Privacy Policy

Last updated: 14 June 2026

This policy explains what personal data D-PAD collects, why we collect it, and your rights over it. D-PAD ("we", "us") is operated by The D-Pad App Ltd, United Kingdom. If you have any questions, contact us at privacy@thedpad.co.uk.

What we collect

Account & identity — when you sign in with Discord, Google, Steam or email, we receive a user identifier, display name and avatar from that provider. We do not receive your provider password.
Gameplay activity — if you connect Discord, we read the game you are currently playing and how long you play, to award Miles.
Fitness / step data — on Android, with your permission, we read your daily step count via Health Connect to award Miles for walking.
Location — with your permission, your device location is used to award location stamps, power check-ins, and detect nearby content. Some location checks run in the background to notice when you arrive somewhere new.
Device & notifications — a push notification token so we can send you alerts (e.g. a stamp arriving nearby).
Usage data — basic in-app activity and diagnostics to keep the service working and improve it.

How we use your data

We use this data only to run D-PAD: to award and track Miles, boosts and stamps; to surface challenges and nearby content; to send notifications you have opted into; to operate the rewards store; and to keep accounts secure.

Health & location data. Step data read via Android Health Connect and your location data are used solely to provide D-PAD's features (earning Miles and awarding stamps). We do not sell this data, do not share it with third parties, and do not use it for advertising. You can revoke step or location access at any time in your device settings; the rest of the app will continue to work.

Our lawful basis

Under UK GDPR, we rely on: consent for processing your location, Health Connect step data, and push notifications (which you can withdraw at any time in your device settings); and contract — to operate your account and provide the rewards service you signed up for.

Who we share data with

We share the minimum necessary with service providers that help us run D-PAD, including: your chosen sign-in provider (Discord, Google, Steam), game-metadata services (IGDB), mapping (Mapbox), music (Spotify, if you connect it), and Google (push notifications and Health Connect). We do not sell your personal data to anyone.

Storage, retention & security

Your data is stored on our servers in the United Kingdom / EU and retained for as long as your account is active. We take reasonable technical measures to protect it. You can delete your account and associated data at any time from within the app, or by emailing us (see Contact).

International transfers

Some of the service providers that help us run D-PAD (such as Discord, Google, IGDB/Twitch, Mapbox and Spotify) are based outside the UK and EU, including in the United States. Where your data is transferred outside the UK/EU, we rely on appropriate safeguards (such as the UK International Data Transfer Agreement or equivalent) to protect it.

Your rights

Under UK data protection law you have the right to access, correct, export or delete your personal data, to withdraw consent, and to object to or restrict certain processing. To exercise any of these, email privacy@thedpad.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data.

Children

D-PAD is intended for users aged 16 and over, and is not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe someone under 16 has provided us data, contact us and we will remove it.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "last updated" date above and, where appropriate, notified in the app.

Contact

Questions or requests: privacy@thedpad.co.uk.