Legal
Privacy Policy
This notice explains how Norn Digital (?we?, ?us?) processes personal data when you use the Dander app and website. It is written for users in the United Kingdom (including Northern Ireland) and the Republic of Ireland / European Economic Area where EU GDPR applies.
Data controller
Norn Digital Ltd (company number NI742575), 70 Carnvue Road, Newtownabbey, United Kingdom, BT36 6RQ, is the data controller. The company is incorporated in Northern Ireland. Privacy enquiries: info@dander.fit.
EU representative (Article 27 GDPR): Where required for EEA users, we will publish EU representative contact details on this page. Until then, EEA users may contact info@dander.fit for all privacy matters.
What we cover
Dander is a fitness and walking rewards app (not a game or social network). This notice covers the Dander mobile app, website (www.dander.fit), account services, step sync, virtual rewards (Clover), leaderboards, referrals, optional profile photos, push notifications, rewarded advertising, and partner reward redemptions.
Age limit
You must be at least 13 to create a Dander account. We do not knowingly collect data from younger children. App-store age ratings (for example PEGI 3 or Everyone) reflect content suitability; our account minimum remains 13.
Clover and partner rewards
- Clover is virtual in-app currency earned through walking, app activity, optional rewarded ads, referrals, and promotions. It has no cash value, is not cryptocurrency, and cannot be sold or transferred outside the app.
- Dander does not sell digital goods or in-app currency for real money. There is no in-app purchase billing or other real-money checkout in the app.
- When you redeem Clover for a partner offer (voucher code, discount link, or similar), fulfilment is provided by that independent business under its own terms. Dander does not issue cash, bank transfers, gift cards, or convertible digital assets.
Location and leaderboards
- When you open Rewards (and on reward maps if you use them), Dander may use your device location once per day to show offers for the country you are in. You can turn this off in your phone?s location settings for Dander. Offers then fall back to your home country.
- We do not store your exact coordinates, and we do not keep a history of places you have been. We store the country (for example Northern Ireland) and one coarse area of about 5 km.
- We do not share your location with other users.
- If your map location stays in the same country for 10 days, we update your home country so leaderboards and offers match where you actually are.
- Staff can see an internal heatmap of those coarse areas. An area is only shown once at least 5 people are in it. Deleting your account removes you from that count.
Fundraiser walk recording
When you tap Record on a club distance fundraiser, Dander uses your device?s location only while recording is active (including in the background if you allow it), so we can measure how far you walked. GPS is used on your phone to calculate distance. We do not send your route, path, or exact coordinates to our servers, and we do not store a map of where you went.
When you finish, we save only:
- the distance you added (in metres), and
- your running total toward that fundraiser.
That total is shown on the fundraiser progress bar with other members? totals. It is not shared as a live location and is not shown on a map.
You can stop recording at any time in the app, or turn off location for Dander in your phone?s app settings. If location is off, you cannot record GPS distance for that fundraiser (you can still use the rest of the app).
Personal data we collect
| Category | Examples |
|---|---|
| Account | Email, password (stored as a hash), display name, username, user ID, country/region code |
| Profile | Optional profile photo (camera or photo library), team name, referral code, equipped title |
| Fitness | Daily step counts and sync metadata from Apple Health / Health Connect when you connect; on some devices, motion/activity data may be used as a fallback when health access is unavailable |
| Fundraiser walks (optional) | Distance recorded toward a club fundraiser (metres only); no route or GPS trail stored |
| Leaderboards | Public ranking fields: display name, optional profile image, step totals, team name, regional grouping |
| App activity | Feature usage events (e.g. login, shop redemption, ads, health permission) |
| Device | Push notification token, advertising and device identifiers, app integrity signals, ad consent choices (where a consent prompt is shown) |
| Rewards | Clover balance, shop redemptions, voucher codes/links, referral records |
| Support | Contact form messages, data access requests, and account deletion requests |
Why we use data and lawful bases
| Purpose | Typical lawful basis (UK / EU GDPR) |
|---|---|
| Create and manage your account | Contract |
| Sync steps, streaks, and leaderboards | Contract; consent for health platform permissions |
| Record distance toward a club fundraiser you joined | Contract |
| Deliver rewards and partner redemptions | Contract; legitimate interests |
| Show leaderboards and team rankings | Contract; legitimate interests |
| Show offers for the country you are in, and correct your home country after 10 days there | Contract |
| Internal heatmap of coarse areas (not exact locations) | Legitimate interests |
| Push notifications (if enabled) | Consent / legitimate interests |
| Analytics and product improvement | Legitimate interests; consent where required for EEA/UK ads |
| Rewarded advertising | Consent where required (in-app consent prompt); legitimate interests for fraud prevention |
| Security and abuse prevention | Legitimate interests; legal obligation |
| Respond to privacy requests | Legal obligation |
Step and motion data are fitness and wellness data. We use them only to power app features, not for medical diagnosis. You can revoke health or motion access in device settings at any time.
Processors and sharing
We use trusted suppliers under contract. We do not sell your personal data for money.
- Cloud infrastructure ? authentication, database, storage, server-side processing, analytics, and app attestation (regions may include the EU and US).
- Advertising provider ? optional rewarded video ads and, where required, consent prompts for personalised advertising in the EEA/UK.
- Website host ? website hosting and privacy-friendly page analytics (see Cookies below).
- Partner businesses ? limited data needed to honour rewards you choose to redeem (for example display name and redemption record). Partners do not receive your email, password, or full step history unless you contact them directly.
International transfers
Data may be processed in the UK, EEA, and United States. Where required, we rely on adequacy decisions, Standard Contractual Clauses, or supplier certification mechanisms. Details are available on request.
Retention
- Account data: until you delete your account, then removed or anonymised within a reasonable period (typically within 30 days of a verified deletion request), except where we must retain records for legal, tax, or fraud purposes.
- Map area: the current country and coarse area only, until you delete your account or your location changes. Exact coordinates are not retained.
- Analytics: according to our analytics provider?s retention settings.
- Support emails: as long as needed to resolve your enquiry.
Security
We use encryption in transit, access controls, and database security rules proportionate to risk. No method of transmission is 100% secure.
Cookies and similar technologies
Our marketing website uses:
- Essential storage ? for example to remember cookie-notice dismissal.
- Website analytics ? privacy-oriented, cookieless page-view analytics on www.dander.fit. We do not use advertising or cross-site tracking cookies on the website.
The mobile app uses on-device storage and third-party software as described above. In the app, open Settings ? Ad privacy settings (where available) to review or change advertising consent choices.
Your rights
Depending on where you live, you may have the right to:
- Access and receive a copy of your data
- Rectify inaccurate data
- Erase data (?right to be forgotten?)
- Restrict or object to certain processing
- Data portability
- Withdraw consent where processing is consent-based
- Lodge a complaint with a supervisory authority
UK: Information Commissioner?s Office (ICO) ? ico.org.uk
Ireland / EEA: Data Protection Commission (Ireland) ? dataprotection.ie
To exercise rights, email info@dander.fit with Data access request or Account deletion in the subject, use our contact form (choose ?Request my Data? or account deletion), or use in-app controls:
- Delete account: Settings ? Delete your account (permanent; removes profile, steps, and rewards data).
- Request my data: Settings ? Request my data (opens the contact form ? email from your Dander account so we can verify you).
- Ad choices: Settings ? Ad privacy settings (mobile app, where available).
We respond within one month where required by law.
Automated decisions
We do not make solely automated decisions with legal or similarly significant effects. Rewards use automated systems with published rules; you may contact us with questions.
Changes
We may update this policy. The ?Last updated? date will change. Material updates may be shown in the app or by email.
Related documents
See also our Terms of Service.