Privacy Policy

Deutsche Fassung

Preamble

With the following privacy policy, we would like to inform you about which types of your personal data (hereinafter also referred to as "data" for short) we process, for which purposes and to what extent. This privacy policy applies to all processing of personal data carried out by us, both in the course of providing our services and in particular on our website getruntime.de and in our mobile application "Runtime" for iOS and Android (hereinafter collectively referred to as "online services").

The terms used are not gender-specific.

Controller

LA Digital Ventures UG (haftungsbeschränkt) Altensteinstraße 40 14195 Berlin, Germany

Authorised representatives: Luca Anzaldo, managing director

Email address: hallo@getruntime.de

Legal notice: https://getruntime.de/impressum.html

Overview of processing

The following overview summarises the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed

• Master data.
• Contact data.
• Content data.
• Contract data.
• Usage data.
• Location data.
• Meta, communication and process data.
• Log data.

Categories of data subjects

• Users.
• Prospective users.
• Communication partners.
• Third parties.

Purposes of processing

• Provision of contractual services and fulfilment of contractual obligations.
• Communication.
• Security measures.
• Organisational and administrative procedures.
• Feedback.
• Reach measurement and error analysis.
• Provision of our online services and user-friendliness.
• Information technology infrastructure.

Relevant legal bases

Relevant legal bases under the GDPR: Below you will find an overview of the legal bases of the GDPR on which we process personal data. Please note that, in addition to the provisions of the GDPR, national data protection requirements may apply in your or our country of residence or registered office. Should more specific legal bases be relevant in individual cases, we will inform you of these in this privacy policy.

• Consent (Art. 6(1)(a) GDPR) – The data subject has given consent to the processing of personal data concerning them for one or more specific purposes.
• Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR) – The processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
• Legal obligation (Art. 6(1)(c) GDPR) – The processing is necessary for compliance with a legal obligation to which the controller is subject.
• Legitimate interests (Art. 6(1)(f) GDPR) – The processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, provided that the interests or fundamental rights and freedoms of the data subject which require protection of personal data do not override them.

Storing and accessing information on terminal equipment (§ 25 TDDDG (German Telecommunications Digital Services Data Protection Act)): We only store or access information on your device if this is strictly necessary for a service you have explicitly requested (e.g. signing in to the app) or if you have given your consent (analytics, see "Usage analytics with PostHog").

National data protection regulations in Germany: In addition to the data protection provisions of the GDPR, national data protection regulations apply in Germany. These include in particular the BDSG (German Federal Data Protection Act). The BDSG contains in particular special provisions on the right of access, the right to erasure, the right to object, the processing of special categories of personal data, processing for other purposes and transmission, as well as automated individual decision-making, including profiling. Furthermore, the data protection laws of the individual federal states may apply.

Security measures

In accordance with the legal requirements, and taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, we take appropriate technical and organisational measures to ensure a level of security appropriate to the risk.

These measures include in particular safeguarding the confidentiality, integrity and availability of data by controlling physical and electronic access to the data, as well as access to, input, disclosure, securing the availability and separation of the data. Furthermore, we have established procedures that ensure the exercise of data subjects' rights, the erasure of data and responses to threats to the data. In addition, we take the protection of personal data into account as early as the development or selection of hardware, software and procedures, in accordance with the principle of data protection by design and by default. In the app this means, among other things: the server itself checks on every request who may see which data, not the app; new runs are visible to no one unless you make a choice.

Securing online connections with TLS/SSL encryption technology (HTTPS): To protect users' data transmitted via our online services from unauthorised access, we use TLS/SSL encryption technology. These technologies encrypt the information transmitted between the website or app and the user's device (or between two servers), thereby protecting the data from unauthorised access. The website and the app communicate exclusively in encrypted form.

Transfer of personal data

In the course of our processing of personal data, it may happen that the data is transferred or disclosed to other bodies, companies, legally independent organisational units or persons. Recipients of this data may include, for example, service providers commissioned with IT tasks. In such cases, we comply with the legal requirements and in particular conclude appropriate contracts or agreements with the recipients of your data that serve to protect your data. The service providers we use are listed in the section "Services used". We do not sell any data and do not pass it on for advertising purposes.

International data transfers

Data processing in third countries: If we transfer data to a third country (i.e. outside the European Union (EU) or the European Economic Area (EEA)), or if this happens in the course of using third-party services or disclosing or transferring data to other persons, bodies or companies (which can be recognised from the postal address of the respective provider or where the privacy policy expressly refers to data transfers to third countries), this is always done in accordance with the legal requirements.

For data transfers to the USA, we rely primarily on the Data Privacy Framework (DPF), which was recognised as a secure legal framework by an adequacy decision of the European Commission of 10 July 2023. In addition, we have concluded standard contractual clauses with the respective providers that comply with the requirements of the European Commission and set out contractual obligations to protect your data.

This twofold safeguard ensures comprehensive protection of your data: the DPF forms the primary level of protection, while the standard contractual clauses serve as additional security. Should changes occur within the framework of the DPF, the standard contractual clauses act as a reliable fallback.

For each service provider, we inform you whether it is certified under the DPF and whether standard contractual clauses are in place. Further information on the DPF and a list of certified companies can be found on the website of the US Department of Commerce at https://www.dataprivacyframework.gov/ (in English).

For data transfers to other third countries, corresponding safeguards apply, in particular standard contractual clauses, explicit consent or transfers required by law. Information on third-country transfers and applicable adequacy decisions can be found in the information provided by the European Commission: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection_en?prefLang=de.

General information on data retention and deletion

We delete personal data that we process in accordance with the legal provisions as soon as the underlying consents are withdrawn or there are no further legal bases for the processing. This applies to cases in which the original purpose of processing no longer applies or the data is no longer needed. Exceptions to this rule exist where legal obligations or special interests require longer retention or archiving of the data.

In particular, data that must be retained for commercial or tax law reasons, or whose storage is necessary for legal prosecution or to protect the rights of other natural or legal persons, must be archived accordingly.

Our privacy notices contain additional information on the retention and deletion of data that applies specifically to certain processing operations.

Where there are several statements on the retention period or deletion deadlines for a piece of data, the longest period always prevails. Data that is no longer retained for its originally intended purpose but due to legal requirements or other reasons is processed by us exclusively for the reasons that justify its retention.

Retention and deletion of data: The following general periods apply to retention and archiving under German law:

• 10 years – Retention period for books and records, annual financial statements, inventories, management reports, opening balance sheet and the work instructions and other organisational documents required to understand them (§ 147(1) no. 1 in conjunction with (3) AO (German Fiscal Code), § 257(1) no. 1 in conjunction with (4) HGB (German Commercial Code)).
• 8 years – Accounting vouchers, such as invoices and expense receipts (§ 147(1) nos. 4 and 4a in conjunction with (3) sentence 1 AO, § 14b(1) UStG (German Value Added Tax Act) and § 257(1) no. 4 in conjunction with (4) HGB).
• 6 years – Other business documents: commercial or business letters received, copies of commercial or business letters sent, other documents insofar as they are relevant for taxation (§ 147(1) nos. 2, 3, 5 in conjunction with (3) AO, § 257(1) nos. 2 and 3 in conjunction with (4) HGB).
• 3 years – Data required to take into account potential warranty and damages claims or similar contractual claims and rights, and to process related enquiries, is stored for the duration of the regular statutory limitation period of three years (§§ 195, 199 BGB (German Civil Code)).

Periods beginning at the end of the year: If a period does not expressly begin on a specific date and is at least one year long, it automatically starts at the end of the calendar year in which the event triggering the period occurred. In the case of ongoing contractual relationships in the course of which data is stored, the event triggering the period is the time at which the termination or other ending of the legal relationship takes effect.

Rights of data subjects

Rights of data subjects under the GDPR: As a data subject, you are entitled to various rights under the GDPR, arising in particular from Arts. 15 to 21 GDPR:

• Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR; this also applies to profiling based on these provisions. Where personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to the processing of personal data concerning you for such marketing; this also applies to profiling to the extent that it is related to such direct marketing.
• Right to withdraw consent: You have the right to withdraw any consent you have given at any time.
• Right of access: You have the right to obtain confirmation as to whether data concerning you is being processed and to access this data as well as further information and a copy of the data in accordance with the legal requirements.
• Right to rectification: In accordance with the legal requirements, you have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
• Right to erasure and restriction of processing: In accordance with the legal requirements, you have the right to request that data concerning you be erased without undue delay or, alternatively, in accordance with the legal requirements, to request a restriction of the processing of the data. You can delete your account yourself in the app at any time (see "Deleting your account").
• Right to data portability: You have the right to receive data concerning you that you have provided to us in a structured, commonly used and machine-readable format in accordance with the legal requirements, or to request its transmission to another controller.
• Complaint to a supervisory authority: Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a data protection supervisory authority if you consider that the processing of your personal data infringes the GDPR. The complaint may be lodged in particular with a supervisory authority in the Member State of your habitual residence, your place of work or the place of the alleged infringement.

You can exercise your rights by email to hallo@getruntime.de; for your account, ideally from the email address you sign in with.

Business services

We process personal data of our contractual partners, i.e. the users of the app, for the initiation, performance and handling of the user agreement under our terms of use. This also includes communication in connection with the contractual relationship.

The processing serves in particular to fulfil our primary and ancillary contractual obligations. These include the provision of the agreed services, any obligations to update and inform, the handling of service disruptions and the handling of other contract-related declarations and requests. The app is free of charge; we currently do not process any payment data.

In addition, we process the data to safeguard our rights and to comply with legal obligations, for example under the Digital Services Act (DSA). Processing also takes place on the basis of our legitimate interests in proper business management, internal administration, risk management and IT security, as well as in protecting our business operations and our users from misuse.

Personal data is only passed on to third parties insofar as this is necessary for the performance of the contract, to safeguard legitimate interests or to comply with legal obligations.

The data is deleted as soon as it is no longer required for the aforementioned purposes and no statutory retention obligations prevent this.

• Types of data processed: Master data (e.g. name, username, email address); contact data; contract data (e.g. time of registration, acceptance of the terms of use).
• Data subjects: Users; prospective users.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; communication; organisational and administrative procedures.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR); legal obligation (Art. 6(1)(c) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Provision of the online services and web hosting

We process users' data in order to be able to provide our online services to them. For this purpose, we process the user's IP address, which is necessary to deliver the content and functions of our online services to the users' browser or device.

• Types of data processed: Usage data; meta, communication and process data (e.g. IP addresses, time information); log data (e.g. log files relating to sign-ins or the retrieval of data); content data.
• Data subjects: Users (e.g. website visitors, users of the app).
• Purposes of processing and legitimate interests: Provision of our online services and user-friendliness; information technology infrastructure; security measures.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

• Provision of online services on rented storage space: To provide our online services, we use storage space, computing capacity and software that we rent or otherwise obtain from corresponding server providers: netcup for the website, Supabase for the app (see "Services used"); Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
• Collection of access data and log files: Access to our online services is logged in the form of so-called "server log files". Server log files may include the address and name of the web pages and files accessed, date and time of access, amount of data transferred, notification of successful retrieval, browser type and version, the user's operating system, referrer URL and, as a rule, IP addresses and the requesting provider. The server log files can be used on the one hand for security purposes, e.g. to prevent server overload (especially in the case of abusive attacks, so-called DDoS attacks), and on the other hand to ensure the utilisation and stability of the servers; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR). Deletion of data: Log file information is stored for a maximum of 30 days and then deleted or anonymised. Data whose further retention is necessary for evidentiary purposes is excluded from deletion until the respective incident has been finally clarified.
• Email sending and hosting: The web hosting services we use also include the sending, receiving and storage of emails. For these purposes, the addresses of the recipients and senders as well as further information relating to the sending of emails (e.g. the providers involved) and the contents of the respective emails are processed. The aforementioned data may also be processed for the purpose of detecting spam. Please note that emails on the internet are generally not sent in encrypted form. As a rule, emails are encrypted in transit, but (unless a so-called end-to-end encryption method is used) not on the servers from which they are sent and received. We can therefore accept no responsibility for the transmission path of emails between the sender and receipt on our server; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
• Content delivery network: We use a "content delivery network" (CDN). A CDN is a service that helps deliver content of online services, in particular large media files such as graphics, map data or program scripts, faster and more securely using regionally distributed servers connected via the internet. We use Cloudflare for this (see "Services used"); Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
• netcup: Services in the field of providing information technology infrastructure and related services (e.g. storage space and/or computing capacity) for the website and the email mailboxes; Service provider: netcup GmbH, Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.netcup.com/de; Privacy policy: https://www.netcup.com/de/kontakt/datenschutzerklaerung; Data processing agreement: https://www.netcup.com/de/helpcenter/dokumentation/general/avv.

Use of cookies

The term "cookies" refers to functions that store information on users' devices and read it from them. This also applies to comparable storage in the app. Cookies can also be used for various purposes, such as the functionality, security and convenience of online services and the analysis of visitor flows. We use cookies in accordance with the legal provisions. To this end, we obtain users' consent in advance where required. If consent is not necessary, we rely on our legitimate interests. This applies where storing and reading information is essential to provide explicitly requested content and functions. This includes, for example, storing settings and ensuring the functionality and security of our online services, in the app for example signing in. Consent can be withdrawn at any time.

Information on legal bases under data protection law: Whether we process personal data using cookies depends on consent. If consent has been given, it serves as the legal basis. Without consent, we rely on our legitimate interests, which are explained above in this section and in the context of the respective services and procedures.

Storage period: With regard to the storage period, the following types of cookies are distinguished:

• Temporary cookies (also: session cookies): Temporary cookies are deleted at the latest after a user has left an online service and closed their device (e.g. browser or mobile application).
• Permanent cookies: Permanent cookies remain stored even after the device has been closed. For example, the sign-in status can be saved and preferred content displayed directly. Likewise, user data collected using cookies can be used for reach measurement. If we do not provide users with explicit information on the type and storage period of cookies (e.g. when obtaining consent), they should assume that the cookies are permanent and that the storage period can be up to two years.

General information on withdrawal and objection (opt-out): Users can withdraw any consent they have given at any time and also object to processing in accordance with the legal requirements, including via the privacy settings of their browser.

Cookie settings/options to object:

• Website: "Privacy settings" link in the footer of every page (https://getruntime.de/privacy.html#analytics).
• App: Settings → "Analyse usage".

• Types of data processed: Meta, communication and process data (e.g. IP addresses, time information, identification numbers).
• Data subjects: Users (e.g. website visitors, users of the app).
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); consent (Art. 6(1)(a) GDPR).

Further information on processing operations, procedures and services:

• Processing of cookie data on the basis of consent: We obtain users' consent to usage analytics on the website via a banner and in the app via the question "Analyse usage". Both answers carry equal weight; without consent no analytics takes place, and the website then only measures without cookies (see "Usage analytics with PostHog"). On the website, the decision is stored in the browser; in the app, it is stored on the device for the respective account, with the time and the version of the text; a yes is additionally reported once by the app to PostHog with this version, as proof; each account is asked once on each device. After a refusal, the app does not ask again. Consent can be withdrawn at any time via the settings mentioned above; Legal bases: Consent (Art. 6(1)(a) GDPR).

Registration, sign-in and user account

Users can create a user account. During registration, users are informed of the required mandatory information, which is processed for the purpose of providing the user account on the basis of the fulfilment of contractual obligations. The data processed includes in particular the email address, the display name and the username. There is no password: to sign in, we send a one-time code to your email address.

When our registration and sign-in functions are used and the user account is used, we store the IP address and the time of the respective user action. The storage is based on our legitimate interests as well as those of the users in protection against misuse and other unauthorised use. As a rule, this data is not passed on to third parties unless this is necessary to pursue our claims or there is a legal obligation to do so.

Users may be informed by email about events relevant to their user account, such as technical changes.

• Types of data processed: Master data (e.g. name, username, email address); contact data; content data (e.g. profile picture, banner); usage data; log data (e.g. log files relating to sign-ins).
• Data subjects: Users.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; security measures; organisational and administrative procedures; provision of our online services and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion". Deletion after termination (see "Deleting your account").
• Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

• Registration with pseudonyms: Users may use pseudonyms instead of their real names as display name and username; Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).
• User profiles are not public: Users' profiles are not visible on the internet, only to signed-in users in the app. Technically, the profile picture and banner are stored at an address that can be accessed without signing in; the app only shows them to signed-in users.
• Setting the visibility of profiles: In the settings, users determine whether they can be found by their username and what friends see of their runs and statistics; Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).
• Two-factor authentication: If you wish, you can additionally secure your account with a code from an authenticator app. For this, we store a secret key shared by your app and our sign-in service, and the time of setup; after the code sent by email, we ask for the code from the app. You can remove the app again in the settings at any time; Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).
• Deletion of data after termination: When users have deleted their user account, their data relating to the user account is deleted, subject to a legal permission, obligation or consent of the users; Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).
• No obligation to retain data: It is the users' responsibility to back up their data before the end of the contract if they terminate it. We are entitled to irretrievably delete all of the user's data stored during the term of the contract; Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).

Community features

The community features we provide allow users to interact with one another: become friends, see friends' runs, give likes and tag friends on runs. Please note that use of the community features is only permitted in compliance with the applicable law, our terms of use and the rights of other users and third parties.

• Types of data processed: Master data (e.g. name, username, profile picture); content data (e.g. runs, run titles, photos, likes, tags); usage data.
• Data subjects: Users; third parties (e.g. tagged friends).
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; security measures; provision of our online services and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

• Setting the visibility of posts: For each run and as a default, users determine what friends see (map, pace, times of day) and whether start and finish remain hidden. Runs are never public; without a choice, no one sees them; Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).
• Storage of data for security purposes: Users' posts and other input are processed for the purposes of the community features and, subject to legal obligations or legal permission, are not disclosed to third parties. An obligation to disclose may arise in particular in the case of unlawful posts for the purpose of legal prosecution. We would like to point out that, in addition to the content of the posts, their time is also stored and our service provider logs the IP address on sign-in. This is done so that we can take appropriate measures to protect other users and the community; Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).
• Right to delete content and information: The deletion of users' posts, content or information is permitted to the extent necessary after an appropriate weighing of interests, insofar as there are concrete indications that they constitute a violation of legal rules, our requirements or the rights of third parties (see "Reporting and blocking"); Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR); legal obligation (Art. 6(1)(c) GDPR).
• Protecting your own data: Users decide for themselves which data about themselves they disclose within our online services. We ask users to protect their data and to share personal data only with care and only to the extent necessary. In particular, we ask users to protect access to their email mailbox, as the sign-in codes are sent there; Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).

Contact and enquiry management

When you contact us (e.g. via contact form or email) and in the context of existing user relationships, the information provided by the enquiring persons is processed to the extent necessary to answer the contact enquiries and any requested measures.

• Types of data processed: Contact data (e.g. email addresses); content data (e.g. text messages); meta, communication and process data (e.g. time information).
• Data subjects: Communication partners.
• Purposes of processing and legitimate interests: Communication; organisational and administrative procedures; feedback; provision of our online services and user-friendliness.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR); performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR).

Further information on processing operations, procedures and services:

• Contact form: When you contact us via our contact form on getruntime.de, by email or other means of communication, we process the personal data transmitted to us in order to answer and handle the respective matter. This usually includes information such as name, contact information and, where applicable, further information that is communicated to us and is necessary for appropriate handling. We use this data exclusively for the stated purpose of contact and communication; Legal bases: Performance of a contract and pre-contractual requests (Art. 6(1)(b) GDPR), legitimate interests (Art. 6(1)(f) GDPR).
• Feedback in the app: Via "Send feedback" in the app's settings, you can send us a message. It is sent by email via Scaleway Transactional Email to hallo@getruntime.de. We receive your text, your username, the app version, the operating system and its version and the language of the app, as well as the email address of your account, to which we reply. Location and runs are not included. To prevent anyone from flooding the mailbox, we store for each account when feedback was sent (at most five per hour), never the text; we delete entries older than one hour with the next feedback, at the latest with your account. We keep the email for as long as handling it requires; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

The Runtime app

Runtime is an app for running with friends. This section describes what the app processes beyond the preceding sections. As a general rule: what others may see is decided by the server according to your settings, not by the app. There are no ads.

Location and runs

• Location: The app only asks for your location when you start your first run and only uses it during a run ("While Using the App", no "Always" access). This produces the route, distance, pace and times of the run. Before the start, the Run tab shows a map around your approximate location; this position stays on the device.
• Motion sensor: If you wish, the app uses the motion sensor ("Motion & Fitness") to determine steps and elevation gain more precisely. Without permission, everything else keeps working.
• Storage: A run is first saved on the device and only uploaded once you save it. The server holds the route, metrics, title, visibility, if you wish a photo, a place determined on the device from the route (e.g. "Tiergarten, Berlin", for friends only with a shared map) and an analysis (e.g. pace zones, elevation profile). The app does not process heart rate or other health data.
• Start and finish hidden: By default, friends do not see the first and last 200 metres of a run, so that your home address cannot be identified. You can change this in the settings.
• Only on the device: Body weight (for a rough calorie estimate) and the selection of metrics stay on the device and are not uploaded.
• Legal bases: Performance of a contract (Art. 6(1)(b) GDPR). You additionally allow access to location and the motion sensor in the operating system and can revoke it there at any time.

Weather

For each uploaded run, our server fetches the weather at the start time. To do so, it sends the start position, rounded to 0.1 degrees (about 10 kilometres), and the time to Bright Sky, a service using data from the Deutscher Wetterdienst (German Meteorological Service). Bright Sky does not learn your IP address or your account in the process. Legal bases: Performance of a contract (Art. 6(1)(b) GDPR).

Maps

The app loads map data (OpenStreetMap) from our own map service tiles.rtinfra.dev, which is delivered via Cloudflare. In the process, the IP address and the map section retrieved are processed. The app creates map images of your runs on the device. Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Friends, invites and tags

• Friendships only come about if both agree. You can invite friends via an invite link or QR code; we only store the QR code as a check value. We store who invited whom in order to assign invites.
• You can tag friends on a run; anyone who tags you without being your friend thereby sends a friend request, and the tag only applies once you accept. You can remove yourself from a tag, and under Settings → Visibility you can turn off tags entirely.
• You decide in the settings whether people can find you by your username.
• Legal bases: Performance of a contract (Art. 6(1)(b) GDPR).

Notifications (push)

If you allow notifications, we store a device identifier (push token) and send, via the Apple Push Notification Service, notices about friend requests, acceptances and tags. The notification contains the name of the person acting. You can turn off notifications in the settings of the app or the operating system. When you sign out, the token is detached from the account. Legal bases: Consent (Art. 6(1)(a) GDPR) via the operating system's prompt; performance of a contract (Art. 6(1)(b) GDPR).

Sharing

When you share a run, the app creates an image on the device and passes it to the operating system's share menu. We do not learn where you share it. You choose a photo for the photo card yourself; the app only reads this one photo.

Reporting and blocking

• You can report people and content and block people. Blocking works both ways: you no longer see each other.
• A report contains the reason, your explanation if any, the reported person or content and the time. We receive it by email and review it. We inform the reporting person and the person concerned of our decision by email; we delete removed images.
• Reports you have submitted are retained after your account is deleted, without any link to you, so that decisions remain traceable. Reports about your account are deleted with the account.
• Legal bases: Legal obligation (Art. 6(1)(c) GDPR in conjunction with Arts. 16, 17 and 20 of Regulation (EU) 2022/2065 (Digital Services Act)); legitimate interests (Art. 6(1)(f) GDPR) in protecting users.

Deleting your account

You can delete your account in the app at any time under Settings → "Delete account". If you signed in more than ten minutes ago, you confirm this with a new code by email. We then immediately and permanently delete your profile, your runs, photos, friendships, tags, likes, devices for notifications and invites on the server, the data of your account on the device and your data at PostHog (see below). Copies in backups of your device, for example in iCloud, are your responsibility. Without access to the app, you can request deletion by email to hallo@getruntime.de from your account's address.

Internal statistics

To understand whether Runtime helps with running regularly, we count weekly totals from the data already stored on our server: how many people ran, how many reached their weekly goal, how many of them have friends on Runtime and how many are still running in the weeks after signing up. The analysis does not leave our server, shows no individual accounts and does not report groups of fewer than five people; Legal basis: Legitimate interests (Art. 6(1)(f) GDPR), our interest being to improve the app.

Usage analytics with PostHog

We use PostHog to understand how the website and app are used and where errors occur. PostHog processes the data in the EU (Frankfurt am Main) and discards IP addresses before data is stored.

• Website: Without consent, the website only measures without cookies: page views are counted via a value that changes daily and does not allow recognition across days. The requests run via our own server getruntime.de/ph. Only with your consent in the banner does PostHog set a cookie and record sessions.
• App: Unless you tap "Allow" for "Analyse usage", the app sends nothing to PostHog, not even crash reports. With consent, it sends:
  • which screens you open (only their type, e.g. "run end", without content or IDs),
  • events such as "run started", "run saved" or "like given" with rough details (distance and duration in ranges, visibility as on or off), never routes, coordinates, names, texts, photos or health data,
  • crash and error reports with the technical sequence of events,
  • screen recordings of the session (session replay), in which maps, routes, names, images, input and all texts except the app's fixed labels are masked,
  • app version, language, device type and operating system.
• Identifier: For the app, each account receives a random analytics identifier that does not correspond to your account identifier. This way, a new device does not count as a new person. PostHog knows neither your name nor your email address.
• Withdrawal: Website via "Privacy settings", app via Settings → "Analyse usage". In the app, this stops the transmission immediately and resets the identifier on the device. Consent applies per account and device.
• Deletion: When you delete your account, we delete your person including events and recordings at PostHog. Otherwise, PostHog deletes events after one year and recordings after 30 days.
• Legal bases: Consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG); for measuring the website without cookies, legitimate interests (Art. 6(1)(f) GDPR).
• Service provider: PostHog Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA; processing in the EU; Website: https://posthog.com; Privacy policy: https://posthog.com/privacy; Basis for third-country transfer: Data Privacy Framework (DPF), standard contractual clauses in the data processing agreement.

Services used

• Supabase: Database, file storage, sign-in and server functions of the app; servers in Frankfurt am Main; Service provider: Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513; Website: https://supabase.com; Privacy policy: https://supabase.com/privacy; Basis for third-country transfer: Standard contractual clauses in the data processing agreement; Legal bases: Performance of a contract (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).
• Scaleway Transactional Email: Sending of the sign-in codes, of the emails about reports and of the feedback from the app; Service provider: Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France; Website: https://www.scaleway.com; Privacy policy: https://www.scaleway.com/en/privacy-policy/; Legal bases: Performance of a contract (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).
• Cloudflare: Delivery of the website, the map data and the invite links, protection against attacks; Service provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; Website: https://www.cloudflare.com; Privacy policy: https://www.cloudflare.com/privacypolicy/; Basis for third-country transfer: Data Privacy Framework (DPF), standard contractual clauses; Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).
• Apple Push Notification Service: Delivery of notifications on iPhones; Service provider: Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA; for the EU Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland; Legal bases: Consent (Art. 6(1)(a) GDPR). Notifications on Android will follow; we will then add Google's service.
• Bright Sky: Weather data from the Deutscher Wetterdienst, see "Weather"; receives no personal data; Website: https://brightsky.dev.
• App stores: The app is distributed via Apple's App Store and Google Play. Their privacy policies apply to the download and your account there; we only receive aggregated statistics from the stores without reference to individual persons.

Management, organisation and auxiliary tools

We use services, platforms and software from other providers (hereinafter referred to as "third-party providers") for the purposes of organising, administering and planning as well as providing our services, for example GitHub for source code and bug reports. When selecting third-party providers and their services, we comply with the legal requirements.

In this context, personal data may be processed and stored on the servers of the third-party providers, for example if a bug report contains technical details. Bug reports do not contain any names, email addresses or run data.

• Types of data processed: Content data; usage data; meta, communication and process data.
• Data subjects: Communication partners; users.
• Purposes of processing and legitimate interests: Provision of contractual services and fulfilment of contractual obligations; organisational and administrative procedures.
• Retention and deletion: Deletion in accordance with the information in the section "General information on data retention and deletion".
• Legal bases: Legitimate interests (Art. 6(1)(f) GDPR).

Changes and updates

We ask you to inform yourself regularly about the content of our privacy policy. We adapt the privacy policy as soon as changes in the data processing we carry out make this necessary. We will inform you as soon as the changes require an act of cooperation on your part (e.g. consent) or other individual notification.

Where we provide addresses and contact information of companies and organisations in this privacy policy, please note that the addresses may change over time, and please check the information before making contact.

Supervisory authority responsible for us:

Berliner Beauftragte für Datenschutz und Informationsfreiheit Alt-Moabit 59–61 10555 Berlin

Definitions

This section provides an overview of the terms used in this privacy policy. Where the terms are defined by law, their legal definitions apply. The following explanations, on the other hand, are primarily intended to aid understanding.

• Master data: Master data comprises essential information necessary for the identification and management of contractual partners, user accounts, profiles and similar assignments. This data may include, among other things, names, contact information and specific identifiers (user IDs).
• Content data: Content data comprises information generated in the course of creating, editing and publishing content of all kinds, such as texts, images and runs, as well as metadata such as author information and times.
• Contact data: Contact data is information that enables communication with persons or organisations, such as email addresses.
• Meta, communication and process data: Information about the way in which data is processed, transmitted and managed, such as timestamps, transmission paths and logs of operations.
• Usage data: Information about how users interact with digital products, such as functions used, frequency of use, timestamps and device information.
• Personal data: "Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
• Log data: Information about events or activities that have been logged in a system, such as timestamps, IP addresses and error messages.
• Location data: Information about the geographical location of a device, at Runtime the positions during a run.
• Controller: "Controller" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
• Processing: "Processing" means any operation or set of operations which is performed on personal data, whether or not by automated means. The term is broad and covers practically any handling of data, be it collection, analysis, storage, transmission or deletion.
• Contract data: Information relating to an agreement between parties, such as the start and end of the contract and the type of services agreed.

Created with the free privacy policy generator Datenschutz-Generator.de by Dr. Thomas Schwenke

Last updated: 21 October 2026