Data and privacy

Text version: 2026-10-11

Sakalm records running, walking and cycling activities. To do that, the app handles data about you. Here is what data, why, and what you can demand at any time. What Sakalm keeps on your phone and in your browser is detailed in the “Cookies and trackers” document.

WHO IS RESPONSIBLE

Sakalm, a French simplified joint-stock company with a sole shareholder (SASU), with share capital of 500 euros, Paris Trade and Companies Register (RCS) 131 251 845, 47 rue Vivienne, 75002 Paris, France. For any question or to exercise your rights: hello@sakalm.com.

WHAT THE APP COLLECTS

Your account: email address, username, first name and surname. Without them, no account.

Your profile: date of birth, sex, country and town, the state for the United States, and for France the region, worked out from the town. If you fill them in, height and weight. The date of birth is used to check the minimum age. Height and weight are optional and are used only to estimate a calorie expenditure. At sign-up you also give the sports you practise and your favourite sport, your level, your usual routine, in sessions and kilometres per week, and whether you have a connected watch: they are used to tune the app to the way you train.

Your activities: the GPS route, the date, the time, the duration, the distance and the elevation. This is the heart of the app. The name of the town closest to your starting point is added to them: our server works it out from its own list of towns, without asking Apple, Google or anyone else. On iPhone, the number of steps counted between the start and the finish also goes with the activity, if you have opened step access. And if you answer “How are you feeling?” at the end of an activity, how you felt, from one to five, is kept with it. No other member sees it, not your friends, not your group, not your coach: it is shown only to you, and to the Sakalm team on the page of an activity it is checking.

Your heart rate, if and only if you consented to it separately. It is health data, it has its own switch on this screen, and you can turn it off whenever you like.

Your steps, when you tap “Count my steps”. While the home screen is open, your count for the day is read from the phone’s pedometer and, if you have given your health agreement, from Apple Health: the higher of the two is shown. That count does not leave the device: nothing is sent or kept until you have confirmed it yourself. One exception only, the one described just above: on iPhone, the steps counted during an activity go with it.

What Sakalm reads in Apple Health, if you give your health agreement. Several uses, and the same agreement for all of them.

The import screen reads your running, walking and cycling sessions to add them to your history: their GPS route where there is one, their distance, their calories, their heart rate, and the stride measurements some watches record: ground contact time, vertical oscillation, stride length and running speed.

And the app completes activities you have already recorded with those same measurements, which the phone alone cannot take. That reading happens on its own, when the app starts, at the end of an activity and when an activity page is opened.

Your step count for the day is read there too, alongside the pedometer, as described above.

A final reading happens without the app being open. When a new running, walking or cycling session is recorded in Apple Health, by your watch or by another app, iOS wakes Sakalm up long enough to notice it, even if you have not opened it. This exists so that an activity you forgot to start in Sakalm is not lost.

That reading only OFFERS it to you. Nothing is added to your history and nothing enters a ranking until you have said yes. A notification asks whether you want to add it, if you have accepted notifications, and in every case a screen asks you on your next visit: it shows you the session, where it came from, and whether it will count towards the week. You add it, or you ignore it, and an ignored session is never offered again.

That wake-up reads your sport sessions and nothing else. It only happens while the Apple Health switch is on: turn it off and iOS stops waking the app.

Apart from your sport sessions and your step count, nothing is read there: no weight, no sleep, no resting pulse, no other medical data. Nothing is ever written into Apple Health. And nothing at all is read until you have given your health agreement, which is separate from accepting these texts and can be withdrawn whenever you like.

On an Android phone, Apple Health is replaced by Health Connect, with the same health agreement and the same rules. Sakalm reads your steps there, your running, walking and cycling sessions, their GPS track, their distance, their active calories, and your heart rate during those sessions. Nothing else, and not the stride measurements. The phone’s pedometer is not used there: your step count comes from Health Connect only. Health Connect is only read while the app is open: there is no background wake-up on Android. Nothing is ever written to it, and you can withdraw access whenever you like, in Sakalm’s settings or in Health Connect itself. Data read from Health Connect is used only for the purposes described here: it is not sold, not used for advertising and not passed on to anyone apart from the hosts that store it for us, named below, and its use complies with the Health Connect data access policy, including the Limited Use requirements.

Your profile photo, if you set one. It is optional, the app opens your photo library only at the moment you ask it to, and it reads no other image. The capture data, including the place, is removed before sending. You can remove it whenever you like from your account menu: the file is then deleted.

The photos you attach to a shared activity, taken on the spot with the camera or chosen from your photo library. The camera opens only when you tap “Take a photo”, it never switches on by itself, and nothing is recorded until you have pressed the shutter yourself. Here too, the place and time written inside the image are removed before sending.

A notification delivery identifier, if you accept them. It designates your phone, not you, it says nothing about what you do, and it is erased with your account. Without it, no notification can reach you. Refusing notifications prevents nothing else from working.

We use it for two different things, and you can refuse the second without losing the first. SERVICE MESSAGES answer something: a question you asked us, an activity you disputed, a problem on your account. They come through whatever happens, because making them vanish silently would be worse than letting them arrive. ANNOUNCEMENTS answer nothing: they are the news we write ourselves. They are turned off with one tap, under Settings then Notifications, the “Announcements” line, and turning that line off turns off no reply to a question you ask us. An announcement can be sent to everyone, or only to some, chosen on five things and nothing else: whether you subscribe, whether your account is less than a week old, whether you opened the app in the last seven days, whether you have not opened it for a month, or whether you have not recorded any activity yet. That is what lets us, for example, write only to those who have not come back for a long time, without disturbing the others.

Reactions and cheers: the ones you put on other people’s activities, and the ones people put on yours, with the name of whoever sent them. These are symbols, never text.

Your purchases, if you make any: your Premium subscription and the themes paid for with real money, with for each one the plan or theme, the dates, the amount and the payment reference that Apple or Google passes on to us. They are used to unlock what you paid for, to restore it on a new phone, to calculate a referral commission, and to know whether you are a subscriber when an announcement is meant only for subscribers or only for the others, as described above. Your payment method stays with Apple or Google: we never see your bank details.

Your referral earnings, if you refer people: the amount of each earning, its date, its status and the payouts you requested.

Your friends list: your friends, the friend requests you sent or received, and the accounts you have blocked. It is built only from the usernames you search for in the app: Sakalm does not ask for access to your phone’s contacts, and never reads them.

The messages you write or record in the discussion of a group, with your username, the time, and the usernames you call there with an “@”. Together with the comments under activities, described below, they are the only words that go from you to other members. They can be read or heard only by the members of that group, and they are erased after twenty-four hours.

Your voice, if you leave a voice message in a group. The microphone opens only when you tap its button, and it closes when you tap it again, which sends the message, or by itself after ten seconds: a voice message therefore lasts ten seconds at most. It never switches on by itself, and never in the background. It is neither transcribed nor analysed: it is only kept in a closed space that only the members of the group can listen to, and the file is erased from the server at most one hour after those twenty-four hours.

The comments you write under a published activity, with your username and their date, and the caption you attach to your posts. Who reads them, and how long they stay, is described below, in “Two places where people speak to each other” and “On your feed”.

Your voice too, if you leave a voice comment under an activity. Same microphone, same ten seconds at most, no transcription and no analysis. The comment is kept in a closed space that only the author of the activity and their friends can listen to, and it stays as long as the comment stays, like a written one. When you remove it, replace it, or the activity disappears, the file is erased from the server within the hour. If it was reported, a copy is kept for the team until the decision, then thirty days at most.

The routes you keep, twenty at most: a track imported from a file, or the track of one of your activities that you choose to keep at the end. Each one carries its name, its length, its elevation gain and its date. They are visible to you alone, and stay until you delete them or delete your account.

The messages you send us through “Report a problem”, with what comes with them so that we can understand: the screen you were on, the app version, your system and your device model. And the disputes you file about an activity, with their reason and our reply.

Minimal technical data: app version, device model, and the errors encountered, so they can be fixed. And the state of the permissions you granted on your phone: location and its precision, pedometer, step access, connection to Apple Health or Health Connect. Yes or no, nothing more: it helps us understand why an activity or your steps are not coming through, when you write to us. Finally, the date you last opened the app, and the date of your last visit to each group and each game: they are used not to notify you about what you have just seen, to mark what is new since your last visit, to know whether an account has stayed inactive for three years, and to choose who receives an announcement, as described above. Only the latest date is kept, not a history of your visits. When you sign in, our account service also notes the IP address and the software the connection comes from: it keeps them for as long as your sign-in session lasts, that is until you sign out or it expires, and they are used for the security of your account.

Your surname, first name and full postal address, ONLY on the day you win a prize to be delivered to you. They are then asked of you by email, never before, and they serve only for the shipment: no other member sees them, and the app shows them nowhere. As long as no prize is at stake, this request happens for nobody.

Your full name and postal address, ONLY if you are a referrer and your earnings pass EUR 2,400 in a single calendar year. Below that threshold we do not ask for them and we do not have them. Above it, the law requires us to report these payments to the tax authorities with the identity of the recipient: it is a legal obligation, not a choice on our part, and the payment cannot go out without it. These two pieces of information live in a separate table, which the app never reads back, and they are visible to no other member.

YOUR LOCATION, AND WHEN IT IS READ

It is the most sensitive data the app handles, so here is exactly what happens.

Sakalm asks for the “While Using the App” location permission, and nothing more. The “Always” permission is not requested, because recording an activity does not need it: when you start an activity with the app open, the system lets Sakalm keep reading the GPS while you put the phone in your pocket, the screen goes off, or you switch to another app. The route does not stop, and your kilometres are not lost.

This permission does not mean “all the time”. Your location is read in three cases only, the first two with the app open on screen: when you display the GO tab, to centre the map, place the day’s chests around you and prepare nearby routes; when you open a territory map or ask for a route; and during an activity started with GO, until STOP, screen off included.

In the first two cases your location goes to our server just long enough to pick nearby chests or loops, and is not stored. At most, when your neighbourhood has no chests or loops yet, the server notes that neighbourhood, without your name, to prepare them there. What is stored are the chests placed for you that day: those you do not pick up are erased after two days, those you pick up are kept for twelve months with the time of pick-up.

Outside those moments, without the “Always” permission, iOS stops Sakalm reading your location as soon as it leaves the screen, except during an activity you started.

During an activity, iOS shows a location indicator at the top of your screen at all times. It is there for you: while it is on, the app is reading your location; when it goes off, it no longer is.

During an activity, your iPhone also shows the activity in progress on the lock screen, and at the top of the screen on models that allow it: the sport, the distance, the time, the pace and the chests picked up, with controls to pause, resume or end it. These figures are worked out by your phone and displayed by it: nothing is sent to Apple for this, and the display goes away when the activity ends. On Android, a persistent notification shows the same figures for as long as the activity lasts. You can turn this display off in your phone’s settings, and recording carries on without it.

The recorded route stays private by default. Nobody in your group for the week ever sees it. It goes out by two paths only, and both require an act on your part: a private group, where it takes both your permission in that group and friendship; and your feed, where you post one activity at a time and decide for each one whether to show the route or not. An image you share yourself outside the app, with both ends cut, is a third, reserved today for a few test accounts. Above those two paths sits a single switch, in Settings then “My routes”: off, it closes both at once, with nothing to remember group by group. Three sections below say exactly how: “In a private group”, “On your feed” and “Cutting the route”.

You can withdraw this permission at any time in your phone’s settings. The app will keep working, but it will no longer be able to record an activity.

WHY

To run the app and your account. This is performance of the contract between us: without this data, there is no service.

To draw up the weekly ranking and check that activities are genuine. This is the legitimate interest of a competition: without checking, it has no value for those who play honestly.

To handle your heart rate, only on your explicit consent, which you can withdraw at any time without having to justify it.

WHAT THE MACHINE DECIDES ON ITS OWN

Every recorded activity goes through an automatic check. Nobody looks at it at that moment: it is a program, and it decides alone.

Here is how it works, because you have the right to know. It scores each activity from zero to one hundred by looking for six families of clues: speed, acceleration, GPS signal quality, position jumps, those anomalies repeating within one activity, and the presence of a simulated position. All of them describe the movement of a device; none of them says anything about your body. The higher the score, the more the activity looks like a manufactured measurement rather than a real outing.

There was a seventh family until 10 September 2026: consistency with the pedometer, meaning your step count compared with the distance. It has been removed from the calculation. The law forbids basing a fully automated decision on health data, and your step count is health data here, because it is cross-referenced elsewhere with your height, your weight and your heart rate. The discrepancy is still recorded, but it no longer decides anything on its own: a person looks at it.

Below fifty, the activity passes. From fifty, it is flagged and shown as “To check”. From seventy, it is not counted. A detected simulated position is worth one hundred on its own, so an immediate refusal.

An activity that is not counted stays in your history and you still see it, but it earns neither Goldies nor a place in the ranking. The same goes for an activity too short to be measured: it stays in your history, but it does not count.

Even before that check, the server makes sure an activity can be recorded. It refuses it on arrival when the phone’s clock does not add up, when it overlaps another activity already recorded, when its track runs outside its duration, or when its duration is outside the limits. An activity refused this way does not join your history, and the app tells you it could not be recorded.

These automated decisions bear only on one activity, and they never close an account: a suspension is always decided by a person.

This check decides rather than merely observing, because the ranking earns Bibs and chests, and a real prize will be at stake at launch. A carefully manufactured activity would then have a parcel delivered to someone who did not run.

You can dispute a decision of this check and ask for a person to look at your activity: write to hello@sakalm.com with the date of the activity. We reply within 72 working hours, and within one month at the latest, which is the period the law allows us.

WHAT OTHER PEOPLE SEE OF YOU

There are three circles around you, and they do not show the same things.

FIRST CIRCLE, ALL MEMBERS. Your username and your profile photo are visible to any member who searches for you. That is how a friend is added, by typing the first letters of a username, and there is no other path: someone who types yours therefore finds you, with your photo, without being your friend and without your knowing. Nothing else is shown to them: not your activities, not your figures, not your route.

SECOND CIRCLE, YOUR GROUP FOR THE WEEK, in Challenge as in Challenge +. Ten people you did not choose, six during your first two weeks, brought together because their level is close to yours, and whom you do not know. They see your username, your profile photo and its frame, your title, your favourite sport, the Premium badge if you subscribe, your total kilometres, your rank, your declared level, your active days, your streak, and the number of cheers you received during the week. Nothing more: never your route, never the place, never the time of your activities. This is not an oversight, it is a decision: knowing when someone runs amounts to knowing when their home is empty.

THIRD CIRCLE, YOUR FRIENDS AND YOUR PRIVATE GROUPS. A friend is someone you went and found by their username and added yourself, or whose request you accepted. It is the only circle where your route can appear, and never without your having decided it. One point to know: in a private group, the other members are not necessarily your friends. A group is filled with the friends of whoever created it, and nothing obliges the guests to know one another. A club, for its part, is joined at your request, approved by a coach of your category (or by the club’s admin if it has no coach yet), and none of your activities go there without a switch you turn on yourself. The sections that follow say exactly what each of them sees.

Your profile photo is therefore visible to your friends, to the members of your private groups whether friends or not, to the people in your group for the week, and to anyone who searches for you by your username. That is the sole purpose of a profile photo, it is optional, and you can remove it whenever you like.

IN A PRIVATE GROUP

A private group is filled by hand, with the friends of whoever created it. Only a friend can therefore add you to it, and they can only do so because you accepted their friendship. A group played in two teams follows the same rule: both teams are in the same group and read the same ranking.

One exception is planned, and you will choose it yourself: random matchmaking, for subscribers only. IT IS NOT OPEN YET: today nobody can ask for it, and no group is formed that way. Here is what it will do once it opens. If you ask for it alone, five people at your level whom you do not know complete a group of six for seven days; as a team of two to five friends, your team faces a team of the same size and the same level. Your level is what you cover each week. While you search, the other people searching for the same thing see your username and profile photo, and how long you have been searching. In a group of six, the others see of your activities what a member who is not your friend sees: the sport, the distance, the duration, the elevation gain and the day, never the route or the photos. In a match, the opposing team sees your username, the distance, the duration and the pace of each activity, and nothing else, even if you are friends. There is no chat in a group of six or between two teams, only reactions under activities; a team of friends keeps the chat of its own group while it searches. Nothing to win but titles.

When you join a private group, your activities in that group’s sport appear there automatically, in the ranking and in the group’s feed. Members see your profile photo, the sport, the distance, the duration, the elevation gain and the day. If you posted the activity on your feed with photos or a caption, those stay reserved for your friends: a member who is not your friend does not see them. Never the time, and never your surname, your first name, your age, your height, your weight, your town or your email address.

That is the very point of a challenge among friends: you cannot measure yourself against someone whose activities you cannot see. You can leave a group at any time, and your activities immediately stop appearing there. You can also remove someone from your friends, or block them, from the Friends tab.

An activity in a sport OTHER than the group’s never goes there on its own. You can put it there by hand if you want, from the activity detail. Your step days follow the same rule in groups played on steps.

THE ROUTE NEVER GOES OUT ON ITS OWN. Two conditions are needed for a member to be able to open the map of one of your activities: that you allowed it in that particular group, with the switch at the top of its screen, and that you are friends. Both, not one or the other. A member who is not your friend will therefore never open it, even in a group where you said yes.

And even then, it arrives under the rule described below: cut at both ends, or whole if that is what you chose in “My routes”.

IN A CLUB GROUP

A club group is a group of its own kind, run by a coach. A coach is a person whose account we activated, at the request of a sports club or association, a municipality or a school we have signed with. A company cannot have one: it is not provided for, and the database refuses it.

The coach’s account is created by us, or by the club’s admin (see below): the club gives their first name, surname, email address and the category or categories they will follow, and an invitation is sent to them to choose a password. We may also create their account directly with a password that we pass on to them. They then fill in a short form, where their first name and surname are already the ones the club gave, adding a username, and accept these texts. We do not ask for their date of birth. We ask for neither their height, nor their weight, nor their sporting habits, and their account only has the coach space: no challenge, no friends feed. An invitation that is never opened is deleted after thirty days, together with the address it held.

A club may also have an admin: a person from the club, who is also our contact at the club, whose account we create at the club’s request, with their first name, surname, email address and a password that we pass on to them; their starting username is “Admin_” followed by the club’s name, and when they first sign in to the app they fill in the same short form as the coach (first name, surname, username) and accept these texts. The admin organises the club and never sees an activity, nor a distance, a time or a schedule. They tick the club’s categories from a list we maintain (for instance U17, U18, U20, Seniors, never below sixteen) and may create others for their club, put one or more coaches in each category, create their coaches’ accounts themselves, may move a member to another category (the member then leaves the groups of their former category, and is told so) or remove them from the club, see the list of the club’s members (username, first name, surname and category), the club’s code and link, the number of arrivals per week and what the club’s referrals have earned it, and about each coach: their groups (name and number of members), the instructions they sent, never who completed them, and the number of requests they approved. The admin and the coach work from the app or from a website, admin.sakalm.com for the admin and coach.sakalm.com for the coach, with the same accounts and the same rules: the website shows nothing more than the app.

You never enter a club without having asked for it yourself. There is no link and no code to get in. From “My club”, you search for your club by its name, choose your category if the club has any, and ask to join. The coach or coaches of your category then receive your username, your first name and your surname, to recognise you among the club’s members, and nothing else. One of them accepts or declines. If your category has no coach yet, the club’s admin approves. Your first name and surname go to the coaches of your category and to the club’s admin, and to no other member of the club.

Being a member of the club shows nothing of your activities, to anyone. What your coach sees depends on a switch, “My coach sees my figures”, in “My club”. It is off until you turn it on, and the screen that carries it says what the coach will see and will not see. Turning it on is dated, and that gesture is what counts as your agreement. Once on, it covers the whole club: the coach places you in the club group or groups they choose, and your activities in the club’s sport arrive there as in a private group.

What your coach sees, switch on, from the day you turned it on and for the club’s sport only: the day, the distance, the duration, the pace and the elevation gain of each activity, your weekly total, your weekly goal if they gave you one, your progression week by week, the date of your last activity, and whether a session they asked for was done. They find these figures in a summary every Monday and can export them. A group can have several coaches, all from the same club, who see the same things. The other members of the club’s group see the day, sport, distance, duration, pace and elevation gain of your activities, with no photo, no caption and no route, your weekly total if the coach turned the ranking on, and, for each instruction, how many members did it, without saying who.

What your coach never sees: the time of your activities, your route, the place, your heart rate and anything that comes from a health sensor, your weight, your height, your age, your email address. Nor the activities from before the switch, nor those in another sport.

The coach can write you instructions, for example “Thursday, 10 km at an easy pace”, which are sent to you as notifications. An instruction is a text they write: it is not medical advice, and nothing in the app adjusts your sessions based on your health.

The coach can also ask a group a question, for example “Coming to practice tonight?”. Answering is never required, and does not depend on the switch. The coach sees each member’s answer with their username, and who has not answered. The other members of the group only see how many answers of each kind there are, without saying who, and the club admin sees neither the questions nor the answers. Answers are deleted after thirty days.

You turn the switch off whenever you want: the coach stops seeing anything about you that very instant, including your past activities, and you remain a member of the club. You can also leave the club, with one tap, from “My club”, and a coach of your category or the club’s admin can remove you. The club itself receives no figures from us: its admin sees the list of its members, never their activities, and neither the admin nor the coach has access to our internal tools.

The legal basis for this sharing is your consent (article 6.1.a of the European regulation). Withdrawing it means turning the switch off.

IN A COMPANY

THIS SPACE IS NOT OPEN YET. This passage describes what will apply on the day it opens.

A company that has signed with us can have a representative: a person from the company whose account we activated for that purpose. A representative is not a coach, and a company cannot have a coach: the database refuses it. The representative never sees an activity, a distance, a pace, a time, a place or a route, neither yours nor anyone’s.

You join your company as you join a club: from “My company”, you search for it by its name and you ask. The representative receives your username, your first name and your surname, to recognise you, and accepts or declines. They therefore know you are a member, because you asked them. That is all they know: being a member shows nothing of your use of the app, neither whether you open it, nor whether you run, nor when.

What the representative sees is what the next section says: totals, in the challenges you chose to be in, and never you. You can leave your company with one tap, from “My company”, and the representative can remove you. If your employer gave you a subscription, that attachment is a different thing: it does not make you a member, and it shows them nothing.

CHALLENGES BETWEEN CLUBS AND BETWEEN COMPANIES

Challenges between companies are not open yet, any more than the company space: what is said about them here, the representative included, will apply on the day it opens.

Each week, from Monday to Sunday, a club can be set against another club, and a company against another company, in the organisation’s sport. We count kilometres per participant, not a raw total, so that a small club can beat a big one.

You are never in by default. In “My club” or “My company”, each challenge has its own switch, off until you turn it on, and it only applies to that week: the following week, the question is asked again. The screen says what is shared before you turn it on.

What is shared when you take part: your validated kilometres from the moment you turn the switch on until you turn it off, in the challenge’s sport, added to those of the other participants. What the coach or the representative, the opposing organisation and its participants see: a total, an average per participant, a number of participants, a score per day. Never your name, never an activity, never your own share. A challenge is not played below five participants for a club and ten for a company: below that, a total would say too much about each person.

Turning the switch off, or “Share nothing” at the bottom of the same page which takes you out of every challenge at once, stops everything: nothing more of yours is counted. What has already been counted stays in the totals, without your name. Removing it would move the total by exactly your share, and someone who noted it before and after would read it. Nobody is told, neither the coach, nor the representative, nor your employer. Outside a challenge you are in, nothing is counted.

The legal basis is your consent (article 6.1.a), given challenge by challenge. Withdrawing it means turning the switch off.

IN A TERRITORY GAME

Territory claim is played on its own, between the members of a private group. There, the other players see the areas you hold, in your colour, and the area you have taken or lost since they last looked.

They see neither your route, nor the times of day you go out, nor the way you went to close a loop. When someone takes ground from you, you are told, and the map shows you only what was yours and no longer is: never the route of whoever took it.

A game only brings together people you accepted as friends or whose group you joined, and each of them appears there under their username, or under the name of their team. There is no anonymous player, and nobody can look you up by your username to see your areas.

ON YOUR FEED

Alongside groups, there is your friends’ feed. Nothing arrives there on its own: a post starts from a finished activity, at the moment you tap Post yourself. Until you do, none of your activities appear there.

At the moment of posting, you decide what goes with it: a caption if you write one, up to six photos if you attach any, the announcement of your distance or your territory, and what you show of the route. Each photo is cleaned before sending: its capture data, including place and time, is removed. As in a group, it is the day that is shown, never the time.

The route has three possible answers, and the question is asked at EVERY post, never once and for all. You can choose not to show it. You can show it cut. You can show it whole, and in that case nothing is removed: your starting point and your finishing point are visible to whoever sees the post. That choice applies to that activity only; the general choice is made in “My routes”.

A post is visible to your friends, and to them alone: it takes friendship, and the absence of a block between you. You see it yourself exactly as they see it, cut included: what you think you are showing must be what is shown.

You can remove a post at any time. It then leaves the feed, and the photos that went with it are deleted.

CUTTING THE ROUTE

One rule, the same everywhere. A length is removed from the start and the finish of any route that goes out: it is not the journey that reveals an address, it is its two ends.

It is one hundred metres by default, and it is set in Settings, then “My routes”: one hundred, one hundred and fifty or two hundred metres. The same place holds the fourth choice, “Whole route”, which removes nothing: your starting and finishing points are then visible to whoever sees your routes. Your choice applies immediately to everything, including to what you have already shared.

Below three times that length, no route is shown at all: nothing would be left after removing the two ends.

For what others see, the cut is made by the server, never by their phone: a cut worked out on their device would mean having sent it your whole route, and so having already disclosed it. The one exception is the image of one of your activities that you share yourself outside the app (sharing that is reserved today for a few test accounts): your phone, which already has your route, cuts both ends the same way before drawing the image, and nothing leaves until you send it.

A route therefore goes out uncut only if you asked for it, in two ways that both show: “Whole route” in “My routes”, which applies to everything, or the whole route chosen post by post on your feed, which applies to that one only. Never by default.

TWO PLACES WHERE PEOPLE SPEAK TO EACH OTHER

Sakalm has no messaging. Nobody can send you a private message, there is no inbox, and nobody can write to you one to one. Text that goes from one person to another passes through two places, and in both it is read by everyone who is there. A third path exists in a club group only: the coach’s instructions, described above, a text that only the coach writes, for the whole group, and that every member receives as a notification.

THE DISCUSSION INSIDE A PRIVATE GROUP OR A CLUB GROUP. It exists nowhere else, and in particular not in your group for the week, which is formed by matching. It is open only to the members of that group: in a private group, the friends of whoever created it, who accepted its invitation; in a club group, the group’s coach or coaches and the club members they placed there, who are not necessarily your friends. You can leave the group whenever you want, and you then stop reading it as well as writing in it.

What is written there is text, five hundred characters at most, or a voice message: you tap the microphone once to speak and once to send, and the message goes by itself after ten seconds. Twenty messages a minute at most. Each message alerts the other members with a single notification per group: it sounds on the first message, then updates silently with the latest one until you open the discussion. An “@” followed by a username calls a member OF THAT GROUP and nobody else: no one gets called from a group they are not in. You receive at most one call notification per hour and per group, whether your username is written there once or forty times.

The filter that refuses certain words reads text; it cannot listen to a voice message. If a voice message seems out of place to you, block its author, or write to us from the app.

THESE MESSAGES LIVE FOR TWENTY-FOUR HOURS ONLY. After that they are erased for good, with nothing to do on your part, and the username calls go with them. A group discussion is there to say something now, not to build an archive. You can also remove one of your own messages before that: it stops being displayed at once.

COMMENTS UNDER A PUBLISHED ACTIVITY, opened on 24 September 2026. On your feed, a friend can write under an activity you published, five hundred characters at most, or leave a voice comment of ten seconds at most. The word filter only reads text: an out-of-place voice comment is reported or removed, like any other. One comment per person and per activity: you edit yours, you do not stack them. It is read by exactly those who see the activity, that is, you and your friends, and by nobody else. It stays as long as the activity stays, and it goes with it.

ON YOUR OWN ACTIVITIES, YOU DECIDE. You remove any comment written under one of your activities, straight away, with no reason to give and nothing to wait for, and whoever is removed that way cannot write a second one. Yours, you remove wherever it is.

Outside those two places, only two gestures go from one person to another, and neither carries text. The four reactions (bravo, fire, strength, wow) which a member can put on one of your shared activities. And the challenge cheer, which someone in your group for the week can send you once a week: you then get a notification carrying their username, and nothing else.

The server refuses everything else.

WHATEVER IS WRITTEN ON YOUR FEED CAN BE REPORTED. A post, a comment: reporting it removes it from your view at once, before we have even read it, and we decide within twenty-four hours. You can also block someone, which makes the two of you invisible to each other.

AND ANY TEXT ADDRESSED TO SOMEONE PASSES A FILTER BEFORE BEING PUBLISHED. A comment, a group message, a caption: the server looks for a list of words in it, and refuses the whole text rather than publishing part of it. Mild insults pass, and that is deliberate; what targets a person for what they are does not. When a text is refused, we keep the date, the word found and the first hundred characters for twelve months, to see whether someone tries again; they are then erased automatically. Nothing is decided automatically from that count: a ban is pronounced by a person.

The only other free text that circulates is what you write about your own affairs: your username, the name of a group you create, and the caption of your posts. None of that is addressed to anyone in particular.

WHO ELSE HAS ACCESS

Nobody outside Sakalm, apart from the providers and recipients named further down in this section, each for what concerns them and nothing more. Your data is neither sold, nor rented, nor passed to advertisers. There is no advertising in the app.

INSIDE SAKALM, HOWEVER, PEOPLE CAN READ IT, and that has to be said plainly. We have an internal tool, on a separate address, where a handful of named people answer questions, check a disputed activity, grant a subscription that never arrived, or follow up a client who bought licences for their staff.

What they see depends on what they have to do there, and not one thing more: each of them has a role that opens some pages and closes others. Email addresses are masked from anyone who has no reason to read them. Nobody writes into the tables directly: every action goes through a door that checks the right before acting.

EVERYTHING DONE THERE IS RECORDED, including the simple fact of opening your file: who, what, when. That record cannot be altered and is not erased for two years, not even by us. It is what lets us answer the question “who looked at my account, and when” instead of asking you to take our word for it.

Those people can also write an internal note on your account, for example so that an ongoing complaint is not restarted from scratch by someone else. THOSE NOTES ARE OWED TO YOU: they come out in “Export my data”, with their date, like everything else. The name of the team member who wrote them is not included; write to us if you want to know, and the question is handled case by case.

Two technical providers host it on our behalf, with no right to use it: Supabase Inc. (970 Toa Payoh North, Singapore) and Amazon Web Services, Europe region.

On the day you win a prize to be delivered to you, your name and your address are passed to the carrier handling the shipment, for that shipment and nothing else. Without that, the parcel cannot go out.

The notifications you receive go through Expo’s delivery service (650 Industries, Inc., United States). It receives your phone’s identifier and the text of the message, for as long as it takes to hand it to Apple or Google. That is the compulsory path of a notification: none arrives without going through it. If you refuse them, none of that happens.

Each time it starts, the app asks Expo’s update service (650 Industries, Inc., United States) whether a new version of its code exists. That request carries your phone’s IP address, its system, the app version and an identifier drawn at random at installation, which designates only that installation. It carries neither your account, nor your location, nor anything you do in the app.

The maps shown in the app are provided by Apple Maps on iPhone, and by Google Maps on Android (Google LLC, United States). To draw a map, your phone asks them for the pieces of the area on screen: they therefore receive your phone’s IP address and the area you are looking at, but neither your account nor your route, which the app draws itself on top. On Android, the Google component that draws the map can also send Google its own technical data, under Google’s privacy rules.

The emails we send you go through Resend (Resend, Inc., United States): the link to confirm your address or change your password, and the rare messages about your account, such as notice of its deletion or of a change in your referral. It receives your email address and the content of the email, to deliver it to your mailbox. Without it, no email can reach you.

The sakalm.com website and the team’s internal tool are hosted by Cloudflare (Cloudflare, Inc., United States). When you visit the website, Cloudflare receives your device’s IP address and the page requested, long enough to serve it to you. When a team member opens your file in the internal tool, what they read passes through Cloudflare’s servers on its way to their screen. Cloudflare has no right to use that data for itself.

Chests are placed on real footpaths, and our server fetches the map of those paths from Overpass, a public OpenStreetMap service hosted in Germany. What leaves is a rectangle of map about five kilometres by four, with no identifier, no account and no precise position: Overpass cannot know who opened the map. It is our server that asks, never your phone, and only once per area.

SUGGESTED ROUTES ARE DRAWN ON THE MAP, NOT ON YOUR ACTIVITIES. When you ask for a route, the app offers you a loop built in advance on OpenStreetMap paths, never someone else’s track. Your activities contribute in two ways, both as numbers and without any identifier. They say in which neighbourhoods loops should be prepared, on a grid of about five hundred metres that keeps nobody’s start or finish point. And they count, path by path, how many different accounts have run along it: that count only exists from three accounts upwards, it says neither who nor when, and it makes a path slightly more likely to appear in suggested loops. An activity only enters that count if the automatic check validated it and if your “My routes” switch is on: turning it off removes you from it, past activities included, at the next recount, and that is also how you object to it. This processing rests on our legitimate interest in suggesting useful routes where people actually run.

THE ELEVATION SHOWN ON A SUGGESTED ROUTE COMES FROM THE IGN. Our server queries the elevation service of the French national geographic institute with the coordinates of the loop itself, never yours: this question is asked once per suggested loop, not once per person who follows it, and nothing links that request to your account.

IF SOMEONE ELSE PAYS FOR YOUR SUBSCRIPTION

A company, a club or an association can buy Sakalm licences for its members. If that is your case, there are things you need to know, and we also send them to you by notification on the day the link is made.

That organisation gave us your address, not you. All we hold from it is what the licence requires: the link between your account and it, and the date. Nothing more.

IT SEES NOTHING OF WHAT YOU DO HERE. Not your activities, not your distances, not your locations, not the times of day you go out, not your ranking, not even whether you open the app. No space, in the app or anywhere else, shows it how you use the app, and this is not a setting: there is nothing to set, that access does not exist.

You can refuse this link. Write to us and we remove it. The only consequence is that you lose the subscription it was paying for; your account, your activities and everything else stay as they are.

This link appears in “Export my data”, with the name of the organisation and the date.

WHERE THIS DATA GOES

It is hosted in Europe. Five things leave: Supabase’s head office is in Singapore, and its technical teams can access the infrastructure to maintain it; Expo’s services, for notifications and app updates, are in the United States; so is the email delivery service; Cloudflare, which hosts the website and the team’s internal tool, is American too; and the maps come from Apple and Google, two American companies. The transfers to Supabase, Expo, Resend and Cloudflare are framed by the European Commission’s standard contractual clauses, which all four providers include in their terms. Apple and Google serve their maps under their own privacy rules, and receive only what is described above.

One exception only, and it is imposed by law: the name and address of a referrer who has passed EUR 2,400 in the year are passed to the French tax authorities, once a year, with the amount paid. Beyond what this page describes, including your address passed to the carrier of a prize, nothing else about you is passed on, to anyone.

FOR HOW LONG

Your activities and your account are kept for as long as the account exists. If you delete it, the erasure is immediate: your tracks, your activities, your entries, your profile and your sign-in account go the second you confirm, and every open session closes. No backup copy survives beyond thirty days.

Your photos are erased by the app at the moment of deletion. Should one of them hold out, because the network dropped at the wrong moment, an automatic task runs every night and removes the files that no longer belong to anyone. No photo stays traceable to you.

Referral records are the exception, and the law imposes that too: earnings paid, their date and the referrer’s tax identity are kept for six years, even after the account is deleted, because they are accounting records.

A few traces also remain for a while, no longer linked to any account: the team’s access record, which keeps for two years who opened your file and when; error reports, detached from your account and erased after three months like the others; an email that was sent to you, with your address, kept for ninety days after sending (one year if it could not be sent); the record of a paid subscription or purchase (plan or item, dates, amount and payment reference), kept for ten years for our accounting obligations; and your reason for leaving if you give one, kept with nothing that identifies you.

The address you give to receive a prize is kept for ninety days after shipping, long enough for a lost parcel, a return or a claim to be settled. After that it is erased. You can also ask for it to be erased before that point, as soon as the prize has arrived, by writing to hello@sakalm.com.

The GPS route of an activity, that is the sequence of your positions, is kept for twelve months. After that it is erased automatically, and the activity remains: its distance, its duration, its pace, its splits and its place in the rankings do not move. It is the map that disappears, not the memory. Twelve months because that is the time needed to compare an activity with last year’s, and because a position is the most sensitive data this app handles.

AFTER THREE MONTHS, YOUR ROUTE LOSES BOTH ENDS, IN OUR DATABASE TOO. The length you chose in Settings is removed from the start and from the finish, and never less than one hundred metres: “Whole route” says what you show, not what we keep. It is not the journey that reveals an address, it is its two ends, and nothing justifies keeping them for a year when they stop being useful after a quarter. Your map stays, it starts and finishes a little further along. Your kilometre splits do not move: they are set aside before the trimming, exactly as they were.

An activity too short to take that trimming, less than three times the length you chose, is made of nothing but its two ends. Its route goes entirely after three months, and the activity stays with its distance and its duration.

THE CHECK’S SCORE IS ERASED AT THE SAME TIME. After twelve months, the score the automatic check gave an activity, the clues behind it and the reliability index disappear along with the route. This is deliberate: that score is an accusation, and the route is its evidence. Keeping the accusation after erasing the means of checking it would leave a judgement that nobody, neither you nor us, could examine any more. What remains is the state of the activity on that day, counted or not, because rewriting it afterwards would falsify your history.

The messages of a group discussion, written or spoken, are erased twenty-four hours after they were sent, and the username calls go with them. The file of a voice message is erased from storage at most one hour later. It is the shortest period on this page, and that is deliberate: a group discussion is there to say something now. No copy of them is kept anywhere else.

Error reports, the log of automatic tasks and notification delivery traces are erased after three months. After a quarter and two versions, a crash no longer helps fix anything.

These erasures are carried out by automatic tasks, on the first of each month for the durations above, every hour for group messages and every night for orphan files. They require nothing of you.

An account left inactive for three years is deleted, after a warning email sent to the account address. Sakalm has been open since 2026: no account has been able to reach that mark yet.

YOUR RIGHTS

You can at any time see your data, correct it, take it away and have it erased.

Height, weight, sex, country, state and town, sports, level, routine, email address and password are changed in Settings, then “My information”. First name, surname, username and date of birth are fixed there from sign-up: to correct one of them, write to hello@sakalm.com.

You can also ask for its use to be frozen while a disagreement is settled, and object to a processing we base on our legitimate interest, such as the checking of activities.

Any agreement you have given is withdrawn as simply as it was given, without having to justify it: the health agreement is turned off on this screen, notifications in your phone’s settings. Withdrawal applies going forward, it does not undo what was done before.

Two buttons do it directly, without having to write to anyone: “Export my data” on this screen, and “Delete my account” right at the bottom of Settings. Deletion requires typing the word DELETE, so that it does not start from an unlucky tap. Without the app, you can also ask for your account and your data to be deleted by writing to hello@sakalm.com from your account’s address: it is done within 72 working hours, and what then remains in backups is erased within the periods given on this page.

For anything else, write to hello@sakalm.com. We reply within 72 working hours, and within one month at the latest, which is the period the law allows us. If the answer does not suit you, you can refer the matter to the CNIL, 3 place de Fontenoy, 75007 Paris, www.cnil.fr.

THE MINIMUM AGE

Sakalm is not open to anyone under 16, the reference age of the European data protection regulation.

This is a translation, provided for convenience. Sakalm is published in France and its obligations are written in French. Where the two versions differ, the French version prevails.