Privacy Policy

What we collect

RUNDR's backend (a Cloudflare Worker) stores exactly two things, both anonymous and ephemeral :

• A random device UUID (e.g. 137c2a11-6909-4ead-ba48-e71cb615799a), generated on your phone the first time you open the app. We never see who you are — just an opaque ID that lets us enforce the free tier's 3 loops/day limit.
• A daily counter (e.g. 2026-05-14:137c2a11... → 2) recording how many loops your device generated today. This counter expires at UTC midnight every night — we don't keep history.

If you upgrade to Pro, we additionally store an opaque receipt hash to bypass the free tier limit — never your Apple ID, never your name, never your email.

What we do not collect

• No name, no email, no phone number, no address
• No Apple ID, no Google ID, no social login
• No analytics SDK (Google Analytics, Mixpanel, Firebase, Amplitude, none)
• No behavioural fingerprinting. We do use a crash reporter (Sentry, EU region — Germany) to capture stack traces when the app or our backend throws unhandled errors. It sends the error message, stack, OS version, and app version — no IP address, no user identifier, no run data. See the sub-processors list below.
• No advertising ID, no IDFA, no IDFV
• No cross-app tracking — Apple App Tracking Transparency dialog is not required
• No marketing email — we never send you anything because we don't have your email

The route you generate

When you tap GENERATE LOOP, your phone sends 3 pieces of data to our backend :

• Your GPS position, rounded to 3 decimal places (~110 m precision) — not your exact location
• The requested distance (e.g. 5000 m)
• Your anonymous device UUID (for rate-limiting)

Our backend forwards those coordinates to OpenRouteService, a Heidelberg University project, which computes the route and sends it back. We cache route results for 7 days in a key-value store to save quota and improve latency — keyed by location bucket and distance, never by user.

The generated route is then sent back to your phone, and from that point on it lives only on your device.

What stays on your phone

Once the route reaches your phone, the following data is stored locally only, in your phone's AsyncStorage, and never uploaded anywhere :

• Your last 10 generated loops (history)
• Your saved favorites (unlimited)
• Your last run's GPS tracking (distance, duration, elevation profile)
• Your OSM POI cache for the zones you've been in
• Your Pro purchase receipt (validated locally by RevenueCat)

Run tracking is erased the moment you start a new run. We don't keep a history of your runs. We can't show you "your past activity" because we have no idea what your past activity is.

Apple HealthKit (opt-in, Pro feature)

If you enable "Save runs to Apple Health" in Settings (a Pro feature, off by default), RUNDR writes each completed run to Apple Health as a Workout. Specifically :

• Write — Workout (Running), with start/end timestamps and distance in meters
• Write — Walking + Running Distance (associated with the Workout above)
• Read — none. RUNDR never reads your existing Health data

This is special category data (health) under GDPR Article 9 and requires your explicit consent, given by the iOS Health permission prompt the first time you enable the feature. You can revoke this consent at any time via iOS Settings → Privacy & Security → Health → RUNDR → Turn Off All Categories.

HealthKit data lives on your iPhone (and Apple Watch if mirrored) under Apple's control, never on RUNDR servers.

How long we keep things

Server-side (Cloudflare Worker) :

• Anonymous device daily counter — purged automatically at UTC midnight (≤ 24 h)
• Anonymous source-IP daily counter (anti-farming) — purged automatically at UTC midnight (≤ 24 h)
• Cached route geometry (keyed by location bucket, not by user) — 7 days, then automatically purged
• Pro receipt token (opaque RevenueCat anonymous ID) — 1 year, refreshed on each app launch when Pro is active

On your device :

• Run history — last 10 loops (free) or unlimited (Pro), kept until you delete them or uninstall
• Favorites, settings, POI cache — kept until you delete them or uninstall
• Pro receipt — kept until you uninstall or restore on a new device

Third-party services we use

• Cloudflare Workers + KV — our backend infrastructure. They see the anonymous device UUID and the rounded GPS coordinates for the duration of one HTTP request. Cloudflare's privacy policy.
• OpenRouteService (Heidelberg University, Germany) — computes the actual route from coordinates. They see the rounded GPS coordinates, no user identifier. ORS privacy statement.
• OpenStreetMap (Overpass API) — public OSM data is queried directly from your phone to fetch points of interest in your zone. They see your IP address (standard HTTP) and your GPS bucket. OSM privacy.
• RevenueCat — manages your Pro purchase. They see the App Store receipt. RevenueCat privacy.
• Apple App Store — handles payment. Apple's privacy policy applies to the transaction.
• Sentry (Functional Software, Inc. — EU region, Germany at ingest.de.sentry.io) — captures stack traces on unhandled errors in the app or our Worker backend. They see the error message, stack trace, OS/device model, and app version. No IP address (we set sendDefaultPii: false), no user identifier, no run data. Sentry privacy.

We have no partnership, no data sharing, no advertising deal with any other entity.

International transfers

Some of our sub-processors are based outside the EU :

• Cloudflare (United States) — runs our backend Worker and KV stores. Transfers are covered by the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914) and the EU-US Data Privacy Framework where applicable.
• RevenueCat (United States) — manages Pro purchases. Transfers covered by the EU SCCs.
• Apple (United States) — App Store payments and HealthKit storage on your device. Transfers covered by Apple's DPA + EU SCCs.

OpenRouteService (Germany) and OpenStreetMap (Switzerland — adequacy decision) are EU-based ; no transfer outside the EU/EEA.

Your rights (GDPR Articles 15–22)

You have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data, and to withdraw your consent at any time (especially for HealthKit data). Since RUNDR is engineered to know almost nothing about you, most of these rights are exercised locally :

• Access — open the app, everything is on your device. To get a copy of what's on our backend (the anonymous daily counter), write to support@rundr.me with your device ID (copy it from Settings → Legal → Copy device ID).
• Erasure — uninstall the app (wipes local data) ; the anonymous server-side counter purges automatically within 24 h. For an earlier purge of the Pro receipt token, write to support@rundr.me.
• Portability — your saved loops can be exported as GPX files (Pro feature).
• Withdraw HealthKit consent — iOS Settings → Privacy & Security → Health → RUNDR.

For any request, we respond within 30 days (extendable by 60 days for complex requests, with notice), as required by GDPR Article 12(3).

You also have the right to lodge a complaint with your local supervisory authority — in France, the CNIL.

Children

RUNDR is not directed at children under 16 (GDPR Article 8) and does not knowingly collect any data from them. We don't collect data from anyone, so this should be obvious, but the legal world likes us to say it explicitly.

Changes to this policy

If we ever change this policy, we'll publish the new version with a new "Last updated" date and keep the old versions accessible. We will never change it in a way that broadens what we collect without an explicit, opt-in user prompt in the app.

Contact

Questions or concerns ? Write to support@rundr.me. We read every message.

Editor : Hadrien Hubert · Sole proprietorship DE.H.VS · France