This policy explains what personal data the Tackle Cancer Challenge mobile application and its backend collect, why, and what control you have over it. It covers the app only. The The Oncidium Foundation FUP website has its own separate privacy policy.
1. Who is responsible for your data
The data controller for the app is:
The Oncidium Foundation FUPAvenue Herrmann-Debroux 40
1160 Brussels, Belgium
Enterprise number 0838.388.420
contact@oncidium-life.org
2. What the app collects
Everything below is data you provide or generate by using the app. The app does not track your location and does not read your contacts.
It carries no advertising trackers, and we do not measure how you use it. We use Firebase for sign-in and for notifications, but not Google Analytics for Firebase — we do not record which screens you open, what you tap, or how long you spend in the app. The only third-party tool of that kind is Sentry, which receives a report when the app crashes. Nothing is sent to it while the app is working normally.
| Data | What it is | Why we need it | Legal basis |
|---|---|---|---|
| Account | Email address and an account identifier issued by our authentication provider | To create your account and sign you in | Performance of a contract |
| Profile | First name, last name, profile picture, time zone, the team you belong to | To identify you to other participants and show times correctly | Performance of a contract |
| Preferences | Distance units, whether you log activity manually or from a fitness app, which fitness app you use, your preferred activity types | To adapt the app to how you use it | Performance of a contract |
| Physical activity | Activity type, steps, distance, duration, the date and time of the activity, and where the entry came from (manual entry, or the name of the source app and platform with its record identifier) | To count your contribution towards the challenge and its rankings | Performance of a contract when you enter it yourself. Your explicit consent when it is read from Apple Health or Health Connect — Article 9(2)(a) GDPR |
| Shared content | Photos and titles you post to the feed, your comments, and the posts you like | To run the feed feature | Performance of a contract |
| Notifications | A push token and device identifier per device you sign in on, plus the notifications sent to you and whether you have read them | To deliver notifications and avoid sending duplicates | Performance of a contract |
| Connection status | Whether you currently have the app open | To decide whether to show a notification in the app or send it as a push message | Legitimate interest in not sending you redundant notifications |
| Technical logs | Server logs of requests made to our backend | To keep the service running and secure | Legitimate interest in the security of the service |
| Crash reports | The error and its technical trace, the version of the app, the device model and the operating system version. Your name, your email address and your account identifier are not attached | To understand why the app crashed and fix it | Legitimate interest in an app that works |
| Session replays | A reconstruction of the screens that led to a crash — their layout and the taps you made, with all text and all images masked out. Recorded only when the app crashes, never during ordinary use | To reproduce the crash and fix it | Legitimate interest in an app that works |
Permissions the app asks for
The app requests only what a feature needs, at the moment you use it:
- Camera and photo library — only when you choose to take or pick a photo for the feed or for your profile picture.
- Notifications — to send you push messages. You can refuse and still use the app.
- Health data — optional, covered in the next section.
The app does not request access to your location or your contacts.
3. Activity data from fitness apps and health platforms
This is optional. You can use Tackle Cancer Challenge entirely with manual entry and never connect a health platform at all.
If you do choose to log activity automatically, the app reads activity records from your device's health platform — Apple Health on iOS, Health Connect on Android. This only happens after you grant permission. We ask for a deliberately narrow set of permissions — your steps, your distance, and your exercise sessions — and from those records we read the type of activity, the number of steps, the distance, the duration, when it took place, and the identifier the platform gives the record.
Activity read this way counts as health data, so we rely on your explicit consent for it rather than on the contract between us. You give that consent when you turn the feature on in the app and grant the permission on your device.
You can withdraw it at any time — turn the feature off in the app, or revoke the permission in your device settings. The app then goes back to manual entry, and you can carry on using it exactly as before. Withdrawing does not close your account, and it does not remove the distance you have already contributed to your team. It does not affect the lawfulness of what we did with the data beforehand.
We only read. We never write anything back to Apple Health or Health Connect, and we do not modify or delete anything they hold.
We do not read your route or your location. The app does not request location access, does not record where you went, and does not read GPS traces from your health platform, even when the platform holds them for a workout.
We want to be explicit about what we do with this data:
- It is used only to calculate your contribution to the challenge, your personal summary, and the rankings.
- It is never used for advertising, marketing, or profiling.
- It is never sold, rented, or shared with data brokers, advertising networks, or any third party for their own purposes.
- We read only the activity information listed above. We do not read medical records, clinical data, or any other health information your device may hold.
4. What other participants can see
Tackle Cancer Challenge is a shared challenge, so parts of your data are visible to other participants by design:
- Your name, profile picture, team and total distance appear in the individual and team rankings.
- Your name and team appear when you are the participant who crosses a sector of the challenge.
- Photos, titles and comments you post to the feed are visible to other participants, along with your name and profile picture.
About images. Your profile picture and any photo you post to the feed are stored so that they can be loaded directly by the app. Anyone who has the exact address of an image file can open it, including someone who is not signed in to Tackle Cancer Challenge. Please keep this in mind when choosing what to upload.
5. Automated checks on the activity you record
To keep the rankings fair, activity entries are checked automatically against plausibility limits for each activity type — a speed no runner sustains, a distance no single day allows. An entry that falls outside those limits is flagged, and we may then reject, correct or remove it, as the Terms of Use set out.
If we act on an entry of yours, you can ask us why, tell us we have it wrong, and ask us to look at it again — write to contact@oncidium-life.org.
Beyond these checks, we do not profile you.
6. Who else processes your data
We do not sell your personal data and we do not share it for anyone else's purposes. We do rely on three service providers, who process data strictly on our instructions:
- Google Ireland Limited — Firebase Authentication, which manages sign-in and holds your email address and account identifier, and Firebase Cloud Messaging, which delivers push notifications to your devices.
- Microsoft Ireland Operations Limited — Microsoft Azure, which hosts our servers, database and image storage.
- Functional Software, Inc., trading as Sentry — crash reporting, and the session replays attached to a crash. Sentry is a United States company, but what it receives from us is held in its European region; see the next section.
We may also disclose data where we are legally required to do so, for example in response to a valid order from a competent authority.
7. Where your data is stored
Our servers, database and image storage run in Microsoft Azure data centres in West Europe (the Netherlands). Crash reports and session replays are held in Sentry's European region, in Frankfurt, Germany. Some of our providers are established outside the European Economic Area, or may process data there; where that happens, the transfer is covered by the European Commission's standard contractual clauses.
8. How long we keep your data
We keep your account and the data attached to it for as long as your account exists. If you delete your account, we remove the data that identifies you and keep only anonymised activity totals, so that team results and past challenges remain accurate. Anonymised data can no longer be linked back to you. Read exactly what is deleted and what is kept.
Server logs are kept for 14 days for security and troubleshooting, then discarded. Crash reports and session replays are kept by Sentry for 90 days and then deleted automatically. Because they carry nothing that identifies you, deleting your account does not affect them.
9. Your rights
Under the General Data Protection Regulation you can ask us to:
- give you a copy of the personal data we hold about you;
- correct data that is wrong or incomplete — you can change your name and picture in the app at any time;
- delete your account and your personal data;
- withdraw a consent you have given us — the one covering activity read from a health platform — without that affecting what was lawful beforehand;
- restrict or object to how we use your data;
- send you your data in a portable, machine-readable format.
Write to contact@oncidium-life.org and we will respond within one month. We may ask you to confirm your identity first, so that nobody can make a request about your data on your behalf.
If you are not satisfied with our answer, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels — contact@apd-gba.be.
10. Children
Tackle Cancer Challenge is built for adults taking part in a team challenge and is not directed at children. We do not verify age, and we do not knowingly collect data from children. If you are a parent or guardian and believe your child has created an account, contact us and we will delete it.
11. Security
Connections between the app and our servers are encrypted. Access to our production systems is restricted to the people who need it. No system is perfectly secure, but we take reasonable measures to protect your data and will notify you and the supervisory authority if a breach is likely to affect your rights.
12. Changes to this policy
If we change how we handle your data, we will update this page and change the date at the top. Significant changes will be announced in the app.
13. Contact
Questions about this policy or about your data: contact@oncidium-life.org.