Privacy Policy — Prove or Pay
Version 6 · in force from the day it is published
The same caveat as the Terms: this is not legal advice. It is a truthful description of what the app actually stores — written from the database rather than from imagination — so a lawyer can read it and fill in the retention periods and the formalities.
What we hold about you
Account. Email, username, display name, date of birth, country, time zone. The date of birth because your age decides whether you may play for money.
Proofs. The photos and videos you film in the app. They sit in private storage, not at a public address.
What the server read out of the file. Camera make and model, capture time and time zone, editing software. We read it from the bytes, not from what the app claims — and that is exactly why we read it: a proof that carries its own evidence is the only kind that can be trusted.
Device fingerprint. Your phone's identifier, salted and hashed on arrival. The raw value is never stored and cannot be recovered from what is. It answers one question: is this the same phone as that one? — and it exists for the one kind of cheating that takes money straight out of an honest player's pocket: one person with four accounts in a single league.
Running route. For running challenges the whole GPS track is uploaded so the server can measure it itself. A distance reported by a phone is a claim; replaying the track is a fact.
Identity document. Only if your deposits total over €500. A person looks at it and the reference is deleted the moment the decision is made.
Wallet and transactions. Balance, deposits, winnings. The accounting record is immutable — that is a requirement that comes with money, not a choice of ours.
What we do not hold about you
- No biometrics. We do not recognise faces and do not compare them against anything.
- No advertising identifier, nothing that follows you between apps.
- No location outside a running challenge that you started yourself.
- Nothing from your Strava or Health unless you connect it yourself.
Who sees it
| who | |
|---|---|
| Your proof | you; other players only after the window closes; a reviewer only while deciding on it |
| Your document | one reviewer, through a link valid for 60 seconds |
| Your wallet | only you |
| Your route | you, and the server measuring it |
A reviewer has no standing access to proof storage. Permission covers exactly the one proof awaiting their decision, and it ends the moment they decide.
Why we process it
Performance of a contract (so the game works), legitimate interest (so it cannot be cheated — without which a contest for money is pointless), and legal obligation for age verification and accounting.
For how long
- Identity document — until the decision, then the reference is deleted.
- Proofs — while a league runs, and afterwards for as long as a decision can be appealed.
- Accounting records — as the law requires.
- Account — until you close it.
Concrete periods belong in the GDPR documentation and will be added by a lawyer.
Your rights
Access, rectification, erasure, portability, objection. Closing your account deletes your profile and your proofs; the accounting record of money movement remains, because we are required to keep it and because changing it is forbidden to us as well. What remains carries no identity: the amounts and dates survive, the person does not.
How to reach us
[email protected]. Any of the rights above is exercised at that address, and you do not have to give a reason.
Why this document is in English
The app is played worldwide and is written in English, so the documents are too. A player who cannot read what they are agreeing to has not agreed to it.
This does not change which law applies — see the Terms, §12 and the note at the end of them. It changes only whether the text can be understood, which is a precondition for everything else, not a substitute for it. If Slovakia is the market that gets chosen, a Slovak translation will be needed alongside this one and kept in step with it.
What is still missing here
- Identification of the operator — trading name, company number, registered address. The contact is here already (above); the rest does not exist without a registered company.
- The list of processors (Supabase, Expo, Stripe, Anthropic) and where their servers are.
- Concrete retention periods.
- Information about transfers outside the EU, if any occur.
Without identification of the operator this document is not valid. It will be added before the first euro.
Publicly this text is at proveorpay.com/privacy and the Terms at proveorpay.com/terms — the same version that is in the app, because both pages are generated from the same file.
Questions: [email protected]