Privacy policy

1. Data controller

Contact: contact@runtgt.com

2. Data we collect

• Account: first name, last name, photo, email (Google or Apple sign-in, possibly an Apple relay address), Strava, Google or Apple ID, city, gender, level, bio, language.
• Strava (if you sign in with Strava): access tokens, your list of clubs, and a summary of your runs from the last 90 days (pace, distance, elevation, day, time and start point), cached for 12 hours. When you complete a run, we read your activities around its start time (to check the run happened before awarding XP: time, start point and distance) and add a “Ran with RunTogether” line to the matching activity’s description (can be turned off in your profile).
• Activity: runs created and joined, waitlists, confirmations, XP, badges, runners you follow, chat messages and when you last read them, chosen reminders, reviews and stars given and received, search alerts (place, radius, pace, days), blocked people, reports of runs and people, chosen pace group, check-ins (time, method) and last-minute cancellations, referral (code, referrer).
• Pro accounts: the organization’s name, type, description, logo, website and city.
• Notifications: your phone’s notification ID (Expo token), your browser’s notification subscription if you turn them on (technical address given by the browser and encryption keys), and notification history.
• Check-in: if you check in with your position, it is only used to verify you are within 300 m of the meeting point and is not stored.
• Location: your position is used to search nearby runs and place a meeting point, it is sent when searching but not stored. Runs’ meeting points are public.

3. Why we use it

• Provide the service (contract): account, runs, chat, reminders, XP, badges, pro accounts.
• Personalize the app (legitimate interest): prefill your runs, suggest a level and runners to follow.
• Keep the community safe and trustworthy (legitimate interest): reviews and stars, blocking, reports, moderation and account suspension.
• Notify you when someone you follow creates or joins a public run, when a run matches your alerts, when a run you joined changes or is cancelled, when you get a spot from the waitlist, and for new messages (can be turned off in your profile).

We don’t sell your data and don’t do targeted advertising. Your Strava data is never shown to other users, apart from the line added to your own Strava activity.

4. What other users see

Your first name, last name initial, photo, city, level, XP, leaderboard rank, attendance rate (when enabled, from 3 runs), badges and group run statistics, the average stars you received (from 3 ratings), plus the public runs you organize, your review comments and your messages in the chats of the runs you join. The stars you give someone, your blocks, reports and alerts are shown to no one.

Following a runner is discreet: the person you follow isn’t told, and nobody sees who follows you, who you follow or how many. In return, the people who follow you are notified when you create or join a public run (never a private one). Blocking someone also ends their follow.

5. Service providers

• Strava, Google and Apple: signing in to your account (under their own privacy policies). For Apple, we also keep a token that lets us revoke access when you delete your account.
• Expo (United States): sending the app’s push notifications.
• Your browser’s push service (Google, Mozilla, Apple… depending on the browser): delivering the website’s notifications, if you turn them on.
• OpenStreetMap (map tiles) and Nominatim (address search): these services receive your IP address and the area viewed.

Transfers outside the European Union are covered by the safeguards required by the GDPR (adequacy decision or standard contractual clauses).

6. Retention

Your data is kept while your account is active. When you delete your account from your profile, it is erased immediately (unless the law requires us to keep it). An account inactive for 3 years is deleted after a warning message. The summary of your Strava runs is recomputed every 12 hours.

7. Cookies and local storage

We use no advertising cookies and no analytics. The website only stores your sign-in session, your language (“rt_locale” cookie) and your layout preference, which are needed for it to work: so no consent is asked.

8. Your rights

You can access, correct and delete your data, object to some processing, restrict it and get a copy (portability) by emailing contact@runtgt.com. You can edit your information and delete your account directly in your profile, and revoke RunTogether’s access to your Strava account in Strava’s settings.

If you believe your rights are not respected, you can complain to the CNIL (www.cnil.fr) or your local data protection authority.

9. Security

Traffic is encrypted (HTTPS), access to data is restricted, and Strava tokens are never sent back to the apps.