Madar Privacy Policy

Last updated: 21 October 2026

Madar is a game, not a health app

Madar is a social walking game by Aryolab. Your steps are game input — fuel for your city's and country's journey to the Moon. We give no health advice, assess no fitness, and read nothing from your health data except the step count.

What we collect

Your account. Your email address only, used to sign you in with a one-time code. No password.

Your game profile. The name you choose, your city and country, and an avatar picked from an in-game set.

Your steps. The step count only — no heart rate, sleep, weight, or location. Details in the next section.

Your in-game activity. What your play produces: daily steps, distances, teams, duels and their results, cheers you send teammates, your «سمائي» sky discoveries, badges and quests.

A device token for notifications. If you enable notifications, we store a token your device issues so we can deliver them. It does not identify you personally, is used for nothing else, and is deleted automatically once it stops working.

Technical logs. Our hosting provider keeps short-lived technical logs of requests (such as IP address and time) to run and protect the service. We do not use them to track you.

Step and health data

• We read your step count from Health Connect on Android, the Health app (HealthKit) on iPhone, or your device's motion sensor — only after your explicit permission.
• Read only: we never write or change any data in Health Connect or the Health app.
• Reads happen only while the app is open — we do not collect steps in the background.
• Your step counts are sent to our server and used only for gameplay: your distance, your city's and country's race to the Moon, duels and team challenges, and your streaks, badges and quests.
• We never use them for advertising or marketing, never sell them, and never share them with third parties for those purposes.
• We do not store your steps or any health data in iCloud.
• You can withdraw permission at any time in Health Connect, the Health app, or your system settings. Reading stops; steps already counted stay in your game.

What we do not do

• We do not sell your data. Ever, to anyone, for anything.
• We do not share it with third parties for their own purposes.
• We show no ads.
• We use no analytics or behavioural tracking today. If that changes, we will update this page before it takes effect.
• We read no health data other than the step count.

Who processes data on our behalf, and where it is stored

• Supabase — hosts your account and game data (including your steps) in a data centre in Singapore (region ap-southeast-1).
• Resend — sends the sign-in code emails. It receives your email address and the message text in order to deliver it, and sends from Ireland (EU).
• Firebase Cloud Messaging (Google) — delivers notifications if you enable them, over Google's global infrastructure. It receives your device token and the notification text in order to deliver it; it does not receive your steps or your game data.

All are service providers acting for us. They do not own your data and do not use it for their own purposes.

Transfers outside Saudi Arabia

Your data is transferred to and stored outside Saudi Arabia: in Singapore with Supabase, and with Resend and Google for the two purposes above only. We rely on contractual safeguards with these providers — their data-processing terms, under which they commit to protect the data and to process it only on our instructions.

What other players can see

Your name, avatar, and city, plus your numbers on leaderboards, teams, and duels. Your email is never shown to anyone.

Retention

• We keep your account and game data for as long as your account exists.
• When you delete your account, we delete it within 30 days.
• Your notification device token is deleted automatically once it stops working.
• What remains after deletion: your past contributions to the collective totals (your city's and country's distance toward the Moon) stay part of that shared history, unattributed and no longer linked to you. Copies may also remain in the hosting provider's routine backups for a limited time until they are overwritten.

Your rights

Under Saudi Arabia's Personal Data Protection Law (PDPL), you can:

• Access the personal data we hold about you.
• Correct it — change your avatar in the app's settings; for anything else, email us.
• Ask us to delete it — see the account deletion page.
• Get a copy of it.
• Withdraw consent — step access in your system settings, notifications in the app's or the system's settings, or all of it by deleting your account.

To use any of these rights, email adel.alobaidi@live.com from your account's registered address. We respond within 30 days. You also have the right to complain to the competent authority, the Saudi Data & AI Authority (SDAIA).

Deleting your account

Email us from your account's registered address and ask for deletion — details on the account deletion page. We will delete your account, profile, daily steps, activity, discoveries, and device tokens within 30 days. Deletion is permanent and cannot be undone — you lose your progress, streaks, sky, and badges.

Age

Madar is intended for people aged 16 and over. We do not knowingly collect data from anyone younger. If you learn a child has created an account, contact us and we will delete it.

Changes to this policy

If what we collect or how we use it changes, we will update this page and the date above, and announce the change in the app before it takes effect.

Contact

For privacy questions and rights requests: adel.alobaidi@live.com — Aryolab.