BhaagBhai

Privacy Policy

Last updated: 9 October 2026

BhaagBhai ("we", "our", or "us") is a social fitness accountability app that lets you set step and distance goals and run challenges with friends. This policy explains what data we collect, why we collect it, and how we protect it.

BhaagBhai involves no money at all. There is nothing to pay, nothing to win, and no payment feature of any kind. Challenges are for bragging rights among friends.

1. Data We Collect

Account information

Mobile phone number — used solely for OTP-based sign-in via Firebase Authentication.
Display name and profile photo — shown to other participants in your challenges.

Content you create

Challenge names and settings, and any message you send through the in-app feedback form.

Fitness data

Step count and distance (and, for your end-of-challenge summary, exercise sessions and active calories) — read from Health Connect on Android or Apple Health on iOS, only with your explicit permission.
On Android, with the background-access permission, we read these metrics periodically while the app is closed so your progress, reminders, and home-screen widget stay current. You can revoke this at any time.
This data is used only to measure your progress in challenges you join. It is never used for advertising and is never sold to third parties.

Device data

Push notification token (Firebase Cloud Messaging on Android, or Apple APNs on iOS) — used only to send you notifications about your challenges. Stored on our servers and never shared.

Usage data

Challenge activity (km logged per day, challenge results) — necessary to run the app's core features.

2. How We Use Your Data

Authenticate your account and keep it secure.
Display your progress and leaderboard position to challenge participants.
Calculate challenge results and standings.
Send push notifications about challenge events (starts, completions, reminders).
Generate personalised coach messages with an AI model (see section 4).

We do not use your data for advertising, profiling, or any purpose not listed above.

3. Health Connect & Apple Health

BhaagBhai reads fitness data (steps, distance, and — for the end-of-challenge summary — exercise and active calories) from Health Connect (Android) or Apple Health (iOS) only to measure your challenge progress. In line with Google's Health Connect requirements, this data is never used for advertising or marketing, is never sold or shared with data brokers, and is transmitted only to our own servers to compute and show your progress to the other participants in your challenge. It is deleted when you delete your account.

You can revoke access at any time — on Android in the Health Connect app (Permissions → BhaagBhai), or on iOS in Settings → Privacy & Security → Health → BhaagBhai. Revoking stops all further reads immediately; it does not delete your account.

4. Data Sharing

We share the minimum data required to operate the app:

Other challenge participants — your display name, profile photo and km progress are visible to people in the same challenge as you.
OpenAI and Google (Gemini API) — our AI coach — to write the short coach messages you see in the app and in notifications, we send one of these AI providers (whichever we have enabled) a summary of the challenge: the challenge name, the dish theme, and the display names, step or distance totals, ranks and team standings of its participants. We do not send phone numbers, profile photos or raw health records. The summary is used only to generate the message and is not used for advertising.
Anyone you share a result with — when you tap Share on a finished challenge, BhaagBhai creates a result image and a web link. They show your first name and your results and, unless you switch it off before sharing, the first names and totals of the friends in that challenge. Anyone who has the link can open it. The link contains no phone numbers or photos, is not listed in search engines, and stops working if you leave the challenge or delete your account.
Firebase (Google) — your phone number is sent to Firebase solely to verify OTP codes. See Firebase Privacy.
Push services — your device token is sent to Firebase Cloud Messaging (Android) or Apple APNs (iOS) to deliver notifications to your device.

We do not sell, rent, or trade your personal data to any third party.

5. Data Retention

Your data is retained for as long as your account is active. Challenge history (results, km records) is kept after a challenge ends so participants can look back on it.

Deleting your account. You can delete your account at any time from inside the app: Profile → Delete account. This takes effect immediately — we erase your name, profile photo, phone number, push tokens and the day-by-day fitness data we hold for you, and you are signed out on every device.

One thing survives, by necessity: the challenges you shared with other people keep their final results, because those belong to the other participants too. Your entries in them are stripped of your identity and appear only as “Deleted user”.

If you cannot reach the in-app option, email privacy@pacewolf.run and we will process the request within 30 days.

6. Security

All data is transmitted over HTTPS. Authentication tokens are stored in the platform's secure storage (Android Keystore / iOS Keychain). We use Railway's managed PostgreSQL with restricted network access for our database. We do not store OTP codes — they are verified and discarded by Firebase.

7. Children

BhaagBhai is not intended for users under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it promptly.

8. Your Rights

Access — you can view all your data in the app (profile, challenge history, stats).
Correction — you can update your display name in the app.
Deletion — delete your account and data yourself at any time from Profile → Delete account in the app (see section 5), or email privacy@pacewolf.run.
Portability — contact us to request a copy of your data in JSON format.

9. Changes to This Policy

We may update this policy as the app evolves. We will notify you of material changes via an in-app notice. The "Last updated" date at the top always reflects the current version.

10. Grievances & Contact

Questions, complaints, or requests about your data? Email privacy@pacewolf.run. We acknowledge every request within 2 working days and resolve it within 30 days. If you are not satisfied you may escalate to the Data Protection Board of India.

Withdrawing consent. You can stop any use of your data at any time: revoke Health access in Apple Health / Health Connect (progress tracking stops immediately), switch off notifications in your device settings, or delete your account in the app (Profile → Delete account).

Where your data lives. Our servers and database are run by our hosting provider (Railway); sign-in is handled by Firebase (Google); AI coach messages are generated by OpenAI or Google (see section 4). We keep your data only while your account exists; deleted accounts are anonymised immediately.