Privacy Policy
Last updated 18 October 2026
1. Who we are
Safarnama is operated by Still Moving, run by an individual based in Gurgaon, Haryana, India, which decides how your personal data is handled. For anything about your data, a question, a correction, a deletion request, or a complaint, write to hello@still-moving.in and we will handle it in line with the Digital Personal Data Protection Act, 2023.
2. What we collect
| Category | Examples | Source |
|---|---|---|
| Account details | Name, email address, profile picture | You, at registration or in your profile |
| Challenge data | Which challenge(s) you join, total distance, monuments reached, milestone unlocks, current position on the route, membership tier | Generated as you use the Service |
| Activity records | Distance, activity type, perceived effort (RPE), notes, date; uploaded GPX/FIT files and, in the fallback flow, activity screenshots | You, when you log an activity |
| Strava data (optional) | Your Strava athlete ID, access and refresh tokens, and the activities you authorise us to read (distance, type, date, time) | Strava, if you connect it |
| Payment data | Membership purchased, amount, Razorpay payment/order IDs, payment status, whether you are a Founding Member | Razorpay, on a successful payment. We never see or store your card, UPI or bank details, those are handled entirely by Razorpay. |
| Stories & photos (optional) | A written testimonial and any photo you choose to submit after completing a route, plus whether you consented to publication | You, only if you use the optional “Share your story” prompt |
| Feedback | Messages you send through the in-app feedback form or by email | You |
| Technical data | Basic request logs kept by our hosting providers (IP address, timestamp, browser), used for security and diagnostics | Automatically, via Vercel and Supabase |
3. Why we use it, and our legal basis
- To run your challenge, calculate progress, unlock monuments, project your pace. (Performance of our agreement with you / your consent.)
- To verify activity, read distance from your files; let an administrator review a manual submission. (Performance of our agreement; our legitimate interest in fair play.)
- To take payment and give access, record what you have unlocked, issue finisher badges, email your receipt. (Performance of our agreement; legal obligation to keep financial records.)
- To communicate with you, sign-in links, payment confirmations, and occasional service or challenge updates. (Consent / performance of our agreement.)
- To improve Safarnama, read the feedback you send us, and use optional stories/photos for product research. (Our legitimate interest.)
- To feature stories you consent to, publish an approved testimonial and photo, credited to your first name, on our website and social channels. (Your consent, see section 5.)
- To keep the Service secure and to comply with law. (Legitimate interest / legal obligation.)
We do not sell your personal data, and we do not use it for advertising.
4. Who we share it with
We share personal data only with the service providers we need to run Safarnama, each under their own terms and privacy policy:
- Supabase, database, file storage and authentication.
- Cloudflare Turnstile, bot and abuse verification for sign-in and newsletter forms.
- Vercel, website and app hosting.
- Resend, transactional email (sign-in links, receipts) from
noreply@still-moving.in. - Razorpay, payment processing. Razorpay is the entity that collects and processes your payment instrument.
- Strava, only if you choose to connect it, and only the data you approve.
- OpenStreetMap, map tiles; your IP address is visible to them when the street map loads, as with any embedded map.
We may also disclose data if required by law, or to protect the rights and safety of participants or the Service.
5. Stories, testimonials and photos you share
After you complete a city, a trail, or all of India, Safarnama may invite you to write a short story about your journey and, if you wish, attach a photo. This is entirely optional, you can close or skip the prompt and it does not affect your badges or progress in any way.
If you do submit a story or photo, we ask you to tick a box confirming that we may publish it. We only publish a submission when both of these are true:
- you ticked the consent box when submitting, and
- a member of our team has reviewed and approved it.
When we publish, we show your first name only alongside your words and photo, on still-moving.in and on Safarnama's own social media channels. We do not publish your email, phone number, surname, exact location, or activity files. We may lightly edit for length or clarity without changing your meaning. Our legal basis is your consent.
You can withdraw consent at any time. Email hello@still-moving.in and we will unpublish the story and delete the photo, normally within a few working days. Withdrawal does not affect a re-share that a third party made while it was public, which is outside our control. If you never tick the consent box, your submission is stored only for our own product research and is never shown publicly.
Please only upload a photo that is yours to share and that does not identify other people without their agreement.
6. Strava connection
Connecting Strava is optional. If you connect it, we store the tokens needed to read your activities and we import activity distance, type, elevation gain and date to add to your Safarnama. We use Strava data only to calculate your progress on your chosen route, we do not use it for any other purpose, share it, or use it to train any model.
You can disconnect at any time from your profile. Disconnecting revokes our access at Strava, deletes the stored tokens, and removes every activity we synced from Strava (rolling that distance back out of your progress) so a reconnection starts clean. You can also revoke access from your Strava settings. Our use of Strava data is also governed by the Strava API Agreement.
7. Payments
Paid memberships are processed by Razorpay Software Private Limited. When you pay, you enter your card / UPI / netbanking details on Razorpay's secure checkout, not on our servers. We receive only a confirmation (payment ID, order ID, amount, status) which we store against your account to grant access and issue a receipt. Refunds are governed by our Refund & Cancellation Policy.
8. Where your data is stored
Data is stored on infrastructure operated by Supabase and Vercel, which may host or process it outside India (for example in Singapore, the EU or the USA). We rely on these providers' contractual and security commitments to protect data transferred in this way. If Indian law restricts a particular transfer, we will adjust our providers or configuration accordingly.
9. How long we keep it
We keep your account and challenge data for as long as your account is active. If you ask us to delete your account, we remove your personal data within 30 days, except where we must keep certain records longer, for example, payment and tax records, which Indian law requires us to retain for up to eight years. Aggregated or anonymised statistics that cannot identify you may be kept indefinitely.
A story or photo you submitted without ticking the publication box is kept only while it is useful for product research, and is deleted on request. A published story stays up until you withdraw consent or we retire it; on withdrawal we unpublish it and delete the photo.
10. Your rights
Under the DPDP Act, 2023 you have the right to:
- access a summary of the personal data we hold about you and how we process it;
- have inaccurate or incomplete data corrected or updated;
- have your data erased (subject to the retention rules above);
- withdraw a consent you previously gave (this will not affect processing already carried out);
- nominate another person to exercise these rights on your behalf in the event of death or incapacity;
- raise a grievance with us (section 14) and, if unresolved, complain to the Data Protection Board of India.
To exercise any of these, email hello@still-moving.in. You can edit your name and profile picture yourself in the app at any time. To delete your account, use “Delete my account” on your profile, we email you a confirmation link, and once you click it your routes, activities and progress are erased immediately (anonymised payment records are retained only as long as tax law requires, per section 9).
11. Security
We use HTTPS everywhere, store activity files and unapproved photos in private storage, and limit database access with column-level grants and row-level security so that participants can only read their own records. No system is perfectly secure. Please keep your email account secure, it is the only credential your Safarnama account relies on. If we become aware of a personal data breach that is likely to cause harm, we will notify the Data Protection Board and affected participants as required by law.
12. Children
Safarnama is intended for people aged 18 and over. We do not knowingly collect data from children under 18 without verifiable parental or guardian consent. If you believe a child has registered without consent, contact us and we will delete the account.
13. Cookies and local storage
We do not use tracking or advertising cookies. The app stores a small amount of data in your browser (your email, and a session token from Supabase) purely to keep you signed in. Clearing your browser storage will sign you out.
14. Changes
We may update this policy as the Service develops. If a change is significant we will make reasonable efforts to notify registered participants by email or an in-app notice, and we will update the date at the top.
15. Contact
For any question, request or complaint about your personal data, email hello@still-moving.in. We aim to acknowledge within 48 hours and resolve within 30 days.
Grievance Officer, Still Moving
Gurgaon, Haryana, India
Email: hello@still-moving.in
If a concern is not resolved, you may complain to the Data Protection Board of India.