Ocupy Privacy Policy
Last updated: 22 August 2026
Ocupy is a location-based fitness game in which you claim real-world territory by running and walking. This policy explains what data is collected when you use the Ocupy mobile app and ocupy.melberlabs.com, why it is collected, who it is shared with, and the rights you have over it. The data controller is Ocupy, the developer of the app; you can reach us at ocupyapp@gmail.com.
1. What we collect
| Data | When and why |
|---|---|
| Account details — email, username, password | When you create an account. Your password is never stored in plain text; it is protected with a modern hashing algorithm (argon2). |
| Social sign-in identity — Google/Apple account identifier and email | If you choose "Continue with Google" or "Continue with Apple". We receive only what is needed to verify your identity; we do not access your contacts, files or any other data. |
| Location data — GPS coordinates, speed, altitude | Only while you have a run/walk recording in progress. Your route is sent to our servers to calculate the territory you claim, and is kept in your activity history. |
| Activity data — distance, duration, pace, area gained | For every activity you save — this is the core of the game (territories, levels, leaderboards). |
| Photos | Only if you attach photos you have chosen yourself to an activity. EXIF location data is stripped from photos on the server. |
| Club and social content — club name/photo, chat messages, likes and comments | When you use those features. |
We do not collect an advertising identifier, we use no third-party advertising or analytics SDKs, and we do not sell your data.
2. Background location — explicit notice
Ocupy collects your location while the screen is off only during an active run/walk recording. The sole purpose is to record your route without gaps when you put the phone in your pocket. While recording, you always see this in a persistent notification. Background location access stops when you finish the recording or leave the app. You are not required to grant background permission; without it, recording continues only while the screen is on.
3. How we use the data
- Running the game: calculating territory from your route, capturing and defending territory, levels/XP, challenges.
- Social features: leaderboards, activity feed, clubs, private games.
- Notifications: for example when your territory is taken (can be turned off in preferences).
- Security: detecting cheating (e.g. mock GPS), protecting your account, preventing abuse of the service.
4. What other players can see
Ocupy is a social game. The following are visible to other players: your username, your level, your character, the territories you have claimed (on the map), your leaderboard position, and the activities you share. You can choose not to share an activity to the feed. We recommend not starting a recording at sensitive places such as your home or workplace: your route data defines your territory boundaries, and territories appear on a public map.
5. Who we share data with
- OpenFreeMap — map tiles come from here (the data comes from OpenStreetMap contributors); in the process your IP address and the map area you are viewing are sent to OpenFreeMap. The map itself is drawn inside the app.
- Mapbox — for three operations only, and only for the relevant locations: snapping the points you draw when planning a route onto roads, matching a finished run's GPS trace to the road network, and finding the place name shown on a share card. Map imagery does not come from Mapbox (Mapbox privacy policy).
- Google / Apple — only if you sign in with a social account, for authentication.
- Hosting — our data is stored on our servers at Amazon Web Services (Frankfurt, EU region).
Apart from these, your data is not shared with third parties; disclosure to authorities may occur only where legally required.
6. Retention and account deletion
Your data is kept for as long as your account is open. To delete your account:
- In the app: Me → Settings → Delete account, or
- By email: write "account deletion request" to ocupyapp@gmail.com from your registered email address.
On a deletion request your account, activities, routes, photos and territories are permanently deleted; this is completed within 30 days at the latest. Copies held in backups disappear within the normal backup cycle (90 days at the latest).
7. Your rights
Under Article 11 of Turkish Law No. 6698 (KVKK) and, if you are in the EU, under the GDPR, you have the right to access, correct and delete your data, to object to its processing, and to request its portability. To exercise these rights simply write to ocupyapp@gmail.com; we respond within 30 days at the latest.
8. Children's privacy
Ocupy is intended for users aged 13 and over. We delete the accounts and data of users we learn to be under 13.
9. Changes
If we update this policy we will publish the new version on this page and notify you in the app for significant changes. The date at the top of this page always indicates the version currently in force.
Contact
For questions: ocupyapp@gmail.com