Privacy Policy

Welcome to RunRun ("the App", "we", "our"). RunRun is a gamified running app that turns your workouts into a competitive, team-based experience. This Privacy Policy explains what personal data we collect, how we use it, and the choices you have regarding your information.

By downloading or using RunRun, you agree to the practices described in this policy. If you do not agree, please stop using the App and contact us to request deletion of your account.

1. Data We Collect

1.1 Account & Profile Information

• Display name and profile picture (from your Google account via Supabase Auth)
• Email address
• Team assignment (Red Bulls or White Bears)
• Account creation date

1.2 Health & Fitness Data (HealthKit / Health Connect)

On iOS, RunRun requests read-only access to Apple HealthKit for the following data type only:

• Running workout distance (kilometers per activity)

1.3 App Usage Data

• Sweat Currency ($SC) balance and transaction history
• Betting history (personal bets and pool bets)
• Leaderboard rankings and weekly running totals
• In-app purchase or shop activity (if applicable)

1.4 Device & Technical Data

• Device type and operating system version (for crash diagnostics)
• App version
• LINE user ID (if you connect LINE for push notifications)

2. How We Use Your Data

• Tracking your runs — converting kilometers into Sweat Currency ($SC) and updating your weekly stats
• Game mechanics — calculating weather bonuses, applying the weekly survival tax, resolving personal bets and pool bets
• Leaderboards & team scoring — displaying your stats on team and global leaderboards
• Push notifications — sending LINE messages about bet results, survival tax warnings, and weekly recaps
• Authentication & security — managing your login session via Supabase
• App improvement — diagnosing crashes and improving performance (no third-party analytics SDK is used)

We do not use your data for advertising, profiling, or any purpose beyond operating and improving RunRun.

3. Data Sharing

We do not sell, rent, or trade your personal data. Data is shared only in the following limited circumstances:

3.1 Service Providers

• Supabase — our backend database and authentication provider. Your profile and game data are stored on Supabase servers (hosted on AWS).
• LINE Messaging API — your LINE user ID is used solely to send you push notifications from RunRun. We do not share any other personal data with LINE.
• Vercel — our hosting platform. Request logs may be retained by Vercel for a short period for operational purposes.

3.2 Legal Requirements

We may disclose data if required by law, court order, or governmental authority, or when we believe disclosure is necessary to protect the safety of any person or to prevent fraud.

3.3 No Sale of Data

We do not sell personal data to any third party, including data brokers or advertising networks.

4. Apple HealthKit — Special Notice

5. Data Retention

We retain your account and game data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law or to resolve outstanding disputes.

• Running activity records (distance per day) are retained indefinitely while your account is active, as they determine your all-time stats
• Betting history is retained for the duration of your account
• Server access logs (Vercel) are typically retained for up to 30 days

6. Your Rights

Regardless of where you are located, you have the following rights regarding your personal data:

• Access — request a copy of the personal data we hold about you
• Correction — ask us to correct inaccurate data
• Deletion — request deletion of your account and all associated personal data
• Data portability — request an export of your running history and game data in JSON format
• Revoke Health access — remove RunRun's access to Apple Health or Health Connect at any time in your device Settings

To exercise any of these rights, contact us at the email address below. We will respond within 30 days.

7. Children's Privacy

RunRun is not directed at children under the age of 13 (or 16 in the EU). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us immediately and we will delete it.

8. Security

We take reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS/TLS), Supabase row-level security policies, and limited employee access. However, no system is completely secure, and we cannot guarantee absolute security.

9. Updates to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, send a notification via LINE or email. Continued use of the App after changes become effective constitutes your acceptance of the revised policy.

10. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact: