Privacy Policy — Blue Route

Effective date: August 12, 2026

This Privacy Policy describes how Blue Route ("we", "our", "us") collects, uses, and shares information when you use our mobile application and related services. "Blue Route" is a walking and fitness course app that students use to track walks, progress through a journey, and complete class assignments.

By using Blue Route, you agree to the collection and use of information as described in this policy. If you do not agree, please do not use the app.

1. Information we collect

1.1 Information you provide, or that your school/instructor provides

• Account and identity information: Your name and email address (provided through Canvas or Google sign-in), plus an internal user ID we assign.
• Course information: Your cohort/class membership and instructor-assigned access code.
• Waiver: A liability waiver signature (image) when your cohort requires it.
• Profile content: Avatar configuration and any profile photo you choose to add.
• Walk check-ins: Photos you attach to walks, plus any moods, intentions, or tags you record.

1.2 Information we collect automatically

• Location data: While you are actively recording a walk, we collect precise GPS location to measure distance, pace, and elevation. Location tracking is only active during a walk session you start. We also collect coarse location for map rendering and route display.
• Motion/fitness data: Step and distance estimates derived from device motion sensors (indoor pedometer mode).
• Walk activity records: Distance, pace, elevation, elapsed time, and any music/podcast play log you record during a walk.
• Notification tokens: If you enable notifications, a push notification token (a device identifier) used to deliver reminders.
• Canvas assignment data: If you are enrolled in a Canvas-linked cohort, we sync course modules, assignments, quizzes, and your submission status from your institution's learning management system.

1.3 Third-party partner data

The app integrates third-party services, each of which may process limited data as described below and in Section 4.

2. How we use your information

We use the information we collect to:

• Provide and operate the app: track walks, compute distance/pace/credit, and show journey progress.
• Manage your account, authentication, and cohort membership.
• Deliver class assignments, quizzes, and instructor-facing progress.
• Send notifications you have opted into (walk reminders, assignment reminders, module transitions).
• Store and display your profile, avatar, and walk history.
• Respond to support requests and enforce our terms.

We do not use your data for advertising, and we do not sell your personal information.

3. Legal bases and your rights

If you are located in the European Economic Area (EEA), the UK, or Switzerland, we rely on the following legal bases: performance of a contract (providing the course service), your consent (e.g., precise location during walks, notifications, photos), and our legitimate interests (service security and improvement). You may withdraw consent at any time without affecting prior processing.

Subject to applicable law, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your data and account.
• Restrict or object to processing in certain circumstances.
• Data portability where applicable.

To exercise these rights, contact us at the address in Section 9. We will respond within the timeframe required by law (typically 30 days).

4. Third-party services

The following third-party services process data on our behalf or as part of the app:

These services have their own privacy policies, and we encourage you to review them.

5. Data retention

We retain personal data only as long as needed for the purposes described in this policy, or as required by law. Specifically:

• Walk records and journey progress: retained for the duration of your account and as needed by your institution to award course credit.
• Account data (name, email, waiver): retained while your account is active, and as long as your institution requires records.
• Photos: retained while the related walk or profile exists, or until you request deletion.
• Push tokens: retained until you disable notifications, the token becomes invalid, or you delete your account.
• Backups and logs: retained per Supabase and hosting retention policies.

6. How to delete your data

You can request complete deletion of your account and all associated data at any time. Deletion removes your profile, walk records, photos, submissions, quiz attempts, and notification data, and permanently closes your account.

• In-app: Open the app → Profile tab → scroll to the bottom → Delete account. You'll be asked to confirm; deletion is permanent and cannot be undone. The app then clears locally stored data on your device.
• Web request: If you cannot use the in-app option, you can request deletion by visiting our Account Deletion page or by emailing us at the address in Section 9. We will process your request promptly and confirm to you.
• Canvas-linked cohorts: Deletion of data may require coordination with your institution because course records may belong to the institution.

When you request deletion, we will process it promptly and confirm to you.

7. Children's privacy

Blue Route is a class course app primarily used by college/university students and is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us personal information, contact us and we will delete it.

If your institution uses Blue Route with minors, the institution is responsible for obtaining any required parental consent.

8. Data security

We use industry-standard safeguards, including:

• Authentication via OAuth (Canvas, Google) and Supabase's managed auth.
• Row-level security on our database to scope data access.
• Encrypted data in transit (HTTPS).
• Minimal collection: we do not run analytics or crash-reporting SDKs.

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Contact us

Questions, requests, or concerns about this policy or your data:

We will respond to privacy inquiries within 30 days. If you are in the EEA/UK and believe your data-protection rights have not been respected, you may also lodge a complaint with your local supervisory authority.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Effective date" above and, where changes are material, notify you in the app. Your continued use of Blue Route after changes take effect constitutes acceptance of the updated policy.