Privacy Policy

Effective 13 November 2026 · Last updated 13 November 2026

This is LangkahFit's notice under Malaysia's Personal Data Protection Act 2010 (the PDPA). It explains what personal data we collect when you use LangkahFit, why we use it, who we share it with, how long we keep it, and your rights.

1. Who we are

LangkahFit is a running game: you jog in place or on a treadmill with your phone, and your runner moves along a 3D road in your web browser, alongside other players. It is made up of:

• the website at langkahfit.app;
• the web game at home.langkahfit.app;
• the LangkahFit phone app, which acts as the motion sensor; and
• our server at api.langkahfit.app,

together, the Service. LangkahFit is operated by Chelevenild Technologies (Business Reg. No. 202603131930), a business registered in Malaysia. We are the data user (controller) of the personal data described here.

By signing in or using the Service, you consent to us processing your personal data as described in this policy. Where needed, we also rely on providing the Service you asked for, and on complying with the law.

2. Data we collect

Account

You sign in with Google. Google gives us your Google account ID, your name, your email address and your profile picture link. We keep these, along with when your account was created and when you last signed in.

Your runner

The look you choose for your runner: body type, skin tone, hair, top, shorts and shoe colours.

Your runs

For each run: the map, where on the route you started, the distance, moving time, height climbed, step count, top speed, how you played (phone sensor, camera or keyboard), and when the run started, was last updated and ended. We also keep your last position on a route, so you can carry on from it later.

Live position while you run

While a map is open, your browser sends your position on the road, your speed and your direction to our server a few times a second, so other players on the same map can see you. We do not collect your physical location (GPS); the position is only your place in the game world.

Motion summaries from your phone

While the phone app is broadcasting, it sends a short summary several times a second: whether you are standing, walking, jogging or running, your speed, step count and cadence (steps per minute). See section 3 for what stays on the phone.

Technical data

Like any website, our hosting and server receive your IP address, browser and device type, and the pages and requests you make. We use these to run the Service, keep it secure and fix problems.

Messages to us

Anything you send us when you contact us, for example by email.

3. Your phone's sensors and camera

The phone app asks for these permissions, only for the features that need them:

• Motion sensors (accelerometer and gyroscope): to count your steps and tell how fast you are moving. The raw sensor readings are processed on your phone and are not sent to us. Only the summary in section 2 leaves the phone.
• Camera (only if you choose a camera mode): to follow your body movement, or to read the speed on a treadmill's display. The pictures are processed on your phone, using Google's on-device ML Kit. They are not recorded, saved or uploaded, to us or to Google.
• Bluetooth: to send your motion summary straight from your phone to the game in your browser.
• Notifications and running in the background (Android): to show the "LangkahFit is broadcasting" notification and keep counting your steps while the screen is locked. It stops when you press Stop or close the app.
• Internet: to sign in, and to send your motion summary to your game through our server when Bluetooth is not used.

You can refuse or withdraw any of these in your phone's settings. The features that need them will then not work.

4. Where your data comes from

Mostly from you, through the game and the phone app. Your name, email, account ID and profile picture come from Google when you sign in with Google.

5. Why we use it

• To create your account and sign you in on the web game and the phone app.
• To link your phone to your game, so your steps move your runner.
• To show you, your name and your runner to other players on the same map, and them to you.
• To record your runs, show your history and statistics, and let you carry on from your last position.
• To run, maintain and improve the Service, and to find and fix problems.
• To keep the Service secure and prevent cheating, abuse and fraud.
• To answer you when you contact us.
• To comply with Malaysian law, and respond to lawful requests from the authorities.

We do not use your personal data for marketing, we do not send you marketing emails, and we do not sell your personal data. If we ever want to send you product news, we will ask first and you will be able to stop it at any time.

6. What other players see

LangkahFit is a shared world. When you run on a map, other players on that map can see your name (as it is on your Google account), your runner's look, and where you are on the road and how fast you are going. They cannot see your email address, profile picture or run history. The other runners you see include computer-controlled runners with made-up names.

7. Who we share it with

We share personal data only with these parties, and only as much as each needs:

• Other players, as described in section 6.
• Google, as the sign-in provider. Google also provides the fonts on our website.
• Hosting and network providers, including Cloudflare, which delivers our website and protects it from attacks, and the provider of the server that runs our database.
• Professional advisers (lawyers, accountants, auditors), who must keep it confidential.
• Authorities, when Malaysian law, a court order or a regulator requires it, or to protect our legal rights or the safety of others.
• A buyer or successor, if LangkahFit is merged or sold, who must protect your data as this policy does.

Service providers may use your data only to provide their service to us, and must keep it secure.

8. Cookies and browser storage

We do not use advertising or tracking cookies, and we do not use analytics tools that follow you across websites.

The game keeps a few things in your browser's local storage: your sign-in, your runner's look, your last position on each route, and the phone you paired, so it can reconnect without asking again. The phone app keeps your sign-in and settings on the phone. Clearing your browser's data, or signing out, removes them. Cloudflare may set cookies needed to protect the website from attacks.

9. How long we keep it

• Account, runner and runs: while your account is open. When you ask us to delete your account, we delete it and all its runs within 30 days.
• Live position and motion summaries: passed on as they arrive and not stored, apart from the run totals and last position above.
• Technical logs (IP address, browser, requests): kept for no longer than 90 days, unless we need them longer to look into a security problem.
• Messages to us: as long as needed to deal with them, and no longer than 2 years.

We may keep data longer where the law requires it, or to deal with a legal claim.

10. Security

Data is encrypted in transit (HTTPS). Sign-ins use signed, expiring tokens, and we do not see or store your Google password. Access to our server and database is limited to people who need it. No system is perfectly secure, so we cannot guarantee absolute security. Please keep your Google account secure and tell us at once if you think your account has been misused.

If a personal data breach happens, we will notify the Personal Data Protection Commissioner as soon as practicable. Where the breach is likely to cause you significant harm, we will also tell you without unnecessary delay.

11. Your rights under the PDPA

You have the right to:

1. Access the personal data we hold about you.
2. Correct personal data that is inaccurate, incomplete, misleading or out of date.
3. Data portability: receive your data, or have it sent to another organisation, where technically feasible.
4. Withdraw your consent to us processing your personal data, by written notice.
5. Stop direct marketing: ask us not to use your data for direct marketing.
6. Deletion: ask us to delete your account and your data, subject to section 9.

To use any of these rights, or to make a complaint, email our Data Protection Officer at hello@chelevenild.my from the email address on your account. We may need to confirm your identity first. We will reply within twenty-one (21) days, as the PDPA requires. We may charge a fee for access requests where the PDPA allows.

If you withdraw your consent or ask us to delete your data, we will not be able to keep your account open or record your runs.

If you are not happy with how we handled your request, you can complain to the Personal Data Protection Commissioner (www.pdp.gov.my).

12. Your choices

• Choose your runner's look, or leave the default.
• Play with the keyboard, the phone's motion sensors or the camera. The camera is never needed.
• Refuse or withdraw the phone app's permissions in your phone's settings.
• Sign out of the web game or the phone app at any time.
• Ask us to delete your account at any time.

13. What you must provide

To use LangkahFit you need to sign in, which gives us your name, email and Google account ID. Without them we cannot open an account, link your phone to your game or record your runs. Everything else, such as your runner's look and the phone's permissions, is up to you.

14. Data outside Malaysia

Some of our providers, including Google and Cloudflare, may store or process data outside Malaysia. We transfer personal data abroad only where the PDPA allows: where it is needed to provide the Service you asked for, with your consent, or after taking reasonable steps to make sure it is protected to the standard the PDPA requires.

15. Children

LangkahFit is for people aged 13 and over. If you are under 18, you need your parent's or guardian's permission to use it. A parent or guardian can ask us to delete their child's data by emailing hello@chelevenild.my.

16. Changes and contact

We may update this policy. If we make significant changes, we will tell you in the game or by email before they apply, and update the date at the top of this page.

Questions, requests and complaints, including to our Data Protection Officer:

See also our Terms of Use.