Privacy Policy

Effective date: 21 September 2026

Version: legal-v1.1.3

This Policy explains how CREWA processes personal data when you use the CREWA mobile application, crewa.run, related pages and support channels (together, the Service).

1. Controller and contact details

The data controller is CREWA Limited Liability Partnership (CREWA LLP), BIN 260840013815, legal and postal address: 1 Kunaev Street, Medeu District, Almaty 050016, Republic of Kazakhstan.

Email: support@crewa.run. Phone: +7 778 391-21-62.

2. Data we collect

Depending on the features you use, we may process:

account and identity data, including email, name, authentication identifiers, credentials in protected form and account-security records;
profile and social data, including avatar, biography, city, public code, connections, clubs, posts, comments and visibility settings;
running and fitness data, including time, distance, pace, route and GPS points, elevation, cadence, heart rate, calories and statistics from your device or a connected service;
location data while a relevant permission is enabled, including precise location needed to record a route;
device and technical data, including IP address, device and app identifiers, operating system, locale, time zone, logs and diagnostics;
subscription data, including plan, entitlement, purchase status and store receipt identifiers. Apple and Google process payment credentials; CREWA does not receive full bank-card details;
communications, support requests, reports and preferences; and
website analytics, referral and security signals, including pages viewed, referrer, campaign parameters and abuse indicators.

We receive data from you, your device, Apple or Google, services you choose to connect, other users where social features apply, and service providers acting on our behalf.

3. Why and on what basis we process data

We process data to create and secure accounts; record and validate runs; calculate personal and city progress; operate profiles and social features; activate subscriptions; provide support and notices; diagnose errors; prevent fraud, manipulation and abuse; improve the Service; and comply with law.

The legal basis may be performance of our contract, your consent, our legitimate interests in operating and protecting the Service, or compliance with a legal obligation. Where law requires consent—particularly for precise location, health-related information or optional communications—you may withdraw it through device settings, the Service or by contacting us. Withdrawal does not affect prior lawful processing.

4. Routes, health data and public features

Running routes and fitness metrics can reveal sensitive information. Check visibility and privacy-zone settings before publishing. Do not record or publish another person's sensitive location without permission. A profile or activity is public only to the extent selected by you or clearly indicated in the Service; backend privacy controls are applied before public data is returned.

User content and visibility

User Content may contain personal data, including profile photographs, names, text and information you choose to share about an activity. We process this information to store and display the content to its intended audience, provide social features, address rights complaints and protect the Service. The applicable processing grounds are described in section 3; the content licence in our Terms of Use is not a substitute for consent where consent is required.

The audience depends on the feature and the visibility settings shown to you. Before sharing, review which profile details, photographs, activity information and route details will be visible. Publicly accessible information may be copied by others. Do not disclose another person's private information without the necessary permission. Permissions to record location or obtain health information do not, by themselves, authorize public sharing of that information.

Service providers involved in storing, delivering and protecting User Content are described in section 5. Retention, deletion and your rights are described in sections 7 and 8. You may use the available privacy and deletion controls or contact support@crewa.run. Intellectual-property permissions and reports about infringement are addressed in section 5 of our Terms of Use.

We disclose only data reasonably needed to:

hosting, storage, communications, mapping, security, diagnostics, analytics and customer-support providers;
Apple and Google for purchases, subscription management and platform functionality;
connected fitness or identity services you authorize;
professional advisers, authorities or courts where required by law or necessary to protect rights and safety; and
a successor in a merger, financing, reorganization or sale, subject to appropriate confidentiality and notice requirements.

We do not sell personal data for money. Providers must process data under our instructions or their own published terms where they act as independent controllers.

Workout weather

To show approximate workout weather, CREWA uses MET Norway forecasts and Apple WeatherKit for missing historical data. Requests contain the coordinates of the workout city’s center; Apple requests also include a time range for the workout date. CREWA selects three approximate samples for morning, afternoon and evening. Requests are made by the CREWA server and do not include your name, email, account or workout identifier, full route, or fitness metrics. Provider information: MET Norway and Apple WeatherKit.

Weather data is optional and may be unavailable. MET Norway forecasts are saved in a shared city-and-date archive under CC BY 4.0 and linked to workouts. Linked weather remains for the lifetime of the workouts; unused records are deleted after 180 days. Saved forecasts are approximate estimates, not measurements taken during the workout. Apple results remain in a temporary cache for no more than one hour and no longer than the provider’s validity period, and are not added to the permanent archive. Technical request counters do not contain weather results or user coordinates. Permissions and applicable processing grounds described elsewhere in this Policy continue to apply.

6. International transfers

The Service and its providers may process data outside your country. We use contractual, organizational and technical safeguards required by applicable law and obtain consent for cross-border transfers where that is the required basis. You may contact us for information about applicable safeguards.

7. Retention

We retain account data while your account is active and afterwards only as needed for legal obligations, transaction records, disputes, security and fraud prevention. Activities and user content remain until deleted, anonymized or no longer needed for the stated purposes. Support and diagnostic records are retained for a period proportionate to the request or incident; backups are overwritten on a controlled cycle. Store transaction records may be retained by Apple or Google under their policies.

8. Your rights

Subject to applicable law, you may request access, a copy, correction, deletion, restriction, portability, or object to processing; withdraw consent; and complain to the competent data-protection authority. You may also ask for human review of an automated integrity or fraud decision. CREWA does not use automated processing to make decisions producing legal or similarly significant effects without appropriate safeguards.

Send a request from the email associated with your account to support@crewa.run. We may verify your identity. We will respond within the period required by applicable law. If consent is withdrawn under Kazakhstan law, processing based on that consent will be stopped within the statutory period unless another legal ground requires continued processing.

9. Cookies and analytics

Crewa.run uses necessary browser storage and Google Analytics. Details and available controls are described in the Cookie Policy. We do not intentionally send form contents, precise running routes or health metrics to website analytics.

10. Security

We use access controls, encryption where appropriate, logging, backups, staff and provider restrictions, and incident-response measures designed to protect data. No online service can guarantee absolute security. Contact us promptly if you believe your account or data has been compromised.

11. Children and minors

CREWA is not directed to children under the age of 13. A person under 13 may not create an account or use the Service, even with permission from a parent or legal guardian.

We do not knowingly collect personal data from children under 13. If we learn that a child under 13 has provided personal data or created an account, we will take reasonable steps to restrict the account and delete the personal data and associated account, subject to appropriate verification and any limited retention required by applicable law, security obligations or the controlled backup cycle.

Users aged 13 to 17 may use CREWA subject to applicable law. Where consent is the applicable legal basis for a particular processing activity and applicable law requires authorization by a parent or legal guardian, that authorization must be obtained before the relevant processing begins. We may take reasonable and proportionate steps to verify age and authorization where required by law.

If you are a parent or legal guardian and believe that a child under 13 has provided personal data to CREWA, contact us at support@crewa.run. To protect users, we may request information reasonably necessary to identify the account and verify your identity and authority. Please do not send passwords, payment details, copies of identity documents or other unnecessary sensitive information unless we specifically request them through a secure channel.

12. Changes

We may update this Policy to reflect legal, technical or product changes. We will publish the updated date and, where required, provide additional notice or request renewed consent.

13. Contact

Privacy questions and requests: support@crewa.run or +7 778 391-21-62. Postal correspondence may be sent to the address in section 1.