Masar
Privacy policy
Draft updated 9 November 2026
Draft. A solicitor has not reviewed this policy yet, and some details below are still to be confirmed.
1. Who we are
In short: we run Masar, we decide how your data is used, and you can contact us any time.
Masar is run by Omnia Hamad, trading as Masar, from the United Kingdom. We are the controller of your personal data, which means we decide how and why it's used. You can contact us at masarruns@gmail.com or through Contact support in Settings. Our registration with the Information Commissioner's Office (ICO), the UK data protection regulator, is to be confirmed: registration number.
2. Information we collect
In short: what you give us, what your runs record, and a little about how the app is used.
Account details: your email, display name and password (we store only a scrambled version of the password, never the password itself), your date of birth and gender, and, if you choose, your height and weight. Height and weight are optional and count as health-related information, so only give them if you're comfortable. You can change or remove any of these in Settings > Account details.
Your runs: the route (GPS location points with times), distance, pace and duration of each run and walk you record or bring in from Strava, plus your RW points, rewards, challenge progress and badges.
Fraud checks: a coded fingerprint of each route, which we use to spot the same route being submitted twice, and what your phone reported next to what we measured.
Strava, only if you connect it: your Strava account number and the activities Strava shares with us, which are your runs and their routes. We keep the connection details encrypted.
Using the app: your IP address and the phone type you sign in from (to keep your account secure and stop abuse), and any message you send through Contact support. We don't use advertising or analytics trackers in the app.
The waitlist on our website: if you join it, your email address, whether you use an iPhone or an Android phone, and, if you choose to say, where you heard about us. The website doesn't use advertising or analytics cookies or trackers.
3. Location data
We use your location only to record, measure and check your runs and walks. We collect it only while a run is recording. It stops when you pause or finish, and it doesn't run when you aren't recording a run. On a phone where you've allowed it, Masar keeps recording while the screen is locked or the app is in the background, so your run isn't lost. You decide this in your phone's location settings, and turning location off means you can't record runs.
Your recorded routes are visible to you in your activity history. Other runners and the businesses never see them. You can choose to include your route in a shared run image, which is off by default.
4. Why we use it, and our legal reasons
To run your account, record and verify your runs, work out your points, and let you claim rewards, because that's the service you asked for (the legal reason is performing our contract with you).
To keep Masar fair and secure: checking runs, spotting cheating and keeping logins safe (our legitimate interest in preventing fraud and abuse). Your runs are checked automatically, and a run that doesn't add up earns no points. If you disagree, ask us and a person will look at it.
Where we ask first, we rely on your consent: location access on your phone, optional height and weight, connecting Strava, and including your route in a shared image. You can withdraw consent at any time, for example by switching it off in Settings.
The waitlist: we use your email only to tell you when Masar opens and to invite you to test it, because you asked us to (we rely on your consent). To leave the waitlist, email us and we'll remove you.
Your date of birth confirms you're at least 16. Right now we only store your gender, height and weight and show them back to you. They don't change your points. If we later use height and weight to estimate calories burned, we'll tell you first and ask before using them for that. We don't show your date of birth, gender, height or weight to other runners.
We don't sell your data and we don't use it for advertising. We email you only a sign-up code and important notices about your account, and, if you joined the waitlist on our website, a message when Masar opens and invitations to test it.
5. Who we share it with
In short: the businesses never get your personal details. A few service providers handle data for us.
Businesses that offer rewards only see the code you show them, and whether it's valid. They don't see your name, email, runs or location.
Companies that help us run Masar act on our instructions: a database provider and a hosting provider (where your data is stored and processed), and an email provider that sends your sign-up code. If you connect Strava, we exchange data with Strava as you've allowed. We may also share information if the law requires it or to protect people from harm.
6. Where your data is kept
Your data is stored in a database in London. The server that runs Masar is in the European Union, and the UK treats the EU as a safe place to send personal data. If a provider ever moves data outside the UK and EU, we'll make sure it's protected by approved safeguards. The final hosting setup is to be confirmed before launch.
7. How long we keep your information
In short: we keep it while you have an account, and delete it when you delete the account.
If you delete your account, your profile, run history and routes, points, claimed rewards, challenge progress and support messages are removed from our live systems straight away. Our database provider keeps a short recovery history, currently no longer than 24 hours, and your data drops out of it when that history rolls over. Server logs, which record the address of a request but never what's in it, are kept for a short time.
Waitlist emails are deleted once we've told you Masar is open, and in any case no later than 12 months after you join, or sooner if you ask.
If you sign up but never enter the code we email you, we delete that account after 14 days. Logins that have expired or been signed out are deleted automatically.
8. Keeping it safe
Passwords are stored scrambled with a strong method. Your login on your phone is kept in the phone's secure storage and can be cancelled from the server. Data travels encrypted, Strava connection details are encrypted where we store them, and we limit who can see what. No system is perfectly secure. If a breach puts your data at risk we'll tell you and the ICO as the law requires.
9. Your rights and choices
You have the right to: see the data we hold about you; correct it; have it deleted; ask us to limit how we use it; object to some uses, including checks we do in our legitimate interest; move your data to another service; and withdraw consent you've given. You can change your details and delete your account in Settings, turn location access on or off, choose whether to share your route, and disconnect Strava at any time. For anything else, use Contact support and we'll reply within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to put it right first.
10. Children
Masar is for people aged 16 and over. We check the date of birth you give when you sign up. If we find an account belongs to someone younger, we'll delete it. Because people under 18 may use Masar, we keep location and route sharing off unless you turn them on.
11. Changes and contact
We may update this policy, and we'll tell you in the app about important changes. Questions about this policy can be sent through Contact support in Settings.