Privacy Policy

1. Welcome to Drom

Welcome to Drom’s Privacy Policy. We designed this policy to be transparent, straightforward, and easy to read. Think of this as your guide to exactly what data we collect, why we need it, how we protect it, and what controls you have as our runner and partner.

2. Who We Are & Where This Applies

This Privacy Policy applies to the Drom mobile application (iOS & Android), the website rundrom.com, and related services. The database controller responsible for managing your data under the Israeli Protection of Privacy Law, 5741-1981 is:

This policy is governed by the laws of the State of Israel, including the Protection of Privacy Law, 5741-1981 and its regulations. If you reside in the European Economic Area (EEA) or the United Kingdom, please also review Section 13 below.

3. The Data We Collect

To connect you with compatible running partners, facilitate real-world meetups, and maintain community safety, we collect and process the following categories of data:

Data You Provide to Us:

• Account Data: Depending on how you create your account: your phone number (verified via SMS OTP), your name and email provided by Google or Apple sign-in (including Apple Private Relay addresses), or your email and password (handled securely through Firebase Authentication; we never store or see your raw password). We also collect your date of birth to verify you are 18 or older.
• Profile Data:Your name, photos, age, gender, running level and pace (including Jack Daniels' VDOT fitness scores), schedule preferences, and intent tags you choose (such as "Open to Dating", "Race Prep", "Social Running", or "Women Only"), as well as your relationship status ("Single" or "In a Relationship") if you choose to set it. Providing certain tags (e.g. dating preferences and gender) is entirely voluntary.
• Content & Chats: Messages, images, and Run Proposals shared in 1-on-1 chats and in dromNow group chats. Group chat messages and run details are visible to all approved participants of that specific run.
• Safety & Reports Data: Information submitted when contacting support or reporting another user. When a user is reported, recent conversation messages between the parties are preserved within the incident report for moderation review, even if either user later unmatches, blocks, or deletes their account.

Location and Integrations:

• Location Data (Matching & dromNow): With your device permission, we convert your location into geographic area hashes (geohashes) to connect you with nearby runners and power dromNow spontaneous group runs within a 25 km radius. We do not display your exact live GPS coordinates to other runners—only your approximate distance and meeting points you explicitly create or join. You can revoke location permissions at any time in device settings.
• Strava Integration (Optional): If you choose to connect your Strava account, we receive workout statistics (such as recent runs and 5K paces) via the Strava API to calculate your VDOT score. Your private routes and detailed maps remain visible only to you. You may disconnect Strava at any time in Account Settings, upon which imported data is wiped within 48 hours.

Technical and Analytics Data:

• Usage & Device Data: Device model, operating system, IP address, unique installation identifiers, push notification tokens (Firebase Cloud Messaging), crash diagnostics, and anonymous product telemetry collected through Google Analytics for Firebase and exported to Google BigQuery for backend performance optimization.

3A. Meta (Facebook) SDK & Ad Attribution

We use the Meta SDK (provided by Meta Platforms Ireland Ltd. / Meta Platforms, Inc.) to measure the effectiveness of our install campaigns on Facebook and Instagram.

The SDK sends standard app event signals: App Install / First Open, Registration Completed, First Match, and dromNow Run Joined. We do NOT pass your name, phone number, email address, chat messages, photos, or GPS locations in these event parameters.

When active, the Meta SDK automatically collects technical device metadata (IP address, device OS/model, app version, and advertising identifiers like IDFA on iOS or GAID on Android):

• iOS Devices:Ad tracking identifiers are accessed ONLY if you give affirmative permission via Apple's App Tracking Transparency (ATT) prompt. You can change your selection anytime via iOS Settings → Privacy & Security → Tracking.
• Android Devices:You can manage or delete your Advertising ID via Android Settings → Privacy → Ads.

For more information on how Meta processes information, consult Meta's Privacy Policy.

4. Why and How We Use Your Data

You are not legally obligated to provide us with personal data, but we cannot create an account or provide matching without core registration details. Voluntary details (such as intent tags, Strava sync, and notifications) can be toggled at your discretion.

5. How We Share Data & Processors

We do not sell your personal data. We share data only with fellow community members (as intended by public profiles and group chats) and with trusted infrastructure processors under strict confidentiality and security terms:

6. Cross-Border Data Transfers

While Drom's management and operations are centered in Israel, our cloud infrastructure is hosted primarily on Google Cloud servers located within the European Union (Belgium), with certain analytics and third-party services processed in the United States. All cross-border transfers from Israel are executed in strict accordance with the Israeli Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001, utilizing jurisdictions offering adequate legal protection or providers bound by robust contractual safeguards.

7. Your Rights Under Israeli Law

Under the Israeli Protection of Privacy Law, 5741-1981 (including Amendment 13), you have fundamental rights regarding your information:

• Right of Inspection (Access): You may request a copy of the personal data held about you in our databases. We will respond within 30 days as prescribed by law.
• Right of Correction & Deletion: If you find information to be inaccurate, incomplete, or out-of-date, you can update your profile directly in the app or request that we amend or delete it.
• Account & Data Deletion: Users can request account and data deletion at any time. You can delete your account directly inside the mobile app (Settings → Account → Delete Account) or submit a deletion request online via our dedicated web portal at https://www.rundrom.com/delete-account.
• How to Exercise Rights: Contact our team at privacy@rundrom.com. You also have the right to file a complaint with the Israeli Privacy Protection Authority (PPA) at gov.il/privacy.

8. Data Retention & What Happens on Deletion

Users can request account and data deletion at any time via the app or at https://www.rundrom.com/delete-account. We retain personal data only as long as necessary to provide our services and protect community safety:

9. Age Requirement (Strictly 18+)

Drom is strictly intended for individuals aged 18 and older. We enforce a date-of-birth verification gate at sign-up. If we discover or receive a report that an account belongs to a person under the age of 18, we will immediately terminate and delete that account and its associated profile. If you believe a minor has registered on Drom, please notify us immediately at privacy@rundrom.com.

10. Our Website & Cookies (rundrom.com)

When you browse rundrom.com, we do not use intrusive third-party advertising cookies. We set a single functional cookie (`NEXT_LOCALE`) to remember your preferred language, and store your cookie preference in localStorage. We also utilize Vercel Web Analytics to track general website visitor trends; Vercel Web Analytics is privacy-friendly, does not use cookies, and hashes visitor IPs on a daily basis so users cannot be tracked across days or sites.

11. Data Security

We implement industry-standard physical, organizational, and technical safeguards designed to meet the requirements of the Israeli Privacy Protection Regulations (Data Security), 5777-2017. User data is encrypted in transit (TLS 1.3) and at rest (AES-256) across Google Cloud infrastructure.

12. Contact Us

For any questions regarding this Privacy Policy or your personal information, reach out to us at:

13. Notice for EEA and UK Residents (GDPR)

If you reside in the EEA or UK, we process your personal data under the following legal bases pursuant to the GDPR:

• Performance of Contract: To provide account registration, matching, chat, and meetup services.
• Consent: For geolocation services, push notifications, Strava integration, and ad tracking where applicable.
• Legitimate Interests: To protect our community from abusive users, maintain audit trails, and optimize app stability.

You enjoy rights to data portability, restriction of processing, objection to processing, and the right to lodge a complaint with your local EU/UK Data Protection Authority.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you in-app or via our official communication channels at least 30 days prior to their effective date.