Privacy Policy

2. Scope

This Privacy Policy applies to the Sesh mobile app and any related websites we operate for account deletion, support, or legal notices.

It does not apply to third-party websites or services you access through Sesh.

3. Information We Collect

Information you provide:

• Account credentials — email address, password (hashed by Supabase Auth) — used for authentication and account recovery
• Profile — display name, username, avatar, status/bio, role (runner/owner) — used for identity and social features
• Club & run data — club names, descriptions, cities, session details, RSVPs, attendance — used for core app functionality
• User-generated content — posts, comments, poll responses, images — used for community features
• Communications — support emails you send us — used for customer support

Information collected automatically

We do not collect: contacts, SMS, call logs, browsing history from other apps, advertising IDs for ad targeting, or health data from Apple Health / Google Fit.

• Push notification token, stored via Expo Notifications — used for run reminders and service notifications
• Recommendation events (impressions, profile views, friend-request events) — used to improve people recommendations, not for third-party advertising
• Device permissions (camera, photo library, notifications) — used for QR check-in, image uploads, and alerts
• Location (optional) — only if you grant permission when prompted — used to find nearby clubs; we do not collect background location

Information from others

• Other users may see your public profile information according to your privacy settings.
• Club organizers see RSVP and attendance information for their sessions.

4. Legal Bases for Processing (GDPR / POPIA)

• Account creation and authentication — performance of contract
• Running clubs, RSVPs, feeds, friends — performance of contract
• Push notifications (service-related) — consent (OS permission + in-app preference where offered)
• Recommendation improvement events — legitimate interest (you may opt out in Settings where available)
• Security, fraud prevention, legal compliance — legitimate interest / legal obligation
• Marketing communications (if ever sent) — consent

5. How We Use Your Information

We use personal information to:

• Provide and maintain Sesh
• Authenticate users and manage accounts
• Enable social features (friends, feeds, clubs, RSVPs)
• Send transactional and service notifications
• Improve discovery and recommendations
• Enforce our Terms, including content moderation
• Comply with law and respond to valid requests

What we don’t do

We do not use your data for cross-context behavioral advertising or sell personal information.

6. How We Share Information

Service providers (processors):

• Supabase Inc. — authentication, PostgreSQL database, file storage, realtime — receives account and app data listed above
• Expo / EAS (push infrastructure) — push notification delivery — receives push tokens and notification payloads

Other users

Depending on your privacy settings, other Sesh users may see your profile, club memberships, upcoming runs, run history, and public posts.

Legal and safety

We may disclose information if required by law, to protect rights and safety, or to respond to valid legal process.

Business transfers

If we merge, are acquired, or sell assets, your information may transfer subject to this Privacy Policy.

7. International Data Transfers

Supabase may process data in regions including the European Union (Ireland) and the United States. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses and processor data processing agreements.

8. Data Retention

• Active account data — retained while your account is active
• Deleted account — personal data deleted or anonymized within 30 days of a confirmed deletion request, except where law requires longer retention
• Anonymized attendance aggregates — may be retained without personal identifiers for club statistics
• Support correspondence — retained up to 24 months unless longer retention is required

9. Your Rights

All users:

• Access — request a copy of your personal data
• Correction — update profile information in the App or contact us
• Deletion — delete your account in Settings
• Withdraw consent — where processing is consent-based (e.g. optional notifications)
• Complaint — contact us or your local data protection authority

GDPR (EEA/UK)

You may also request restriction, portability, or object to legitimate-interest processing. We respond within 30 days.

POPIA (South Africa)

You may request confirmation of processing, correction, deletion, and object to processing. Contact us using the details in Section 15.

CCPA/CPRA (California)

California residents have the right to know, delete, correct, and opt out of sale/sharing. We do not sell or share personal information for cross-context behavioral advertising.

We do not discriminate against you for exercising your rights.

Categories collected in the last 12 months: identifiers (email, user ID, username); customer records (name, profile); internet/electronic activity (in-app events); audio/visual (photos you upload); geolocation (precise, only if you grant permission).

10. Account Deletion

In the App: Settings → Delete profile.

By email: use the contact details in Section 15.

Deletion removes or anonymizes your profile, friendships, push tokens, and linked personal records. Content you posted may be deleted or anonymized. Some data may be retained where required by law.

11. Children’s Privacy

Sesh is for users 18 and older. We do not knowingly collect data from anyone under 18. If we learn we have collected such data, we will delete it. Contact us if you believe a minor has registered.

12. Security

We use industry-standard measures including:

• HTTPS/TLS for data in transit
• Password hashing via Supabase Auth
• Row Level Security (RLS) in our database
• Access controls on cloud infrastructure

No method is 100% secure

Report security concerns using the contact details in Section 15.

13. Third-Party Links

The App may link to external sites (e.g. club websites). Their privacy practices are not covered by this policy.

14. Changes to This Policy

We may update this Privacy Policy. Material changes will be notified via the App, email, or push notification, and you may be asked to re-accept before continuing to use the App. The “Last updated” date will change. Continued use after the effective date constitutes acceptance where permitted by law.

15. Contact Us

Linkage Software Solutions (Pty) Ltd

Privacy: privacy@linkagesoftwaresolutions.co.za

Support: software@linkagesoftwaresolutions.co.za

Address: Cape Town, South Africa

South African Information Regulator: inforegulator.org.za

EU supervisory authorities: edpb.europa.eu/about-edpb/about-edpb/members_en