Privacy Policy
Effective September 6, 2026
Runwalk (the “Service”) processes only the information needed to provide walking and running records, courses, and features for exercising with friends. Health data is neither used for advertising nor sold.
1. Information We Process
| Category | Information and how we use it |
|---|---|
| Account and profile | Apple or email login identifiers, email address, sign-up date, nickname, Runwalk ID, and a selected profile photo are used for login, synchronization, and friend features. |
| Workout and health | Runwalk uses workout type, time, distance, route, heart rate, cadence, step count, and active energy on the device to provide records and workout metrics. Regardless of whether the user has an account, the server stores only workout type, timestamp, distance, duration, and whether route data exists in an activity summary; the summary does not include heart rate, raw health data, or body information. Sex and date of birth are required profile information for Runwalk's core workout features. The exact date of birth is used only on the device to calculate age, estimated maximum heart rate, and heart-rate zones; sex selects men's or women's running-tier standards; and weight is used on the device to estimate calories. Height is stored on the device as part of Body Profile. When an installation is upgraded to a version containing this feature, a user whose completed-onboarding state remains on that installation is excluded from collection: the app does not ask for consent or send the previously stored sex, date of birth, or consent record to the server. The server also rejects demographic-storage requests for authenticated user IDs created before the new collection policy was activated on the server. If the app is installed from scratch after deletion or started on a new device and cannot yet find the previous onboarding-completion state or existing authenticated user ID, it may show the new onboarding flow and consent screen. New-onboarding users must provide the mandatory-processing consent when creating their profile and nickname. For a consenting new-onboarding user, the app sends the sex code, birth year, version of the mandatory-processing consent notice, and a random consent receipt ID (consent_receipt_id) for distinguishing retries together with an authenticated random-anonymous or signed-in user identifier. The server stores these items and records the receipt time as the consent timestamp. The consent receipt ID is the idempotency key that prevents a retried request from creating a duplicate consent record. The sex code and birth year are used for aggregate user-composition statistics and service operations, while the consent version, server-recorded timestamp, and consent receipt ID are used to verify the required-profile-information processing consent record and deduplicate retries. The exact date of birth, exact age, height, and weight are not stored on the server. |
| Location | Precise location during an activity is used to calculate distance, pace, and routes and to show weather and provide course features. Precise routes from activities recorded with location access are stored on the server to aggregate roads frequently used by Runwalk users and generate activity-density data appropriate for each map zoom level. Names, heart rate, pace, calories, and photos are not included in heatmap route data. |
| Friends and group workouts | Friend connections, activity summaries, room participation, invitations, and the latest location and voice connection status shared during group workouts are used to provide social features. |
| Fan Run | Fan Run names, cover images, membership relationships, distance from selected activities, monthly and all-time rankings, and creation and report records are used to operate Fan Runs and provide distance leaderboards. |
| Device and usage information | The time of the first launch after installation, app version, operating system, device type, language selected in the app, App Store storefront country, time zone, screen and feature usage events, and push token are used to measure installations, operate the Service by country and language, keep the Service stable, analyze feature use, and send notifications. The storefront country is not treated as a residence or current location. Before sign-in, usage is associated with a random anonymous session that contains no email address, name, or advertising identifier. First-launch metrics do not include account or location data. |
2. Storage Location and Sharing
- Detailed workout records and user-created courses are stored on the iPhone by default and may be stored in iCloud if the user enables synchronization with their Apple Account.
- If the user allows integration with the Apple Health app, workout data is read from or saved to the Apple Health app. Permissions can be changed at any time in Settings on iPhone or in the Apple Health app.
- Friends can see only the profile, activity summaries, online status, and information needed for group workouts that the user has chosen to share.
- Active Fan Run names, cover images, member information, and monthly and all-time distance rankings are shown to signed-in users. Users can report inappropriate cover images.
- The community activity map displays only density aggregated from the precise routes of multiple users and does not disclose an individual’s full route or account identifier to other users.
- Before sign-in, activity summaries and route segments are linked to a random anonymous user identifier. For a consenting user in the new-onboarding cohort, the sex code, birth year, version of the mandatory-processing consent notice, server-recorded consent timestamp, and random consent receipt ID are linked to the same identifier. If the user signs in later, duplicates are removed, the data is merged into that account’s records, and the previous anonymous authentication information is deleted.
- Photos used to edit activity images are processed on the device and are not uploaded to the Runwalk server unless the user sends them directly using the iOS sharing feature. Profile photos are an exception and are stored on the server.
3. Service Providers
- Apple: Sign in with Apple, iCloud, Apple Health app integration, WeatherKit, push notifications, and maps
- Supabase: Authentication, database, profile photo and Fan Run cover image storage, and server functions
- LiveKit: Real-time voice communication while exercising together. Runwalk does not record or store voice content.
- Open-Meteo: Weather and air-quality lookup around the current location when WeatherKit is unavailable
4. Retention and Deletion
Information is retained while the Service is provided and deleted when the user deletes an activity or account, or when the purpose for retaining it ends. Deleting an activity also deletes the associated server activity summary and heatmap route segments. If retention is required by law, the information may be stored separately for the required period. In Settings → Account → Delete Account, signed-in users can permanently delete their server account, profile, any collected sex code, birth year, mandatory-processing consent version, server-recorded timestamp, random consent receipt ID, friend connections, shared activities, and route segments sent to the server. This full account deletion is separate from deleting required information and withdrawing consent in Body Profile. Records stored on the iPhone, in iCloud, or in the Apple Health app are managed separately through the corresponding apps and settings.
5. User Choices and Rights
In Body Profile, users can correct their date of birth and sex. They can also edit their profile, delete activity records, and change location, health, photo, microphone, and notification permissions. Users who go through the new onboarding flow must consent to the provision and processing of required profile information when creating their profile and nickname; without consent, they cannot complete onboarding or begin using the app. When an installation is upgraded to a version containing this feature, a user whose completed-onboarding state remains on that installation is excluded from collection: the app does not show the consent screen or send their sex, birth year, or consent record to the server. After a completely fresh installation, the app may show the consent screen even to an existing user until it can find the previous state or existing authenticated user ID. The server rejects demographic-storage requests for authenticated user IDs created before the new collection policy was activated on the server. Whether signed in or not, users subject to the collection can delete the required information and consent record and withdraw consent in Settings → Body Profile → “Delete Required Information and Withdraw Consent.” After withdrawal, the app remains unavailable until the user consents again and enters the required information. For signed-in users, Settings → Account → Delete Account is a separate option that deletes the entire account. Requests to access, correct, or delete personal information and questions about its processing can be sent to the email address below.
6. Safeguards and Changes
We use encryption in transit, access controls, and least-privilege policies. If this policy changes materially, we will provide notice in the app or on this page before the change takes effect.