Privacy Policy

At Camino ("we," "our," or "us"), we are deeply committed to protecting your personal data and upholding your fundamental rights to privacy and data self-determination. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our mobile applications on Apple iOS (via Apple HealthKit) and Google Android (package: camino.app, via Google Health Connect and Strava API), as well as our official web portal (camino.app).

This policy is formulated in strict accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Danish Data Protection Act (Databeskyttelsesloven, Act No. 502 of 23 May 2018), the Danish Cookie Executive Order (Cookiebekendtgørelsen),Apple App Store Review Guideline 5.1.1, andGoogle Play Developer Policies & Data Safety requirements.

1. Data Controller Identity & Contact

Under GDPR Article 4(7), the Data Controller responsible for the processing of your personal data is:

2. Categories of Personal Data We Collect

We process only the minimum necessary data required to deliver Camino's gamified fitness platform:

3. Legal Bases for Processing (GDPR Articles 6 & 9)

Under European data protection law, we process your personal data only when an authorized legal basis applies:

• Performance of a Contract (GDPR Art. 6(1)(b)): Processing necessary to create your account, calculate rewards, maintain your coin wallet, issue merchant redemption codes, and operate the Camino service in accordance with our Terms of Service.
• Explicit Consent (GDPR Art. 6(1)(a) & Art. 9(2)(a)): Required before accessing health, motion sensor, or activity data via Apple HealthKit or Android Health Connect, or before linking your Strava account via OAuth. You have the statutory right to withdraw your consent at any time via your device settings or the in-app Strava disconnect toggle.
• Legitimate Interests (GDPR Art. 6(1)(f)): Processing necessary for our legitimate business interests in safeguarding system security, preventing algorithmic spoofing, botting, or fraudulent step manipulation, and diagnosing fatal software crashes.
• Compliance with Legal Obligations (GDPR Art. 6(1)(c)): Retaining transaction or dispute audit logs where mandated by Danish statutory law (e.g. the Danish Bookkeeping Act, Bogføringsloven).

4. Apple HealthKit, Health Connect & Strava Compliance

Apple HealthKit Disclosure (Apple Review Guideline 5.1.1)

Camino uses Apple HealthKit APIs on iOS devices solely to query daily walking step counts and distance:

• We do not use HealthKit data for marketing, advertising, or data-broker profiling.
• We do not disclose HealthKit data to third parties without your explicit consent.
• HealthKit data is processed on-device and synced to our secure database only as aggregated daily totals linked to your account UID.

Google Play Health Connect & Sensor Policy

Camino requests the following explicit runtime permissions on Android:

• android.permission.health.READ_STEPS: To retrieve daily steps.
• android.permission.health.READ_DISTANCE: To verify walking distance.
• android.permission.health.READ_EXERCISE: To read verified cycling sessions.
• ACTIVITY_RECOGNITION: To increment local pedometer counters when the app is active.

In compliance with Google Play's Health Connect policy, health data is never transferred to third parties except as strictly necessary to operate the user-facing rewards platform.

Strava Integration & Anti-Double-Counting

If you voluntarily link your Strava account, our server receives read-only access to your public cycling activities. Our Cloud Functions automatically cross-reference Strava activity timestamps with Apple Health / Health Connect walking intervals to credit your effort accurately and avoid duplicate rewards for the same time window. You can disconnect your Strava account at any time in Settings.

5. Third-Party Processors & Data Hosting

We engage trusted service providers who act as data processors under binding Data Processing Agreements (DPAs) compliant with GDPR Article 28:

6. International Data Transfers

Camino prioritizes storing and processing personal data within the European Economic Area (EEA). Where data is processed by subprocessors outside the EEA (such as the United States), transfers are executed under European Commission Standard Contractual Clauses (SCCs) pursuant to GDPR Article 46, or on the basis of adequacy decisions under GDPR Article 45 (including the EU-U.S. Data Privacy Framework).

7. Data Retention & Automated Deletion

• Active Accounts: Account profiles and aggregate reward histories are retained for as long as your account remains active.
• Inactive Accounts: Accounts with no activity for 18 consecutive months receive an email notification and are automatically queued for permanent deletion after 24 months of dormancy.
• Account Deletion Requests: When you delete your account via the app or through ourAccount Deletion Portal, all personal identifiers, daily fitness histories, coin balances, and voucher records are immediately de-indexed and permanently purged within 30 days(per GDPR Art. 12).

8. Your Rights as a Data Subject (GDPR Articles 15–22)

Under European and Danish data protection law, you hold the following non-waivable rights:

• Right of Access (Art. 15): Request confirmation and a copy of all personal data we hold about you.
• Right to Rectification (Art. 16): Correct inaccurate or incomplete profile information.
• Right to Erasure ("Right to be Forgotten", Art. 17): Request permanent erasure of your account and all associated activity records.
• Right to Restriction of Processing (Art. 18): Restrict processing during dispute investigations.
• Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format (JSON/CSV).
• Right to Object (Art. 21): Object to processing based on legitimate interests.
• Right to Withdraw Consent (Art. 7(3)): Revoke health data or Strava access at any time without affecting prior lawful processing.

To exercise any of these rights, contact us at matguzman148@gmail.comor initiate account erasure directly at camino.app/delete-account. We respond to all verified requests within 30 days without charge.

9. Right to Lodge a Complaint with Datatilsynet

If you believe our processing of your personal data infringes GDPR or the Danish Data Protection Act, you have the statutory right under GDPR Article 77 to lodge a formal complaint with the Danish Data Protection Authority (Datatilsynet), which acts as our lead supervisory authority:

10. Updates to This Privacy Policy

We may periodically update this Privacy Policy to reflect app enhancements, new integrations, or changes in European regulatory requirements. When significant revisions are published, we will provide conspicuous notice within the mobile application and update the effective date at the top of this document.

11. Contact & Privacy Officer

For any questions, data requests, or privacy concerns, please contact:

Camino Data Protection Team
Email: matguzman148@gmail.com
Location: Copenhagen, Denmark
Web Support: camino.app/support