Privacy Policy

1. Operator & contact

Operator: arearun (operator of Paso)
Contact: support@arearun.app

2. Information we collect

2-1. Location

• Location is used only for route search, during navigation, for the map view, and at the moment you submit a report (one reading, on the spot). The app never collects location in the background (while the screen is closed).
• We never store or transmit a record of your movements (tracks or history).
• When you report a barrier, the server records the location as the nearest road segment, or as a point rounded to roughly 10 meters — the exact coordinates you sent are not stored.

2-2. Report content

• A report is an objective fact only: which road segment (or ~10 m point), and what was there (a step, stairs, ice, construction, flooding, etc. — from a fixed set of categories). There is no free-text field.
• There are no accounts, and each report is assigned a single-use anonymous ID. By design, multiple reports cannot be joined together to reconstruct an individual's movements.
• The optional mobility profile (wheelchair / stroller / walking) is recorded only as context for assessing report reliability and is not linked to any person.

2-3. Photos (optional — off by default)

• Photo submission is enabled only with your explicit consent.
• Photo location metadata (EXIF) is always removed before sending, and faces, license plates and the like are painted over on your device before upload. The server additionally verifies that no location metadata remains.
• Submitted photos are not published until the operator's review (approval) is complete.

2-4. Information stored only on your device

Consent settings, your mobility profile and your contribution count are stored only on your device and are never transmitted.

3. Purposes of use

• Computing and guiding walking routes that avoid steps
• Showing barrier information (steps, stairs, etc.) on the map and managing its freshness and confidence
• Collecting and showing street passability in disasters (see section 4 below)
• Preventing abusive submissions (device integrity checks via Apple App Attest)

4. Sharing with third parties

• What we may provide to local governments and businesses is only the same day-granularity, count-level aggregated barrier information that appears on the public map (for example: "two step reports on this road segment, last reported on this date"). The Service holds no personally identifiable information, so it does not — and cannot — provide personal data to third parties.
• Disaster-time reports may be shared individually with a municipal disaster-response headquarters, as stated clearly on the report screen (locations are recorded the same way as normal reports).

5. Processors (data storage & delivery)

We use the following services to store and deliver data, only within the purposes set out in this policy: Supabase (database; data stored in the Tokyo region), Vercel (web and API delivery), and Cloudflare (delivery of map tiles and similar assets).

6. Retention & deletion

• Barrier reports are retained as anonymous factual data to maintain the quality of the map.
• Photos that are not approved are never published; rejected photos are subject to deletion.
• If you notice a mistaken submission or something unintentionally captured, please contact us at the address above. We will review it and delete it as appropriate.

7. Changing or withdrawing consent

Consent for submitting reports and photos can be turned on or off at any time in the app's Privacy tab. Everything is off by default. Using navigation requires no consent at all.

8. Changes to this policy

If this policy changes, we will announce it on this page. For material changes, we will also notify you inside the app.