Privacy Policy

Vorld AG

Effective Date: March 31, 2026

1. Introduction

This Privacy Policy explains how Vorld AG, a company registered in Switzerland ("Vorld," "we," "us"), collects, uses, discloses, and processes personal data in connection with the Vorld mobile application and related services (the "Services").

We are committed to protecting your privacy and handling your data transparently and in accordance with applicable laws, including:

• the Swiss Federal Act on Data Protection (nFADP/DSG);
• the EU General Data Protection Regulation (GDPR), where applicable under the market-location principle (Art. 3 GDPR); and
• other applicable privacy laws in jurisdictions where the Services are available.

2. Data Controller

The data controller responsible for processing your personal data is:

Vorld AG

Via Stenna 4, 7017 Flims-Dorf Switzerland

Email: [[email protected]]

If required under Art. 27 GDPR, Vorld will appoint an EU representative and publish contact details here: [To be determined].

3. Personal Data We Collect

3.1 Account Information

• email address, username, first name, last name (optional), date of birth or age, and gender.

3.2 User Content

• profile images, post images, posts and comments, and social interactions (likes, follows).

3.3 Performance and Activity Data

• pumptrack locations associated with sessions, lap times, rankings, session data, and motion data recorded during sessions (e.g. device movement data uploaded as CSV files for validating lap performance).

3.4 Technical Data

• device information (model, operating system), app version, IP address, crash reports (via Firebase Crashlytics), and session/log data.

3.5 Location Data

We use location services (GPS) only to determine whether a user is physically present at a pumptrack at the time of a session. Location data is used temporarily during session start and is not stored persistently. We do not engage in continuous location tracking or build location histories.

3.6 Commercial Data (Future)

If paid features are introduced, we may collect payment-related information such as plan level, transaction references, and billing identifiers. Payment card details are processed by third-party payment processors and are not stored by Vorld.

4. How We Use Your Data

We process your data for the following purposes:

• to provide and operate the Services, including account management, lap tracking, rankings, and social features;
• to validate lap sessions and ensure fair use;
• to detect and prevent fraud, abuse, and manipulation of results;
• to maintain, improve, and develop the Services and introduce new features;
• to respond to user inquiries, reports, and support requests;
• to send service-related notifications (e.g. lap validation, event updates);
• to comply with legal obligations and enforce our Terms of Service; and
• to analyse usage patterns, system performance, and reliability.

5. Legal Basis for Processing

Where the GDPR or Swiss data protection law applies, we process your data based on one or more of the following:

• Contractual necessity (Art. 6(1)(b) GDPR): processing necessary to provide the Services you have requested.
• Legitimate interests (Art. 6(1)(f) GDPR): processing necessary for our legitimate interests, such as improving the app, ensuring fairness and result integrity, security, and fraud prevention, provided these interests are not overridden by your rights.
• Consent (Art. 6(1)(a) GDPR): where required, e.g. for optional marketing notifications or future features. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation (Art. 6(1)(c) GDPR): where processing is required to comply with applicable law.

6. Visibility of Data

By using the Services, you acknowledge that certain data is publicly visible, including rankings, pumptrack performance, and posts and images shared on public profiles.

6.1 Private Profiles

Users may set their profile to private. In this case, detailed lap history is restricted to approved followers. Rankings may still display aggregated performance (e.g. top times). We do not guarantee full anonymity in rankings.

7. Data Sharing

We do not sell your personal data.

7.1 Service Providers (Processors)

We use the following third-party services to operate the app, each of which may process data on our behalf under appropriate data processing agreements:

• Firebase Authentication (user login and identity)
• Cloud Firestore (database)
• Firebase Storage (file and image storage)
• Cloud Functions for Firebase (backend processing)
• Firebase Crashlytics (crash reporting and diagnostics)
• Firebase Remote Config (app configuration)

All Firebase services are provided by Google LLC. Google's data processing terms and sub-processor list apply.

7.2 Future Event and Sponsor Sharing

In the future, we may share limited data with event organisers or sponsors (e.g. username, performance data, participation details). Such sharing will be limited to what is necessary and will be disclosed to you before it occurs. Where required by law, we will obtain your consent.

7.3 Legal and Safety Disclosures

We may disclose personal data to law enforcement, regulators, or courts where required by law or where reasonably necessary to protect rights, safety, or investigate misconduct.

8. International Data Transfers

Your data may be processed by providers (primarily Google/Firebase) outside of Switzerland or the European Economic Area, including in the United States.

Where such transfers occur, we ensure appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs) pursuant to Art. 46(2)(c) GDPR;
• Swiss-recognised adequate protection or equivalent safeguards under the nFADP; and
• appropriate technical and organisational security measures.

You may request information about the specific safeguards in place by contacting us.

9. Data Retention

We retain your data only as long as necessary for the purposes described in this Policy, including to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements.

9.1 Account Deletion

When you delete your account:

• your personal data is removed from active systems;
• your lap data is removed from rankings;
• your User Content (posts, images, comments) is deleted.

We may retain limited data (such as email address and account metadata) where required by law, necessary for fraud prevention, or necessary to maintain audit trails.

10. Notifications

We may send notifications related to lap validation, events, challenges, and activities from organisers or sponsors. You can manage notification preferences in your device settings or within the app.

11. Children's Data

The Services are not directed to children under 13. We do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13 without appropriate authorisation, we will take reasonable steps to delete that information promptly.

Users between 13 and the age of majority may use the Services with parental or guardian consent as set out in our Terms of Service. Parents or legal guardians are responsible for supervising such use.

GDPR-specific: Where Art. 8 GDPR applies and the user is below the applicable age threshold (which varies by EU Member State, typically 16 or with parental consent from 13), processing based on consent requires the consent of the holder of parental responsibility.

12. Data Protection Impact Assessment

Given the nature of the Services (GPS-based tracking, motion-sensor data, performance profiling via rankings, and accessibility to minors from age 13), Vorld acknowledges the requirement to conduct a Data Protection Impact Assessment (DPIA) pursuant to Art. 35 GDPR and the corresponding provisions under Swiss law. A DPIA has been [completed / is in progress] and is available upon request by supervisory authorities.

13. Cookies and Similar Technologies

The Services may use cookies, SDKs, and similar technologies for:

• authentication and secure session management;
• remembering user preferences;
• analytics and performance measurement (e.g. crash reporting); and
• app configuration via Firebase Remote Config.

Users may manage device permissions and cookie settings through their browser or device. Disabling certain technologies may affect functionality.

14. Security

We implement appropriate technical and organisational measures to protect your data, including:

• secure cloud infrastructure (Google Cloud / Firebase);
• access controls and role-based permissions;
• encryption in transit (TLS);
• authentication controls; and
• incident response procedures.

No method of storage or transmission is completely secure. We cannot guarantee absolute security, but we continuously review and improve our security measures.

15. Your Rights

Depending on your location and applicable law, you may have the following rights:

15.1 Under GDPR and Swiss Data Protection Law

• access to your personal data (Art. 15 GDPR / Art. 25 nFADP);
• correction of inaccurate or incomplete data (Art. 16 GDPR);
• deletion of your data ("right to be forgotten") (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• objection to processing based on legitimate interests (Art. 21 GDPR);
• withdrawal of consent at any time (Art. 7(3) GDPR); and
• the right to lodge a complaint with a supervisory authority (in Switzerland: the FDPIC; in the EU: your local data protection authority).

15.2 Under California Privacy Law (CCPA/CPRA)

If you are a California resident, you may have additional rights including the right to know what personal information we collect and how it is used, the right to request deletion, the right to data portability, and the right to non-discrimination for exercising your rights. Vorld does not "sell" personal information as defined under the CCPA.

15.3 How to Exercise Your Rights

To exercise any of your rights, contact us at: [[email protected]]. We will respond within 30 days (or within the period required by applicable law). We may verify your identity before fulfilling your request.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Updates will be made available within the Services with an updated effective date. Where changes are material, we will provide notice by reasonable means. We encourage you to review this Policy periodically. Continued use of the Services after changes take effect constitutes acceptance of the updated Policy, to the extent permitted by applicable law.

17. Contact

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact:

Vorld AG

Via Stenna 4, 7017 Flims-Dorf Switzerland

• Privacy: [[email protected]]
• General Support: [[email protected]]
• EU Representative (Art. 27 GDPR): [To be appointed if required]

Swiss DPA: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern