Privacy Policy

Last updated: 18 July 2026

1. Who We Are

Valkara ("we", "us", "our") is operated by TechniSK s. r. o., a company registered in the Slovak Republic (Company ID: 55109357, Tax ID: 2121871059, VAT ID: SK2121871059), with registered office at Severná 1502/2, 974 01 Banská Bystrica. Contact: privacy@valkara.app

2. What Data We Collect

Account Data

• Email address (required for registration)
• Warrior name / username (chosen by you)
• Password (hashed — never stored in plain text)
• Account role (tester / user / admin)
• Early adopter status and registration date
• Referral source (if you registered via a referral link)

Health & Fitness Data

Collected only with your explicit permission, only on the mobile app:

• Steps, distance, floors climbed, heart rate, HRV, resting heart rate
• Sleep data (duration and quality)
• VO2 Max (if available from your device)
• Body weight, body fat percentage, lean/muscle mass and BMI (manual entry, smart scale or health app)
• Calories burned (calculated via MET formula using your weight)
• Age, gender and height (used to estimate your biological age and calorie figures)

Sourced from Apple HealthKit (iOS), Google Health Connect (Android), or manual entry within the app. All health and fitness data is processed and stored locally on your device, and is used only to calculate your biological age and in-app attributes. We do not upload your health or fitness data to our servers. If you use the optional social features, only your game stats (such as level and XP) may appear on leaderboards — never your raw health metrics.

Location Data

Collected only with your explicit permission, only on the mobile app, and only while you are actively recording an outdoor activity session. We use your device location to measure distance, route and pace during a training session. Location is not tracked in the background, is never used for advertising, and is not shared with third parties. You can revoke location access at any time in your device settings.

Profile Photo (optional)

If you choose to set a profile photo, the app accesses your camera or photo library with your permission. The photo is stored locally on your device and is not uploaded to our servers.

App Usage Data

• Quest completions and streaks
• XP, levels, and attribute progress
• Training session logs
• Achievement records
• Shadow program progress

Device Data

• Device type and OS version
• App version
• Push notification token (notifications only)
• IP address and basic technical logs (recorded by our authentication provider, Supabase, for security and abuse prevention)

Website Data

• Registration and login events
• Referral link usage
• Website analytics — see below

Website Analytics (cookieless)

We measure how the website is used so we can see where visitors get stuck. Neither method uses cookies, and neither identifies you or follows you across other websites. There are two:

Our own measurement. For each interaction we record only: the event (for example a page view, opening the registration form, or starting a download), the page path, the referring website's domain (not the full address), any campaign or affiliate code in the link you arrived through, and whether your screen is phone-, tablet- or desktop-sized. Interactions are grouped by a random identifier created in your browser tab, stored in sessionStorage, and deleted when you close that tab. It is not linked to your account, your email or your IP address.

Vercel Web Analytics. Our hosting provider also provides aggregated visitor statistics — page views, referrers, countries, browsers and devices. It is cookieless and stores nothing on your device; visitors are counted using a temporary identifier derived from request data that rotates daily and cannot be traced back to a person or linked across sites. We see only aggregate counts, never individual visitors. The same provider's Speed Insights feature measures anonymous page-performance timings (how fast pages load) to help us keep the site fast; it likewise sets no cookies and identifies no one.

If your browser sends a Do Not Track or Global Privacy Control signal, our own measurement records nothing at all.

Legal basis: legitimate interest in understanding and improving our own website (Art. 6(1)(f) GDPR). Because the data is not personal and nothing is stored on your device beyond the current tab, this does not require consent.

3. How We Use Your Data

We do not sell your data. We do not share it with advertisers.

4. Where Your Data Is Stored

• Account, authentication and public profile data (email, warrior name, level, XP): Supabase (AWS infrastructure, EU region)
• Optional social data (leaderboards, guilds, mentorships, community quests, feedback): Supabase — only if you choose to use those features
• Everything else — your character, quests, goals, tasks, attribute history, health and training data: stored locally on your device (SQLite), never uploaded to our servers
• Payments: when subscriptions are active, they are made as in-app purchases (IAP) through the Apple App Store and Google Play, which act as merchant of record — we never see or store your card details. Valkara is currently free during the testing period.

5. Data Retention

6. Your Rights (GDPR)

If you are in the EU/EEA or UK, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Erasure — delete your account and all associated data via our account deletion page
• Portability — receive your data in machine-readable format
• Object — opt out of processing based on legitimate interest
• Withdraw consent — at any time for consent-based processing

To exercise any right: privacy@valkara.app. We will respond within 30 days.

7. Health Data (Special Category)

Health and fitness data is a special category under GDPR. We process it only with your explicit consent and only to provide biological age and health tracking features. We do not share health data with third parties. You can revoke HealthKit or Health Connect access at any time in your device settings.

8. Affiliate and Referral Data

If you participate in the affiliate program or refer other users:

• We store your referral link identifier (your warrior name)
• We track successful referrals to calculate rewards and commissions
• Commission data is shared with our affiliate payment provider (TBD) for payout purposes only

9. Children

Valkara is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has registered, contact privacy@valkara.app immediately.

10. Third-Party Services

11. Push Notifications

We send push notifications only with your explicit permission. You can disable them at any time in your device settings. Notification tokens are not used for any other purpose.

Notifications are delivered through Expo's push service and, at the device level, Apple Push Notification service (APNs) on iOS or Google Firebase Cloud Messaging (FCM) on Android. A device push token is shared with these providers solely to deliver your notifications.

12. Security

• Encrypted connections (HTTPS/TLS) on all data in transit
• Supabase Row Level Security — users access only their own data
• Passwords hashed (bcrypt)
• No plain-text storage of sensitive data
• Regular security reviews

13. Changes to This Policy

We will notify you of material changes via email and in-app notification. The "Last updated" date at the top reflects the most recent revision. Continued use after notification constitutes acceptance.

14. Contact

Privacy questions: privacy@valkara.app
Account & data deletion: use our account deletion page — sign in and delete your account and data instantly, no request or waiting needed.

TechniSK s. r. o.
Company ID: 55109357 · Tax ID: 2121871059 · VAT ID: SK2121871059
Severná 1502/2, 974 01 Banská Bystrica
Slovak Republic