Runapt

Legal

Privacy Policy

Effective date: July 16, 2026

1. Who we are

Runapt ("we", "us", or "our") operates the Runapt mobile application and website at runapt.com. We are the data controller responsible for your personal information under applicable privacy law.

If you have questions or concerns about this policy or our practices with regard to your personal information, please contact us at legal@runapt.com.

2. What information we collect

Information you provide to us

  • Account data: name, email address, and password (stored as a bcrypt hash). If you choose Sign in with Apple, we receive the identifier and email address (or private relay email) Apple provides. If you enable a passkey or two-factor authentication (2FA), we store the passkey's public key credential or your TOTP secret and backup codes to secure your account — we never see or store your biometric data itself, which stays on your device under Apple/Google's control.
  • Runner profile: optional fitness details (age, weight, heart-rate zones, training background) and daily check-in wellness logs (subjective fatigue, soreness, and stress). These are cached on your device and synced to our servers when you save them, so we can generate training plans, coaching notes, and readiness metrics.
  • Run data: GPS coordinates, distance, duration, pace, heart rate, and strength training workout completion records.
  • Plan data: race goals, training preferences, and workout completion records.

Information collected automatically

  • Device data: device type, OS version, and app version for crash reporting.
  • Location: GPS coordinates during active runs and for loop route generation from your start point. We do not track your location in the background except during an active workout. You can configure up to 5 custom Route Privacy Zones (e.g., Home or Work) in the app to clip/mask your GPS coordinates on shared runs, activity exports, or synced third-party platforms.
  • Push token: an Expo push notification token to deliver run reminders (stored until you disable notifications or uninstall the app).
  • Error and crash data: sent to Sentry to help us fix bugs. No personally identifiable data is included.

Information from third parties

  • Apple HealthKit: if you grant permission, we read sleep, resting heart rate, and HRV data from HealthKit to support recovery tracking. Runapt can also write completed workouts and route data to HealthKit after a run so your Apple Health activity history stays complete. We will never use HealthKit data for advertising, marketing, or share it with third parties for any purpose other than providing the Runapt service to you.
  • Strava and Garmin: completed activity data (distance, pace, route, heart rate) if you connect your account, used only to import that activity into Runapt. These integrations are import-only — we never post or write data back to Strava or Garmin on your behalf.
  • Spotify: if you enable in-run playback controls, we use Spotify's App Remote SDK to control playback on your device and, via a short-lived authorisation token, start/resume/pause your music during a run. We do not access your playlists, listening history, or account data beyond what is needed to control playback.
  • RevenueCat: subscription status and purchase events for Pro plan management.

3. How we use your information

  • To create and manage your account.
  • To generate personalised training plans, adaptive coaching notes, and AI coach chat replies using third-party large language models accessed via OpenRouter (we may route requests to providers such as Google, OpenAI, Anthropic, or others depending on the model in use).
  • To generate loop running routes based on your GPS location and workout distance.
  • To adjust pace targets and workout guidance for current weather, using your run location's coordinates to fetch a forecast. No account or device identifier is sent with this request.
  • To send run reminder push notifications (you can disable these in your device settings or in the app).
  • To process subscription payments via RevenueCat and Apple/Google in-app purchase systems.
  • To diagnose bugs and improve the product via aggregated, anonymised crash data.
  • To comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data for advertising.

For AI coach chat, we send only the training context needed to answer your question, such as active plan type, current week, recent aggregate progress, upcoming workout type, distance, and target pace. We do not send your name, email address, user ID, GPS route geometry, race location, or free-text run notes as coach context.

4. Lawful basis for processing (GDPR)

If you are located in the European Economic Area (EEA), we process your personal data on the following legal bases:

  • Performance of a contract: processing your account data, run data, and plan data is necessary to provide the Runapt service you have signed up for.
  • Consent: accessing HealthKit data, sending push notifications, and processing optional runner profile details. You may withdraw consent at any time via your device settings or by contacting us.
  • Legitimate interests: collecting anonymised crash and error data to maintain service quality and security. These interests do not override your privacy rights.
  • Legal obligation: where we are required to process or retain data to comply with applicable law.

5. Data sharing

We share data only with the service providers necessary to operate Runapt:

  • OpenRouter: AI routing platform for coaching notes, coach chat replies, weekly training digests, and related AI features. OpenRouter may forward your request (and the limited training context we include) to the underlying model provider we select (for example Google, OpenAI, or Anthropic). We send only the training context needed for the feature; we do not send your name, email, or full GPS route geometry as coach context.
  • Google: Google Maps for map display on Android. If a Google model is selected via OpenRouter, limited coaching context may also be processed by Google under OpenRouter's terms.
  • RevenueCat: subscription management.
  • Sentry: anonymised crash and error reports.
  • Expo: push notification delivery.
  • Open-Meteo: run-location coordinates only, to fetch weather forecasts used to adjust pace guidance.
  • Strava, Garmin, and Spotify: only if you connect these integrations yourself, as described in Section 2.
  • Google Analytics: aggregate, cookie-based visit statistics for the Runapt marketing website (runapt.com) only — never inside the mobile app — and only after you accept our cookie banner. See Section 7.

All providers are contractually required to process data only on our behalf and in accordance with our instructions.

6. International data transfers

Our service providers — including OpenRouter, Google, Sentry, Expo, and RevenueCat — are based in the United States (and underlying AI model providers may process data in additional regions depending on the model selected). When we transfer personal data from the EEA to these providers, we do so under Standard Contractual Clauses (SCCs) approved by the European Commission, or under another recognised transfer mechanism, to ensure your data receives an adequate level of protection.

By using Runapt, you acknowledge that your data may be transferred to and processed in countries outside your country of residence.

7. Cookies and similar technologies

The Runapt mobile app does not use cookies. The Runapt marketing website (runapt.com) uses technically necessary cookies required to serve the site, plus Google Analytics to understand aggregate visit statistics — but only after you accept the cookie banner shown on your first visit. If you decline, or before you make a choice, no analytics cookie is set and no data is sent to Google Analytics. You can withdraw or change your choice at any time via the "Cookie preferences" link in the site footer. We do not use advertising cookies, third-party tracking pixels, or cross-site analytics.

8. Data retention

We retain your account and run data for as long as your account is active. If you delete your account, all your personal data — including runs, plans, and profile information — is permanently deleted within 30 days. Anonymised, aggregated usage statistics may be retained indefinitely.

9. Your rights

Depending on your location, you may have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate personal data.
  • Request deletion of your personal data (you can do this directly in the app under Profile → Delete account).
  • Delete GPS map data selectively from all your logged runs directly in-app, while retaining key statistics like distance, pace, time, and heart rate.
  • Inspect and manage connected integrations and view their privacy scores in the Data Vault.
  • Object to or restrict certain processing.
  • Data portability — receive a copy of your data in JSON format.
  • Withdraw consent at any time where processing is based on consent, without affecting the lawfulness of prior processing.
  • Lodge a complaint with your national data protection authority. In the Netherlands, this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

California residents (CCPA)

If you are a California resident, you have the right to: know what personal information we collect and how it is used; request deletion of your personal information; and non-discrimination for exercising your privacy rights. We do not sell personal information. To exercise your rights, contact us at legal@runapt.com.

To exercise any of these rights, email legal@runapt.com. We will respond within 30 days.

10. Children

Runapt is not intended for children under 13 (or under 16 in jurisdictions where a higher age threshold applies under local law, including certain EU member states). We do not knowingly collect personal information from children below the applicable age. If you believe we have inadvertently collected such data, please contact us immediately and we will delete it.

11. Security

We use industry-standard security measures including bcrypt password hashing, HTTPS-only communication, and JWT authentication. No method of transmission over the internet is 100% secure — we cannot guarantee absolute security but we take every reasonable precaution to protect your data.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the effective date at the top of this page. If changes are material, we will notify you via email or an in-app notice at least 14 days before the changes take effect. Continued use of Runapt after the effective date constitutes acceptance of the updated policy.

13. Company information & Contact

Runapt is a service provided by Voscey. For privacy-related questions, requests, or complaints, contact us using the details below:

  • Company Name: Voscey
  • Registered Address: Herenweg 146, 3648CN Wilnis, The Netherlands
  • Chamber of Commerce (KVK): 99994070
  • VAT ID (BTW): NL005423874B69
  • Email: legal@runapt.com
Start free