Privacy Policy

This Privacy Policy explains how Runked ("we", "us", or "our") collects, uses, shares, and protects your information when you use the Runked mobile application and the website at runked.com (collectively, the "Service").

By using Runked, you agree to the collection and use of information in accordance with this policy.

1. What Information We Collect

a. Account Data When you create an account, we collect information such as your name/username, email address, avatar or profile details, age, gender, user preferences, and privacy settings. You may authenticate using Apple Sign-In, Google Sign-In, or email and password.

b. Activity & Fitness Data When you use the app to track your fitness, we collect the data you generate or log directly within Runked, including: activity type, duration, distance, pace, elevation gain, GPS route (stored as an encoded polyline), device name, performance points, training stress scores, streaks, and related metrics.

c. Location Data When you use the Run feature, we collect your precise GPS location in the foreground and background for the duration of the tracked activity. This data is used solely to record your running route and is stored as part of the activity. We do not track your location outside of active run tracking.

d. Data from Third-Party Fitness Services (Optional) You may choose to connect one or more third-party services to your Runked account. We only access data from these services with your explicit consent and for the purposes described in this policy.

Garmin Connect: If you connect your Garmin account via OAuth, we store your access and refresh tokens securely on our servers. We access your activity details (duration, pace, distance, elevation, GPS routes, splits, and device name). Garmin pushes new activities to us automatically via webhooks. Disconnecting Garmin in the app removes your tokens from our servers, but does not revoke authorization on Garmin's servers. To fully revoke access, you should also remove Runked from your Garmin Connect third-party apps.
Apple Health (HealthKit): If you grant permission, we read workout data (running distance, duration, elevation, energy burned) from Apple Health. We may also write Runked-tracked workouts back to your Apple Health store. We only access the specific data types you authorize. Apple Health data syncs on-device and is uploaded to our servers for processing.

e. Camera & Photos If you choose to upload a profile picture or attach photos to an activity, we request access to your camera or photo library. These images are stored on our servers. We do not access your camera or photo library for any other purpose.

f. Push Notification Data If you enable push notifications, we collect and store your device token (provided by Apple Push Notification service) to send you alerts about activity updates, achievements, and league results. You can disable push notifications at any time in your iOS Settings. Stale or invalid device tokens are automatically deleted from our servers.

g. Subscription & Payment Data Subscriptions are processed through the Apple App Store and managed by RevenueCat, our subscription platform provider. We receive and store subscription event data including: event type (purchase, renewal, cancellation, expiration), product identifier, purchase date, price, and country/region. We do not have access to your payment card details. If you used a partner or promotional code, we store the referral source for attribution purposes.

h. Usage and Device Data We automatically collect technical information about how you interact with our app, such as crash logs, diagnostic data, device and operating system information, IP address, general location derived from your IP, and timestamps.

i. Content You Share We collect information you voluntarily share through social features within the app, such as activity captions, reactions, and profile information.

2. How We Use Your Information

We use the information we collect for the following purposes:

To Provide and Maintain the Service: To authenticate you, manage your account, and operate all app features including activity tracking, training plans, leagues, and the store.
To Sync Your Fitness Data: To sync, process, and display the data you authorize from Garmin Connect or Apple Health.
For Rankings & Leaderboards: To calculate your ranking points and training metrics (such as CTL, ATL, TSB, and ACWR) from your activity data and display your position on leaderboards, subject to your visibility settings.
To Generate Training Plans: To create personalized training plans using established running science algorithms (such as Jack Daniels VDOT formulas) based on your fitness data, goals, and preferences. Training plans are generated by deterministic algorithms, not artificial intelligence.
To Send Notifications: To deliver push notifications about activity confirmations, achievements, league updates, and other Service-related alerts.
To Process Subscriptions: To manage your Runked PRO subscription status, process promotional codes, and track partner referrals.
To Personalize and Improve the Service: To analyze usage patterns to improve features and enhance the user experience.
For Safety and Security: To prevent abuse, detect fraudulent activity, secure our systems, and protect the rights and safety of our users.
To Comply with Legal Obligations: To fulfill our legal requirements and enforce our terms of service.

3. Third-Party Fitness Integrations

Your control over your data is a priority. Our integration with Garmin Connect and Apple Health follows these principles:

Optional & Consent-Based: All integrations are entirely optional. We will not access any data from these services without your explicit authorization.
Purpose Limitation: Data obtained from these services is used solely to provide and improve the core functionality of the Runked app.
Revoking Access: You can disconnect any third-party service from your Runked account at any time through the app's settings. This will stop any future data synchronization from that service. For Garmin, we recommend also revoking access in your Garmin Connect third-party app settings for complete disconnection.
Platform-Specific Rules: Your data on these platforms is also subject to their respective privacy policies and terms.
Apple HealthKit Restriction: Data accessed from Apple HealthKit is used exclusively to provide health and fitness functionality within Runked. This data is never used for marketing, advertising, data-mining, or shared with third-party data brokers.

4. When We Share Your Data

We do not sell your personal information. We only share data in the following limited circumstances:

With Service Providers: We use third-party service providers to operate the Service. These include:
- Supabase - database, authentication, file storage, and server-side functions (hosted in the EU).
- RevenueCat - subscription and in-app purchase management.
- Apple Push Notification service (APNs) - push notification delivery.
- Google - authentication (if you use Google Sign-In).
- Apple - authentication (if you use Apple Sign-In) and App Store payment processing.
These providers are contractually bound to use your data only to provide services to us.
With Your Explicit Direction: When you use features to share your activities on the social feed or appear on leaderboards (subject to your visibility settings).
For Legal or Compliance Reasons: If we believe it is reasonably necessary to comply with a law, enforce our terms, or protect the rights, property, and safety of Runked or our users.
In a Business Transfer: If Runked is involved in a merger, acquisition, or asset sale, your data may be transferred as part of that transaction.

5. Data Hosting and Processing

We use Supabase for our database, authentication, storage, and server-side functions. Your data is hosted in Supabase's Europe (EU) region. Supabase's infrastructure runs on Amazon Web Services (AWS). Subscription data is processed by RevenueCat, which may process data in the United States.

6. Leaderboards and Visibility Controls

User profiles are private by default. You can control the visibility of your profile, your appearance on public leaderboards, the visibility of individual activity posts (public or private), and whether your route maps are displayed. All of these settings can be changed at any time in the app.

7. Your Choices and Rights

You have the right to manage your personal data. You can:

Access & Portability: Request a copy of your personal data.
Correction: Update or correct your account information directly in the app.
Deletion: Delete specific activities within the app, or delete your entire account and all associated data from Account Settings.
Object or Restrict: Object to or request the restriction of certain data processing activities.
Withdraw Consent: Revoke permissions you have granted for any third-party integration, push notifications, or optional feature at any time.
Notification Opt-Out: Disable push notifications through your iOS Settings at any time.

To exercise these rights, please contact us at: [email protected]

8. Data Retention

We retain your data for as long as your account is active or as needed to provide you with the Service.

Account & Activity Data: Retained until you delete your account or individual activities.
Subscription & Payment Records: Retained for up to 7 years after your last transaction for tax, legal, and compliance purposes.
Device Tokens: Automatically deleted when they become invalid or when you delete your account.
Garmin Tokens: Deleted immediately when you disconnect Garmin in the app.

When you delete your account, all personal data, activities, and profile information are permanently removed. Aggregate, anonymized statistics (such as historical leaderboard totals) may persist.

9. Security

We implement reasonable technical and organizational measures to protect your data, including encryption in transit and at rest, row-level security policies on our database, and secure token storage. However, no method of transmission or storage is 100% secure.

10. International Transfers

Your data is primarily hosted in the European Union. However, some of our service providers (such as RevenueCat and Apple) may process data in the United States or other countries. In such cases, we ensure that appropriate safeguards, such as Standard Contractual Clauses, are in place to protect your data.

11. Children's Privacy

Runked is not directed to children under the age of 16. We do not knowingly collect personal data from children under this age. If you believe a child under 16 has provided us with personal data, please contact us and we will promptly delete it.

12. U.S. State Privacy Rights

If you are a resident of California, Virginia, Colorado, Connecticut, or another U.S. state with applicable privacy legislation, you may have additional rights including:

The right to know what personal information we collect and how it is used.
The right to request deletion of your personal information.
The right to opt out of the "sale" of personal information. We do not sell your personal information.
The right to non-discrimination for exercising your privacy rights.

To exercise these rights, contact us at [email protected].

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or by email. The "Effective Date" at the top indicates when it was last revised.

14. Contact Us

If you have any questions or concerns about this Privacy Policy, please contact us:

Runked
Attn: Oktay Kurt
Website: runked.com
Email: [email protected]
Support: [email protected]

Apple, the Apple logo, and iPhone are trademarks of Apple Inc., registered in the U.S. and other countries.