Data and privacy

Text version: 2026-09-07

Sakalm records running, walking and cycling activities. To do that, the app handles data about you. Here is what data, why, and what you can demand at any time.

WHO IS RESPONSIBLE

Sakalm, 10 place Souham, Hall 3, 75013 Paris, France. For any question or to exercise your rights: hello@sakalm.com.

WHAT THE APP COLLECTS

Your account: email address, username, first name and surname. Without them, no account.

Your profile: date of birth, sex, region and town, and if you fill them in, height and weight. The date of birth is used to check the minimum age. Height and weight are optional and are used only to estimate a calorie expenditure.

Your activities: the GPS route, the date, the time, the duration, the distance and the elevation. This is the heart of the app.

Your heart rate, if and only if you consented to it separately. It is health data, it has its own switch on this screen, and you can turn it off whenever you like.

Your steps, when you tap "Confirm my steps". While the home screen is open, the phone’s pedometer is read to show you your count for the day, and that count does not leave the device: nothing is sent or kept until you have confirmed it yourself.

What Sakalm reads in Apple Health, if you give your health agreement. Two uses, and the same agreement for both.

The import screen reads your running, walking and cycling sessions to add them to your history: their GPS route where there is one, their distance, their calories, their heart rate, and the stride measurements some watches record, ground contact time, vertical oscillation and stride length.

And the app completes activities you have already recorded with those same measurements, which the phone alone cannot take. That reading happens on its own, when the app starts, at the end of an activity and when an activity page is opened. It never happens in the background: the app has to be open in front of you.

Nothing else is read there: no weight, no sleep, no resting pulse, no other medical data. Nothing is ever written into Apple Health. And nothing at all is read until you have given your health agreement, which is separate from accepting these texts and can be withdrawn whenever you like.

Your profile photo, if you set one. It is optional, the app opens your photo library only at the moment you ask it to, and it reads no other image. The capture data, including the place, is removed before sending. You can remove it whenever you like from your account menu: the file is then deleted.

The photos you attach to a shared activity, taken on the spot with the camera or chosen from your photo library. The camera opens only when you tap "Take a photo", it never switches on by itself, and nothing is recorded until you have pressed the shutter yourself. Here too, the place and time written inside the image are removed before sending.

A notification delivery identifier, if you accept them. It designates your phone, not you, it says nothing about what you do, and it is erased with your account. Without it, no notification can reach you. Refusing notifications prevents nothing else from working.

Reactions and cheers: the ones you put on other people’s activities, and the ones people put on yours, with the name of whoever sent them. These are symbols, never text.

Minimal technical data: app version, device model, and the errors encountered, so they can be fixed.

Your surname, first name and full postal address, ONLY on the day you win a prize to be delivered to you. They are then asked of you by email, never before, and they serve only for the shipment: no other member sees them, and the app shows them nowhere. As long as no prize is at stake, this request happens for nobody.

Your full name and postal address, ONLY if you are a referrer and your earnings pass EUR 2,400 in a single calendar year. Below that threshold we do not ask for them and we do not have them. Above it, the law requires us to report these payments to the tax authorities with the identity of the recipient: it is a legal obligation, not a choice on our part, and the payment cannot go out without it. These two pieces of information live in a separate table, which the app never reads back, and they are visible to no other member.

YOUR LOCATION, AND WHEN IT IS READ

It is the most sensitive data the app handles, so here is exactly what happens.

Sakalm asks for the "Always" location permission. That permission is essential, and not for convenience: without it, iOS cuts off GPS reading as soon as you put the phone in your pocket, the screen goes off, or you switch to another app. The route stops dead, and every kilometre covered afterwards is lost. A running app that only works with the screen on, held out in front of you, is of no use.

"Always" does not mean "all the time". Your location is read ONLY during an activity you started yourself by tapping GO, and reading stops as soon as you tap STOP. Between two activities, the app does not ask for your location, does not receive it, and keeps no trace of it.

During an activity, iOS shows a location indicator at the top of your screen at all times. It is there for you: while it is on, the app is reading your location; when it goes off, it no longer is.

The recorded route stays private by default. Nobody in your group for the week ever sees it. It goes out by two paths only, and both require an act on your part: a private group, where it takes both your permission in that group and friendship, and where the route always arrives cut; and your feed, where you post one activity at a time and decide for each one whether to show the route cut, whole, or not at all. Three sections below say exactly how: "In a private group", "On your feed" and "Cutting the route".

You can withdraw this permission at any time in your phone’s settings. The app will keep working, but it will no longer be able to record an activity.

WHY

To run the app and your account. This is performance of the contract between us: without this data, there is no service.

To draw up the weekly ranking and check that activities are genuine. This is the legitimate interest of a competition: without checking, it has no value for those who play honestly.

To handle your heart rate, only on your explicit consent, which you can withdraw at any time without having to justify it.

WHAT THE MACHINE DECIDES ON ITS OWN

Every recorded activity goes through an automatic check. Nobody looks at it at that moment: it is a program, and it decides alone.

Here is how it works, because you have the right to know. It scores each activity from zero to one hundred by looking for seven families of clues: speed, acceleration, GPS signal quality, position jumps, consistency between sensors, repetition of the same route, and the presence of a simulated position. The higher the score, the more the activity looks like a manufactured measurement rather than a real outing.

Below fifty, the activity passes. From fifty, it is flagged and shown as "to be checked". From seventy, it is not counted. A detected simulated position is worth one hundred on its own, so an immediate refusal.

An activity that is not counted stays in your history and you still see it, but it earns neither Goldies nor a place in the ranking. It is the only decision of this kind in the app, it bears only on one activity, and it never closes an account: a suspension is always decided by a person.

This check decides rather than merely observing, ever since Challenge + put a real prize at stake. A carefully manufactured activity would have a parcel delivered to someone who did not run.

You can dispute it and ask for a person to look at it: write to hello@sakalm.com with the date of the activity. We reply within 72 working hours, and within one month at the latest, which is the period the law allows us.

WHAT OTHER PEOPLE SEE OF YOU

There are three circles around you, and they do not show the same things.

FIRST CIRCLE, ALL MEMBERS. Your username and your profile photo are visible to any member who searches for you. That is how a friend is added, by typing the first letters of a username, and there is no other path: someone who types yours therefore finds you, with your photo, without being your friend and without your knowing. Nothing else is shown to them: not your activities, not your figures, not your route.

SECOND CIRCLE, YOUR GROUP FOR THE WEEK, in Challenge as in Challenge +. Ten people you did not choose, six during your first two weeks, brought together because their level is close to yours, and whom you do not know. They see your username, your total kilometres, your rank, your declared level, your number of active days and your current streak. Nothing more than a line in a ranking: never your route, never the place, never the time of your activities. This is not an oversight, it is a decision: knowing when someone runs amounts to knowing when their home is empty.

THIRD CIRCLE, YOUR FRIENDS AND YOUR PRIVATE GROUPS. A friend is someone you went and found by their username and added yourself, or whose request you accepted. It is the only circle where your route can appear, and never without your having decided it. One point to know: in a private group, the other members are not necessarily your friends. A group is filled with the friends of whoever created it, and nothing obliges the guests to know one another. The two sections that follow say exactly what each of them sees.

Your profile photo is therefore visible to your friends, to the members of your private groups whether friends or not, and to anyone who searches for you by your username. That is the sole purpose of a profile photo, it is optional, and you can remove it whenever you like.

IN A PRIVATE GROUP

A private group is never formed by matching: it is filled by hand, with the friends of whoever created it. Only a friend can therefore add you to it, and they can only do so because you accepted their friendship. A group played in two teams follows the same rule: both teams are in the same group and read the same ranking.

When you join a private group, your activities in that group’s sport appear there automatically, in the ranking and in the group’s feed. Members see the sport, the distance, the duration and the day. Never the time, and never your surname, your first name, your age, your height, your weight, your region or your email address.

That is the very point of a challenge among friends: you cannot measure yourself against someone whose activities you cannot see. You can leave a group at any time, and your activities immediately stop appearing there. You can also remove someone from your friends, or block them, from the Friends tab.

An activity in a sport OTHER than the group’s never goes there on its own. You can put it there by hand if you want, from the activity detail. Your step days follow the same rule in groups played on steps.

THE ROUTE NEVER GOES OUT ON ITS OWN. Two conditions are needed for a member to be able to open the map of one of your activities: that you allowed it in that particular group, with the switch at the top of its screen, and that you are friends. Both, not one or the other. A member who is not your friend will therefore never open it, even in a group where you said yes.

And even then, it arrives cut, under the rule described below. A group feed never shows a whole route.

ON YOUR FEED

Alongside groups, there is your friends’ feed. Nothing arrives there on its own: a post starts from a finished activity, at the moment you tap Post yourself. Until you do, none of your activities appear there.

At the moment of posting, you decide what goes with it: a caption if you write one, a photo if you attach one, the announcement of your distance or your territory, and what you show of the route. The photo is cleaned before sending: its capture data, including place and time, is removed. As in a group, it is the day that is shown, never the time.

The route has three possible answers, and the question is asked at EVERY post, never once and for all. You can not show it. You can show it cut. You can show it whole, and in that case nothing is removed: your starting point and your finishing point are visible to whoever sees the post. It is the only case, in the whole app, where a route goes out uncut, and it requires that explicit act on that particular activity.

A post is visible to your friends, and to them alone: it takes friendship, and the absence of a block between you. You see it yourself exactly as they see it, cut included: what you think you are showing must be what is shown.

You can remove a post at any time. It then leaves the feed, and the photo that went with it is deleted.

CUTTING THE ROUTE

One rule, the same everywhere. A length is removed from the start and the finish of any route that goes out: it is not the journey that reveals an address, it is its two ends.

It is one hundred metres by default, and you can raise it to one hundred and fifty, two hundred or three hundred in Settings, then My data. Your choice applies immediately to everything, including to what you have already shared.

Below three times that length, no route is shown at all: nothing would be left after removing the two ends.

The cut is made by the server, never by your phone: a cut worked out on the device would mean having sent it the whole route, and so having already disclosed it.

It knows one exception, the one in the previous section: the whole route you choose yourself, post by post, on your feed.

NO MESSAGES, ANYWHERE

Sakalm has no messaging. Nobody can send you a private message, and nobody can write under one of your activities: there is no comment, no reply, no discussion, nowhere in the app, not in your group for the week, not in a private group, not on your feed.

Only two gestures go from one person to another, and neither carries text. The four reactions, cheer, fire, strength, wow, which a member can put on one of your shared activities. And the challenge cheer, which someone in your group for the week can send you once a week: you then get a notification carrying their username, and nothing else.

The server refuses everything else. Nobody can therefore send you a word, and you cannot send one to anybody.

The only free text that circulates is what you write yourself about your own affairs: your username, the name of a group you create, and the caption of your posts. None of that is addressed to anyone in particular.

WHO ELSE HAS ACCESS

Nobody else. Your data is neither sold, nor rented, nor passed to advertisers. There is no advertising in the app.

Two technical providers host it on our behalf, with no right to use it: Supabase Inc. (970 Toa Payoh North, Singapore) and Amazon Web Services, Europe region.

On the day you win a prize to be delivered to you, your name and your address are passed to the carrier handling the shipment, for that shipment and nothing else. Without that, the parcel cannot go out.

The notifications you receive go through Expo’s delivery service (650 Industries, Inc., United States). It receives your phone’s identifier and the text of the message, for as long as it takes to hand it to Apple or Google. That is the compulsory path of a notification: none arrives without going through it. If you refuse them, none of that happens.

WHERE THIS DATA GOES

It is hosted in Europe. Two things leave: Supabase’s head office is in Singapore, and its technical teams can access the infrastructure to maintain it; the notification delivery service is in the United States. Both transfers are framed by the European Commission’s standard contractual clauses, which both providers include in their terms.

One exception only, and it is imposed by law: the name and address of a referrer who has passed EUR 2,400 in the year are passed to the French tax authorities, once a year, with the amount paid. Nothing else is passed on, to anyone.

FOR HOW LONG

Your activities and your account are kept for as long as the account exists. If you delete it, everything is erased within thirty days, with no backup copy beyond that.

Referral records are the exception, and the law imposes that too: earnings paid, their date and the referrer’s tax identity are kept for six years, even after the account is deleted, because they are accounting records. Nothing else survives deletion.

The address you give to receive a prize is kept for ninety days after shipping, long enough for a lost parcel, a return or a claim to be settled. After that it is erased. You can also ask for it to be erased before that point, as soon as the prize has arrived, by writing to hello@sakalm.com.

The GPS route of an activity, that is the sequence of your positions, is kept for twelve months. After that it is erased automatically, and the activity remains: its distance, its duration, its pace, its splits and its place in the rankings do not move. It is the map that disappears, not the memory. Twelve months because that is the time needed to compare an activity with last year’s, and because a position is the most sensitive data this app handles.

Error reports, the log of automatic tasks and notification delivery traces are erased after three months. After a quarter and two versions, a crash no longer helps fix anything.

These erasures are carried out by an automatic task, on the first of each month. They require nothing of you.

An account left inactive for three years is deleted, after a warning email.

YOUR RIGHTS

You can at any time see your data, correct it, take it away and have it erased. You can also ask for its use to be frozen while a disagreement is settled, and object to a processing we base on our legitimate interest, such as the checking of activities.

Any agreement you have given is withdrawn as simply as it was given, without having to justify it: the health agreement is turned off on this screen, notifications in your phone’s settings. Withdrawal applies going forward, it does not undo what was done before.

Two buttons do it directly, without having to write to anyone: "Export my data" on this screen, and "Delete my account" right at the bottom of Settings. Deletion requires typing the word DELETE, so that it does not start from an unlucky tap.

For anything else, write to hello@sakalm.com. We reply within 72 working hours, and within one month at the latest, which is the period the law allows us. If the answer does not suit you, you can refer the matter to the CNIL, 3 place de Fontenoy, 75007 Paris, www.cnil.fr.

THE MINIMUM AGE

Sakalm is not allowed to anyone under 16, the reference age of the European data protection regulation.

This is a translation, provided for convenience. Sakalm is published in France and its obligations are written in French. Where the two versions differ, the French version prevails.