your data (Me › Download my data).
- Correct your details (Me › Edit).
- Withdraw consent for marketing, the leaderboard, or connected apps at any time.
- Delete your account (Me › Delete my account). This removes your personal data, except where the law requires us to keep it.
- Contact our Data Protection Officer at dpo@[organisation-domain]. If you are not satisfied with our reply, you may contact the Personal Data Protection Commission (PDPC).
9. Changes to this notice
If we change this notice in a way that affects you, we will tell you in the app before the change takes effect.