Effective Date: May 15, 2026

Last Updated: May 15, 2026

Humble Rhino Inc. ("we," "us," or "our") operates the OpenRun mobile application and website (collectively, the "Platform"). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use our Platform. By using OpenRun, you consent to the practices described in this policy.

This policy is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Canadian provincial privacy legislation.

1. Information We Collect

1.1 Information You Provide

• Account information: name, email address, username, password, date of birth, gender, and profile photo
• Profile details: bio, sports preferences, skill levels, and location (city/neighbourhood)
• Payment information: processed and stored by Stripe, Inc. We retain only the card brand, last four digits, and expiration date for display purposes
• User-generated content: messages, community posts, comments, run reviews, photos uploaded to runs or chats, and receipt images
• Communications: messages you send to other users via direct messages or run group chats

1.2 Information Collected Automatically

• Device information: device type, operating system, browser type, and unique device identifiers
• Usage data: screens visited, features used, runs viewed or joined, and interaction patterns
• Location data: precise geolocation (with your permission) for finding nearby runs, calculating distances, and venue check-in verification. Approximate location may be derived from IP address
• Log data: IP address, access times, and referring URLs

1.3 Information from Third Parties

• Stripe: payment confirmation status, charge results, and refund status
• Geocoding services: address-to-coordinate lookups via OpenStreetMap (Nominatim/Photon)

2. How We Use Your Information

We use your personal information for the following purposes:

• To create, maintain, and secure your account
• To match you with nearby pickup games based on your sport preferences, skill level, location, and gender preferences
• To process payments, split costs between run participants, and issue refunds when runs are cancelled
• To facilitate communication between users through direct messages and run group chats
• To send you notifications about runs, messages, friend requests, payment confirmations, and other Platform activity
• To display your public profile to other users (subject to your privacy settings)
• To enforce our Terms of Service, prevent fraud, and protect the safety of our community
• To administer the Platform, including content moderation, report handling, and user management
• To improve the Platform through aggregated, anonymized usage analytics

3. Legal Basis for Processing

Under PIPEDA, we process your information based on:

• Consent: you provide express consent when creating your account and granting location permissions
• Contractual necessity: processing required to provide the services you have requested (payments, run matching, messaging)
• Legitimate interests: Platform security, fraud prevention, and service improvement
• Legal obligations: compliance with applicable Canadian laws, tax reporting, and law enforcement requests

4. Location Data

Location is central to how OpenRun works. Here is how we handle it:

• We request precise location permission to show runs near you and calculate distances. This is optional — you can use the Platform without granting location access, but distance-based features will be limited
• Your location is never continuously tracked in the background
• Your precise coordinates are not shared with other users. Other users see only the city or neighbourhood you choose to display on your profile
• Venue coordinates are stored to display runs on the map and are visible to all users

5. Payment Information

All payment processing is handled by Stripe, Inc., a PCI-DSS Level 1 certified payment processor. We never receive, process, or store your full credit or debit card number.

• When you save a payment method, a tokenized reference is stored by Stripe. We store only the card brand, last four digits, and expiration date for your reference
• Charges are initiated automatically by our system based on the run's scheduled start time (typically 3 hours before). You are notified before any charge occurs
• Hosts who receive payouts connect their Stripe account through Stripe Connect. We do not have access to their bank account details
• Stripe's privacy policy governs how Stripe handles your payment data: https://stripe.com/privacy

6. Sharing and Disclosure

We do not sell, rent, or trade your personal information.

We share information only in these circumstances:

• With other users: your profile name, avatar, sports, skill level, and reviews are visible to other users as part of normal Platform functionality. You can restrict DMs to friends only and hide your profile from search in your privacy settings
• With Stripe: payment details necessary to process charges, refunds, and payouts
• With service providers: infrastructure providers (Supabase for database and authentication, Vercel for hosting) who process data on our behalf under contractual obligations
• For legal reasons: when required by law, court order, or governmental authority; to protect our rights, safety, or property; or to prevent fraud or illegal activity
• Business transfers: in connection with a merger, acquisition, or sale of assets, your information may be transferred to the successor entity

7. Data Retention

• Account data is retained for as long as your account is active
• When you delete your account, we delete your profile, messages, posts, reviews, and run participation history. Some data may persist in encrypted backups for up to 30 days
• Payment transaction records are retained for 7 years as required for tax and financial reporting obligations
• Anonymized, aggregated data may be retained indefinitely for analytics
• Reports and moderation records may be retained after account deletion to protect community safety

8. Your Rights

Under PIPEDA and applicable provincial legislation, you have the right to:

• Access: request a copy of the personal information we hold about you. You can export your data from the app settings
• Correction: update inaccurate information through your profile settings or by contacting us
• Deletion: delete your account and associated data through the app settings. Certain data may be retained as described in Section 7
• Withdraw consent: you may withdraw consent for optional data collection (e.g., location permissions) at any time through your device settings
• Privacy controls: restrict who can message you (friends only), hide your profile from search, and manage notification preferences

To exercise these rights, contact us at support@openrunapp.com. We will respond within 30 days.

9. Data Security

We implement industry-standard security measures to protect your information:

• All data is encrypted in transit using TLS/SSL
• Database access is protected by row-level security (RLS) policies ensuring users can only access data they are authorized to see
• Authentication is handled by Supabase Auth with secure token management
• Payment data is handled exclusively by PCI-DSS compliant Stripe infrastructure
• Administrative access is restricted and logged

While we take reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

10. Children's Privacy

OpenRun is not intended for users under the age of 16. We do not knowingly collect personal information from anyone under 16. If we learn that we have collected information from a user under 16, we will promptly delete that information and terminate the account. If you believe a child under 16 is using OpenRun, please contact us at support@openrunapp.com.

11. International Data Transfers

Your data is primarily stored and processed in Canada. Some of our service providers (Stripe, Vercel) may process data in the United States or other jurisdictions. Where data is transferred outside Canada, we ensure appropriate safeguards are in place through contractual obligations with our service providers.

12. Cookies and Local Storage

OpenRun uses browser local storage to save your theme preference, authentication session, and certain UI state. We do not use third-party tracking cookies or advertising pixels.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes through in-app notifications or email. Your continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

14. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data practices, contact our Privacy Officer:

Humble Rhino Inc.

Email: support@openrunapp.com

Website: openrun.ca

If you are not satisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.