Privacy Policy

Last updated: August 2026

This Privacy Policy explains how Kondri, MB, operating the Koja kojon application and related services ("Koja kojon", "we", "us", or "our"), collects, uses, stores, and shares personal data.

We are committed to processing personal data transparently and only to the extent reasonably necessary to provide and improve Koja kojon.

1. Who Is Responsible for Your Data?

The data controller is:

Kondri, MB
Company code: 307438050
Registered office: Jaunimo g. 7-4, Raudondvario k., LT-82213 Radviliškio r., Lithuania
Email for privacy enquiries: info@kojakojon.app
Website: kojakojon.app

For questions about this Privacy Policy or your personal data, contact us at info@kojakojon.app.

2. What This Policy Covers

This Privacy Policy applies to personal data processed through:

• the Koja kojon mobile application;
• your Koja kojon account;
• challenge participation;
• activity synchronisation;
• manual activity entries;
• purchases and payments;
• physical medal delivery;
• gifting;
• customer support;
• analytics; and
• related Koja kojon services.

3. Information We Collect

Account Information

When you create or use an account, we may process:

• email address;
• unique account identifier;
• optional full name or display name;
• account creation date;
• preferred language;
• timestamp recording acceptance of the Terms;
• marketing preference; and
• authentication-provider information if you use Google or Apple sign-in.

Koja kojon uses passwordless authentication.

We do not receive or store a traditional Koja kojon password.

Activity Information

When you synchronise activity from a supported device health platform, Koja kojon may process:

• activity type;
• walking or running distance;
• cycling distance;
• steps;
• activity duration;
• activity start time;
• source of the activity; and
• technical identifiers used to prevent duplicate synchronisation.

Raw health samples are processed on your device and reduced to the activity information needed for challenge progress before relevant information is sent to our backend.

You can also provide activity information manually.

Information We Do Not Collect Through Health Synchronisation

Koja kojon does not currently request or collect:

• heart rate;
• calories or energy expenditure;
• sleep information;
• blood pressure;
• blood glucose;
• HRV;
• VO₂ max;
• medical records;
• workout GPS coordinates; or
• workout routes.

Location

Koja kojon does not currently request access to:

• precise device location;
• approximate device location;
• background location; or
• GPS workout routes.

Maps shown in the App display predefined virtual challenge routes rather than your real-world location.

Purchase Information

When you make a purchase, we may process:

• product or purchase tier;
• transaction amount;
• currency;
• payment status; and
• payment or checkout session identifier.

Payment-card information is entered directly into our payment provider's checkout environment.

Koja kojon does not receive or store your complete payment-card number.

Shipping Information

If you purchase a physical product, we may process:

• recipient name;
• telephone number;
• delivery country;
• selected delivery carrier;
• parcel-locker identifier; and
• parcel-locker name.

Physical product delivery is currently available to supported parcel lockers in Lithuania, Latvia, and Estonia.

Gift Information

If you purchase or redeem a gift, we may process information such as:

• email associated with the gift;
• unique gift claim code;
• purchaser account identifier; and
• recipient or claiming account identifier.

Technical and Usage Information

When analytics is enabled, we may process limited technical and usage information such as:

• device model;
• operating system and version;
• app version;
• IP address;
• language or locale;
• app session information;
• screens viewed;
• app lifecycle events;
• challenge interactions;
• activity type and aggregated distance or duration associated with product analytics; and
• technical error information.

We do not use advertising identifiers such as IDFA or AAID for advertising tracking.

We do not use Koja kojon analytics data for cross-app advertising.

Notifications

Koja kojon currently uses local device notifications.

These notifications are scheduled on your device.

We do not currently obtain or store remote push-notification tokens for this functionality.

Notification permission is optional and can be changed through your device settings and, where available, Koja kojon settings.

4. Health and Fitness Data

On supported devices, Koja kojon can request read-only access to activity information through device health platforms.

On iOS, this may include access through Apple HealthKit.

On Android, this may include access through Health Connect.

Koja kojon currently requests read access only to data needed for challenge progress, such as:

• workouts or exercise sessions;
• walking/running distance;
• cycling distance; and
• steps.

Koja kojon does not request permission to write activity information into your health record.

Health synchronisation is optional.

Where manual activity entry is available, refusing health access does not prevent you from manually recording eligible challenge activity.

We do not sell health information.

We do not use health information for targeted advertising, marketing profiling, credit decisions, insurance decisions, or similar unrelated purposes.

5. How We Use Personal Data

We process personal data for the following purposes.

Providing Your Account and the Service

We process account information to:

• create and authenticate your account;
• maintain login sessions;
• provide your profile;
• provide challenges;
• record challenge participation;
• calculate progress;
• award achievements;
• generate certificates; and
• provide purchased functionality.

Processing Manual Activity

We process activities you manually provide to record challenge progress and deliver the functionality you request.

Synchronising Health and Fitness Activity

Information obtained from HealthKit, Health Connect, or another supported health platform may constitute sensitive health-related data.

We therefore process such synchronised activity on the basis of your explicit consent where required by applicable data protection law.

You choose whether to enable health synchronisation.

You may revoke the relevant device permission at any time.

Revoking access prevents future synchronisation but does not make earlier lawful processing unlawful.

Purchases and Orders

We process purchase, payment-status, gift, and fulfilment information to:

• process purchases;
• confirm transactions;
• provide digital products;
• deliver physical products;
• manage gifts;
• respond to customer requests; and
• handle refunds, disputes, or complaints.

Certain transaction records may also be processed to comply with accounting, taxation, fraud-prevention, or other legal obligations.

Analytics

With your consent where required, we use product analytics to understand how Koja kojon is used and to improve:

• usability;
• challenge design;
• performance;
• reliability; and
• product functionality.

Analytics is not used for third-party advertising or cross-app behavioural advertising.

You may withdraw analytics consent through the mechanism provided by Koja kojon.

Marketing

If you separately opt in to marketing communications, we may use your contact details to send Koja kojon news, new-challenge announcements, offers, or similar marketing.

Marketing is based on your consent where required.

Marketing consent is optional and separate from accepting the Terms.

You may withdraw marketing consent at any time.

Security and Legal Compliance

We may process information where necessary to:

• prevent fraud;
• investigate misuse;
• secure accounts and systems;
• enforce our legal rights;
• comply with legal obligations; or
• establish, exercise, or defend legal claims.

The applicable legal basis may be compliance with a legal obligation or our legitimate interests, depending on the circumstances.

6. Analytics

Koja kojon currently uses PostHog for product analytics.

PostHog may receive information such as:

• your pseudonymous Koja kojon user identifier;
• app usage events;
• device and operating-system information;
• app version;
• IP address;
• language;
• screen information; and
• selected product-interaction information.

We do not intentionally send your name, shipping address, phone number, or payment-card details to PostHog as analytics event properties.

Session replay is not currently enabled.

Automatic touch or interaction recording is not currently enabled.

Koja kojon does not use PostHog for advertising or cross-app tracking.

Where required, analytics will operate only after the relevant consent has been provided.

7. Authentication

Koja kojon authentication is provided through Supabase Auth.

Depending on the method you select, authentication may also involve:

• Google; or
• Apple.

When using Google or Apple authentication, those providers process authentication information under their own privacy terms.

Koja kojon receives information necessary to authenticate your account, such as an identity token and, where made available, your email address or name.

8. Payments

Payments are processed using Stripe.

When you proceed to checkout, Stripe may receive information necessary to process your transaction, including your email address, payment information, transaction amount, and relevant order information.

For physical purchases, limited fulfilment information may also be associated with the transaction.

Your full payment-card details are handled by Stripe and are not stored in Koja kojon's backend.

Stripe may retain transaction data according to its legal and regulatory obligations.

9. Email

We use Resend to send transactional communications where applicable.

These may include:

• authentication-related email;
• gift information;
• purchase-related information; and
• other Service communications.

Resend may process the recipient's email address and the content required to deliver the relevant communication.

10. Maps

We use Mapbox to display challenge maps and predefined virtual routes.

Koja kojon does not use Mapbox to display or track your actual location.

Map tile requests may involve technical information such as an IP address as part of normal internet communication.

11. Physical Product Delivery

Where you purchase a physical medal or bundle, delivery information may be shared with the organisation responsible for order fulfilment and with the selected delivery provider as necessary to deliver your order.

Supported delivery providers currently include:

• Omniva; and
• LP Express / Unisend.

Only information reasonably necessary for delivery should be shared.

This may include:

• your name;
• telephone number;
• delivery country; and
• selected parcel locker.

12. Service Providers and Recipients

Depending on the functionality you use, personal data may be processed by the following categories of recipients:

Supabase
Backend infrastructure, database, authentication, and server-side functions.

PostHog
Product analytics.

Stripe
Payment processing.

Resend
Transactional email.

Google
Optional Google authentication.

Apple
Optional Apple authentication and Apple HealthKit on supported devices.

Google Health Connect
Health/activity access on supported Android devices.

Mapbox
Map display.

Omniva and LP Express / Unisend
Physical product delivery where relevant.

Expo-related infrastructure
May be involved in technical app build, deployment, or application infrastructure where applicable.

We may also disclose information where required by law, court order, competent authority, or where reasonably necessary to establish or defend legal rights.

We do not sell personal data.

We do not share personal data with advertising networks for behavioural advertising.

13. International Data Transfers

Some service providers may operate or process information outside Lithuania or the European Economic Area.

Where personal data is transferred outside the EEA and the destination does not benefit from an applicable adequacy decision, we will use a lawful transfer mechanism required under applicable data protection law, such as appropriate contractual safeguards.

You may contact info@kojakojon.app for further information about applicable international-transfer safeguards.

14. How Long We Keep Data

We retain personal data only for as long as reasonably necessary for the purposes described in this Policy or for periods required by law.

Account and Profile Data

Normally retained while your account is active and deleted when your account is deleted, unless specific information must be retained for another lawful reason.

Challenge and Activity Data

Normally retained while your account is active so we can maintain challenge progress, achievements, and account history.

It is deleted from our primary account database when your account is deleted unless retention is legally required.

Order and Financial Information

Purchase and accounting records may be retained for the periods required by applicable Lithuanian tax, accounting, and financial-record laws.

Certain accounting records may need to be retained for up to 10 years.

We minimise retained personal information where possible.

Shipping Information

Shipping information is retained only for as long as required to fulfil the order, handle returns or complaints, demonstrate fulfilment, comply with legal obligations, and resolve disputes.

Gift Information

Gift records may be retained while necessary to enable redemption and afterwards to maintain necessary transaction or fraud-prevention records.

Analytics

Analytics information is retained according to our configured analytics retention settings and operational requirements.

Where an identifiable analytics record must be erased in response to a valid data-protection request, we will take reasonable steps to action the request with the relevant provider.

Third-Party Records

Some information held independently by payment, email, authentication, or other service providers may be retained according to their own legal obligations and retention requirements.

Account deletion does not require us or a provider to erase information that must lawfully be retained, such as certain financial transaction records.

15. Account Deletion

You may delete your Koja kojon account using the account-deletion functionality provided in the App. If you no longer have the App installed, you may request deletion at kojakojon.app/en/delete-account or by emailing info@kojakojon.app.

Deleting your account removes your authentication account and associated Koja kojon account data from our primary database, including relevant challenge and activity records, subject to legal retention requirements.

Certain limited records may remain where necessary for:

• accounting or taxation;
• payment disputes;
• fraud prevention;
• compliance obligations;
• legal claims; or
• another lawful purpose.

Data held by third-party providers may require separate processing as part of a data-erasure request.

If you want us to exercise an erasure request across relevant service providers, contact:

info@kojakojon.app

16. Security

We use technical and organisational measures intended to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

Measures used by the Service include, where applicable:

• passwordless authentication;
• HTTPS/TLS encryption for data transmitted over the internet;
• access controls;
• database row-level security;
• server-side authentication checks;
• restricted server credentials;
• verification of payment-provider communications; and
• separation of user records by account identity.

No internet-connected system can be guaranteed to be completely secure.

If we become aware of a personal-data breach, we will respond in accordance with applicable data-protection law.

17. Children

Koja kojon accounts are intended for users who are at least 14 years old.

We do not intentionally request date of birth, gender, or other information about children.

Users under the applicable age for providing their own valid data-protection consent must not provide consent for optional processing such as health-data synchronisation without any authorisation required by applicable law.

If we become aware that personal data relating to a child has been collected in circumstances where legally required consent or authorisation was not obtained, we will take appropriate steps.

A parent or legal guardian who believes that a child has provided personal data improperly may contact info@kojakojon.app.

18. Your Data Protection Rights

Depending on applicable law, you may have the right to:

• obtain information about how your personal data is processed;
• request access to your personal data;
• request correction of inaccurate data;
• request deletion of your data;
• request restriction of processing;
• receive certain data in a portable format;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing relies on consent; and
• lodge a complaint with a competent data-protection supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

These rights may be subject to exceptions or limitations provided by law.

To exercise a right, contact:

info@kojakojon.app

We may need to verify your identity before completing certain requests.

19. Health-Data Permissions

You control health-data permissions through your device.

Removing Koja kojon's access through Apple Health or Health Connect prevents future access to the relevant information.

Removing the permission does not automatically delete information previously synchronised with your Koja kojon account.

You may delete your account or contact us if you also want previously stored Koja kojon activity data deleted, subject to applicable legal exceptions.

20. Marketing Choices

Marketing consent is optional.

Refusing marketing does not prevent you from creating or using a normal Koja kojon account.

If you opt in, you may withdraw your consent at any time using an unsubscribe mechanism where provided or by contacting info@kojakojon.app.

Transactional communications necessary for your account, purchases, security, or requested services are separate from marketing communications.

21. Automated Processing

Koja kojon automatically calculates challenge progress and may automatically unlock checkpoints, achievements, or virtual rewards based on recorded activity.

We do not currently use personal data to make solely automated decisions that produce legal effects or similarly significant effects concerning you.

22. No Advertising Profiling

Koja kojon does not currently use:

• advertising networks;
• behavioural advertising identifiers;
• cross-app advertising tracking; or
• health information for advertising.

If this changes in the future, this Privacy Policy and any required consent mechanisms will be updated before the new processing begins.

23. Changes to This Privacy Policy

We may update this Privacy Policy when our Service, technology, providers, or legal obligations change.

The current version will display its most recent update date.

Where a material change affects how personal data is processed, we will provide appropriate notice.

If new processing requires consent, we will request the required consent rather than relying solely on an updated Privacy Policy.

24. Complaints

If you have concerns about how Koja kojon processes your personal data, please contact us first at:

info@kojakojon.app

You also have the right to lodge a complaint with the competent supervisory authority.

For Kondri, MB in Lithuania, the supervisory authority is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, VDAI).

If you live elsewhere in the EEA, you may also have the right to contact the supervisory authority applicable to you.

25. Contact Us

Kondri, MB

Company code: 307438050
Registered office: Jaunimo g. 7-4, Raudondvario k., LT-82213 Radviliškio r., Lithuania
Privacy email: info@kojakojon.app
Website: kojakojon.app