Bundu | Hiking Trails ZA - Privacy Policy

Effective Date: 10 October 2026

Bundu ("Bundu", "the App") is a hiking and trail app operated by Bundu, r, South Africa ("We", "Us", "Our"). This policy explains what personal data the App accesses and collects, why, who it is shared with, how it is protected, how long it is kept, and how You can access or delete it. It applies to the Bundu app on Android and iOS and to bundu.club.

We process personal data in line with South Africa's Protection of Personal Information Act (POPIA) and, where they apply to You, other data protection laws such as the GDPR.

1. Data We Collect

Account information

You sign in with Google or Apple. We receive and store:

• Your name and email address (with Apple, this may be a private relay email if You choose to hide your email).
• A unique account identifier from Google or Apple and sign-in tokens used to keep You logged in.
• Your profile picture, if You upload one.

You can also sign in on bundu.club with Google to view Your profile, saved trails, visits and workouts. Your sign-in session is kept in Your browser's local storage until You sign out. The website does not record workouts or access Your location.

Location data

The App accesses Your device's precise (GPS) and approximate location, only after You grant permission. Location is used in two ways:

• Finding trails near You (while using the App). Your current location is used on Your device to show nearby trails, sort trails by distance and show Your position on maps. To work out which country and province You are in, Your coordinates are sent to Google's Geocoding service. We do not store this location on our servers.
• Recording workouts (in the foreground and in the background). When You start recording a hike, walk, run or ride, the App records Your GPS route (latitude, longitude and time) together with distance, pace, speed, elevation and duration. If You allow background location, recording continues when the App is minimised or the screen is off, so the whole workout is captured. Location is only recorded while a workout is in progress. When You save a workout, the route and statistics are stored on our servers in Your account.

Saved workouts are private by default and visible only to You. If You mark a workout as public, its route map and statistics are visible to other Bundu users in the community feed. You can switch a workout back to private at any time.

Content You create

• Trails You save to Your bucket list, and trails You check in to (visits).
• Groups and group hikes You create or join, and comments You post. Group details and comments are visible to the other members of that group, or to all users for public groups.
• Trails You suggest for listing.

Camera and photos

With Your permission, the App accesses Your camera and photo library only when You choose a profile picture or save a workout summary image to Your gallery. Profile pictures are uploaded to our servers; images saved to Your gallery stay on Your device.

Notifications and device data

If You allow notifications, Your device's push notification token is used to send You notifications about Your groups and hikes. Our servers also record standard technical information with each request, such as IP address, device type and operating system version, which We use to keep the service running and secure.

What We do not collect

We do not collect contacts, messages, call logs, payment details or health records, and We do not show third-party advertising in the App.

2. How We Use Your Data

• To create and manage Your account and sign You in.
• To show trails near You and directions to them.
• To record, display and store Your workouts, routes and statistics.
• To run community features: groups, group hikes, comments and public workouts.
• To send notifications You have opted into.
• To respond to Your support, data access and deletion requests.
• To keep the service secure, prevent abuse and fix problems.

We do not sell Your personal data, including Your location data, and We do not use it for advertising.

3. How We Share Your Data

We share personal data only with the service providers needed to run the App, and only for the purposes above:

• Google - Google Sign-In (account sign-in), Google Maps and Geocoding (maps, trail locations and working out Your country and province from Your coordinates), and Firebase Cloud Messaging (push notifications). Google Privacy Policy.
• Apple - Sign in with Apple. Apple Privacy Policy.
• DigitalOcean - hosting of our servers, database and file storage, where Your account data, workouts and profile pictures are stored. DigitalOcean Privacy Policy.

Other users see only what You choose to share (public workouts, Your name and profile picture on public content, group membership and comments). We may also disclose data if required by law or to protect the safety of our users. If Bundu is ever merged or sold, Your data would transfer under this policy and We would notify You first.

Our hosting providers may store data outside South Africa. Where that happens, We rely on providers that are bound by data protection obligations at least as strong as this policy.

4. How We Protect Your Data

• Encryption in transit: all communication between the App and our servers uses HTTPS (TLS). Connections from our servers to our database are also encrypted.
• Encryption at rest: our database and file storage are hosted on DigitalOcean infrastructure, which encrypts stored data at rest.
• Restricted access: our database only accepts connections from approved servers and administrator devices, and access is limited to the Bundu team members who need it to run the service. Credentials are kept out of the App and stored securely on our servers.
• Data minimisation: We only collect what the features above need. Location used to find nearby trails is not stored, and background location is only recorded during a workout You start.
• Breaches: if a security incident affects Your personal data, We will notify You and the Information Regulator as required by POPIA.

No system is completely secure, but We review and update these measures as the App changes.

5. How Long We Keep Your Data

• Account information, workouts, routes and content are kept while Your account is active.
• When You delete Your account, We delete Your account information, workouts, GPS routes, visits, saved trails, comments and profile picture within 30 days. Removed data may remain in encrypted backups for up to a further 30 days before being overwritten.
• Server logs are kept only as long as needed for security and troubleshooting.
• We may keep limited data for longer only where the law requires it.

6. Your Choices and Rights

• Location permissions: You can allow, limit or deny location access, including background location, at any time in Your device settings. Without background location, workouts may stop recording when the App is minimised. Without any location access, You can still browse trails.
• Workout visibility: make any workout public or private from Your profile.
• Delete a workout: delete any workout from Your activity list in the App. It is immediately removed from Your profile and the community feed.
• Delete Your account: in the App, go to Profile → Account Settings → Delete Account, or submit a request at bundu.club/data-settings. You do not need to reinstall the App to make a request.
• Access, correct or export Your data: request a copy of Your data or a correction at bundu.club/data-settings or by emailing hello@bundu.club. We respond within 30 days.
• Notifications: turn push notifications off at any time in Your device settings.
• Complaints: You may lodge a complaint with South Africa's Information Regulator (inforegulator.org.za) or Your local data protection authority.

7. Children's Privacy

Bundu is not intended for children under 13, and We do not knowingly collect personal data from them. If You believe a child has given Us personal data, contact Us and We will delete it.

8. Changes to This Policy

We will post any changes on this page and update the effective date. If We make significant changes to how We use Your data, We will notify You in the App before they take effect.

9. Contact Us

Bundu, Johannesburg, South Africa
Email: hello@bundu.club
Data requests: bundu.club/data-settings