Privacy Policy for Distance Goal

Distance Goal is published by Bluetorch Consulting Ltd, a company registered in England and Wales (Companies House number 14663890). This privacy policy explains how the Distance Goal app for Android handles your information.

If you have any questions about this policy, you can contact us at support@bluetorch.co.uk.

Distance Goal is a simple distance goal tracker. You create a goal with a target distance and deadline, then manually add distance entries for activities such as walking, cycling or running. The app shows your progress towards the goal.

Distance Goal does not require you to create an account. The app is designed for manual distance goal tracking.

The app may store the following information locally on your device:

• Goal name
• Target distance
• Start and end dates
• Manually entered distance entries
• Activity type, such as walking, cycling, running, or other
• Optional notes entered by you
• If you use the optional Health Connect feature: the activity labels you set by hand on auto-tracked distance (a time period and the activity you chose), and the names of any Health Connect source apps you excluded

This information is stored locally on your device. Bluetorch Consulting Ltd never receives your goals, your individual distance entries or your notes, and never sells or shares any of your information with anyone.

If you choose to use buddy groups, a small number of figures are sent to our relay in encrypted form — see Buddy groups below for the exact list. Even then, we cannot read them.

Distance Goal does not:

• Require an account — there is no sign-up, no login, no username and no profile, including for buddy groups
• Collect your name, email address or other personal details
• Collect GPS or location data
• Track your routes or movements
• Use analytics or advertising services
• Send push notifications from a server, or use any push or messaging service
• Include any third-party tracking SDKs
• Sell, rent or share your information with anyone
• Send anything at all to a server unless you choose to join a buddy group — until then the app makes no network connections

Everything you enter into Distance Goal is stored locally on your device. Your goals, your individual distance entries, your notes, your badges and your history are not uploaded, synchronised or backed up to any service operated by Bluetorch Consulting Ltd.

The one exception is buddy groups, described below. If you choose to use them, a short list of figures — a name the app picks for you, your distance and target, and optionally a streak and a last-active date — is sent to our relay, encrypted on your device first so that the relay cannot read it. Nothing else in the list above is ever sent anywhere.

Because your data lives only on your device, deleting the app or clearing its app data may permanently delete your goals and distance entries. Your device or Google account settings may include general device backup features (such as Android backups) that are controlled by you and Google, not by Bluetorch Consulting Ltd.

Distance Goal never collects GPS location data and never tracks your route. It has no direct integration with Google Fit, Apple Health, Fitbit, Strava, or similar platforms, and it reads nothing from any health or fitness service unless you switch on the optional Health Connect feature described below.

Optional Health Connect auto-tracking (Android). You can choose to turn on auto-tracking in the app's settings. If you do, Distance Goal reads your distance and the activity type of the workouts you tracked — and nothing else — from Google Health Connect, so your goals can update themselves from distance your phone, or a connected watch or fitness app, has already recorded.

• Off by default — nothing is read until you turn the setting on and grant permission in Health Connect.
• Two read-only permissions, and no more. The app never writes anything to Health Connect.
• Read distance — for each distance reading: how far it was, when it started and ended, which app recorded it, and whether that app recorded it automatically in the background or from an activity you started.
• Read exercise — used only to work out whether a stretch of distance was a walk, a ride or a run. Health Connect's distance records don't say, so without it the app can't tell your cycling from your walking, and a cycling goal would count both. From a workout the app reads exactly four things: its start time, end time, activity type, and which app recorded it. It does not read your route or GPS trace, your heart rate, laps, splits or calories, or the workout's title or notes.
• Knowing which app recorded something is what lets the app show you what your total is made of, let you exclude a source you don't trust, and tell two apps apart when they both recorded the same walk. The app cannot see steps, sleep, weight or anything else, and never asks for them.
• What period is read — only the span your auto-tracking goals cover: from the start of the earliest to the end of the latest, plus a few hours either side so a workout running past midnight can still be identified. If two of your goals have a gap between them, that gap falls inside the span and is read too.
• On your device only — everything read is used only to work out your goal progress. It is never sent anywhere and never shared.
• No individual reading is kept. Health Connect's own records — each distance reading and each workout — are never copied into the app's storage. They are re-read from Health Connect every time, and disappear from the app the moment you turn auto-tracking off.
• One figure per day is kept, and here is why. So that a badge you have earned can never be taken away by a source app deleting its history, the app banks a single number for each calendar day: the furthest it has ever seen you go that day. Where you use auto-tracking, that number can include distance that came from Health Connect. It is a total for a day — never a workout, a route, a time of day, or which app recorded it.
• Activity labels you set are saved on your device. Many apps record distance without recording a workout, so the app can't always tell what an activity was — you can label those yourself. That label (the exact time period of the distance you were labelling, taken from Health Connect, plus the activity you picked) is saved on your device like any other setting and can be erased at any time with Settings → Reset activity labels.
• Your source choices are a local setting — if you exclude a source, or turn on “ignore automatic distance”, that preference (including the app id of any excluded source, for example com.sec.android.app.shealth) is saved on your device like any other setting.
• Reversible at any time — turn auto-tracking off in the app (reading stops immediately), or revoke either permission in the Health Connect app. Refusing the exercise permission is fine: the app simply can't tell your activities apart, and counts all auto-tracked distance toward every auto-tracking goal.

Auto-tracking supplements manual logging; it never replaces it.

We never receive any of it. Nothing read from Health Connect is sent to us, sold, or used for advertising, and it is never given to anyone else without your say-so.

Sharing with a buddy group is per app, and off until you say yes. If you are in a buddy group, the app asks you — separately for each app that records distance, naming it — whether that app's distance should count toward what your group sees. Until you say yes it does not, and an app you have never been asked about is never shared. You can change any of these answers at any time in History.

What is shared is a distance total only: never a workout, an activity type, a route, a time of day, or which app recorded it. If you are in no groups, none of this applies and nothing is shared at all.

The one way any of it can leave your phone is if you export it yourself: a backup file includes your activity labels and source choices, and the day-by-day totals include days that auto-tracked distance contributed to. See Exporting and sharing your data below.

You can choose to share your progress with a small group of people, so you can see how each other are getting on. This is the only part of Distance Goal that uses a server, and it is off until you use it.

• Off by default — no network connection of any kind is made until you create or join a group. Delete your last group and the connections stop again.
• No account and no directory — there is no sign-up, no email address, no username, no phone number and no access to your contacts. The only way anyone can join a group is with a code you send them yourself. Nobody can find, search for, or add you.
• Exactly what is published, and nothing else: a name picked for you by the app from a fixed list (you never type it), the distance you have logged toward one goal you choose, that goal's target distance, and — only while you leave the two switches on — your current streak and the date you were last active. That is the entire list.
• Which distance is published — everything you logged by hand, plus, only if you agreed to it, the distance recorded by apps you were asked about individually and said yes to. Nothing from an app you have not agreed to share is ever published, and that is the default for every app. Only a total is published: never a workout, an activity type, a route, a time of day, or which app recorded it.
• Never published: your individual entries and notes, your other goals and their names or dates, your badges, activity types, your day-by-day record, your units, your reminder or Health Connect settings, your real name, your email, your contacts, or your location.
• It is locked before it leaves your phone — your progress is encrypted on your device (XChaCha20-Poly1305) with a key derived from the group's code. That key exists only on the phones of people you gave the code to. It is never sent to the server, so the server stores figures it has no way to read, and neither do we.
• Your identifiers are random — the group and member identifiers are random numbers generated on your phone, tied to nothing about you or your device. The same person in two groups gets two identifiers that cannot be connected to each other.
• Nobody can type anything at you — there is no chat, no messages, no comments, no reactions, no photos and no free text of any kind. Names come from a fixed list the app chooses from, so nobody can put an offensive word in one. You can also rename or hide anyone privately on your own phone.
• Anyone with the code is in — the invite code is like a key, and anyone it ever reaches can keep seeing that group's updates. There is no way to remove someone else. If a code goes somewhere you did not intend, start a fresh group. Only send a code to people you know.
• Leaving and deletion — leave a group at any time from the group's screen, and your entry is deleted from the server immediately. If nobody in a group opens the app for 60 days, the whole group is deleted automatically.
• Group codes are never exported — a backup file you export deliberately leaves out your group keys, so a backup can never hand someone access to your groups.

The server, described honestly. The relay is operated by Bluetorch Consulting Ltd on Cloudflare and does one thing: hold a scrambled blob for each member and hand it back to the other members of that group. It cannot read your name, distance, target, streak or last-active date.

It can see, as any web server can: a random group identifier, a random member identifier, how big each update is, when updates happen, and the IP address your phone connects from. We do not log IP addresses or build any profile from them, but we will not pretend the connection is invisible — anyone operating a server can see that much, and you should know it.

You can optionally turn on reminders in the app's settings. When enabled, Distance Goal can show a notification if you haven't logged any distance for a day.

• Off by default — no notification is scheduled until you turn reminders on and grant the notification permission.
• On your device only — reminders are scheduled locally by your phone's operating system. There is no server, no push service and no account, and nothing about your reminders ever leaves your device.
• Reversible any time — turn reminders off in the app, or turn off notifications for Distance Goal in your phone's settings.

Distance Goal can hand you a copy of everything you've logged — as a spreadsheet, a document, a note, or a backup file you can restore later. It can also make a progress card: a square image of one goal's progress ring that you can post or send to someone. These are the only ways data leaves the app, neither ever happens on its own, and each only goes where you send it.

• You start it, every time — nothing is exported unless you choose a format on the Export your data screen, and no image is made unless you tap Share progress on a goal and then Share this card. There is no automatic, scheduled or background export.
• The app does not upload your export — it writes the file, or draws the image, into temporary storage on your phone and passes it to your phone's own share sheet. Exporting involves no server of ours whatsoever.
• Where it ends up is your choice — you pick the destination from the share sheet. Once a copy is in another app, that copy is governed by that app's privacy policy, not this one.
• What an export can contain — depending on the format: your goals, your logged entries and their notes, the badges you've earned, and the app's day-by-day record of how far you went (which includes distance from Health Connect, if you use auto-tracking). A backup file also contains your activity labels and excluded-source choices.
• What a progress card contains, exactly — the goal's name, its start and end dates, the percentage complete, the distance logged against the target, and, if the goal came from one of the built-in challenges, the name of that route and the point along it you have reached. That is the whole list. A card never contains an individual entry, a note, a date you exercised, a badge, or anything read from Health Connect.
• You see it before it goes — the card is drawn on your phone and shown to you first, so you always know exactly what you are sending.
• Temporary files are cleaned up — each export leaves a single file in the app's own cache area, and each progress card a single image in a separate one. Both are replaced by the next of their kind and removable by your phone at any time.
• Restoring a backup only ever adds — it never overwrites or deletes what is already on your phone, and never changes your units, reminder or Health Connect settings.

Distance Goal does not use third-party analytics, advertising, crash reporting or tracking services, and does not share any information with third parties.

If you use buddy groups, the relay that carries your encrypted progress runs on Cloudflare, which hosts it for us. Cloudflare is our hosting provider, not a company we share your information with — and what passes through it is encrypted so that neither Cloudflare nor we can read it.

The app is distributed through Google Play. Google may collect information relating to your download and installation of the app under its own privacy policy, which is separate from this one.

Distance Goal is suitable for people aged 9 and over, and we have designed it so that a child using it is safe by default.

• There is no way for anyone to send a child anything — no chat, no messages, no comments, no reactions, no images, no links, no free text. The only thing that travels between people is a distance in kilometres and a name the app chose from a fixed list.
• There is no pornographic, violent, self-harm, suicide or eating-disorder content in the app, and no way for a user to introduce any, because there is no channel that could carry it. Our terms prohibit it outright.
• A child cannot be found or contacted — there is no account, no username, no profile, no search and no directory. The only way into a group is a code the child's own phone shares.
• No advertising, no analytics, no profiling and no nudge techniques. We do not build a profile of any user, child or adult, and there is nothing in the app designed to keep a child using it longer than they meant to.

Parents and guardians: the safest way to use buddy groups with a child is to keep the group to people you know, and to share the code yourself. Anyone the code reaches can see the group's progress, so treat it like a house key. If you want a child's group closed off, start a fresh group and do not share the old code.

If you believe a child's information has reached us in a way it should not have, contact us at support@bluetorch.co.uk and we will remove it.

You are always in full control of deleting your data. You can:

• Delete individual goals or distance entries within the app
• Leave a buddy group from the group's screen — your published figures are deleted from the relay immediately
• Clear the app's data from your device settings (Settings → Apps → Distance Goal → Storage → Clear data)
• Uninstall the app, which removes its locally stored data

If you have never used buddy groups, Bluetorch Consulting Ltd holds no copy of your data at all, so there is nothing further for us to delete on our side.

If you have used buddy groups, leaving each group deletes what was held for you. Anything left behind is deleted automatically 60 days after the last time anyone in that group opened the app. Because there is no account, we cannot look you up to delete on request — but you can always delete it yourself with the steps above, and it expires on its own regardless.

If future versions of Distance Goal add features that change how your information is handled — such as optional cloud sync — this privacy policy will be updated before those features are released, and the "Last updated" date above will be revised. We encourage you to review this page from time to time.

If you have questions about this privacy policy or about how Distance Goal handles your information, please contact: