Privacy Policy

1. Who we are (Data Controller)

RunPal is operated by Simon Thornton and Andres Narvaez, trading as the RunPal partnership (UK). For UK GDPR purposes, the RunPal partnership is the data controller. The partners are jointly responsible for compliance.

Based in Sale, Greater Manchester, UK.

Email: support@runpal.live

If you need a postal correspondence address, email us and we'll provide one.

2. What we collect

You provide: name, email, encrypted password, profile photo, bio, runs you create/join, and messages in run/group chats.

We collect automatically: approximate location (town/city) to show nearby runs, device info, app usage logs, and crash/error reports.

We do not collect: precise GPS location, payment details, government IDs, or health data.

3. Legal bases for using your data

• Contract: to create your account and provide core features (discover, join, host runs, profile).
• Legitimate interests: app security and reliability; showing relevant local runs.
• Consent: optional push notifications (you can withdraw at any time).

Location is optional and can be turned off (see Section 9).

4. How we use your data

• Provide and improve core features (discover, join, host runs)
• Show local/relevant runs based on your inputs and preferences
• Display your profile and run activity you choose to share
• Enable user messaging
• Send in-app/push notifications (e.g., invites, join requests, messages). Service-critical notices may rely on legitimate interests; you can opt out of non-essential pushes
• Maintain performance, safety, and reliability
• Comply with legal obligations

We do not use your data for advertising and do not share it with ad networks.

5. Sharing your data

We share data only with:

• Other users when you choose to host/join runs or post content;
• Service providers acting on our instructions (e.g., Firebase for hosting, authentication, messaging, analytics/crash reporting);
• Authorities where required by law.

We never sell or rent your data.

6. International transfers

Some providers process data outside the UK/EEA. For example, parts of Firebase may process or store data in the United States or other regions. Where transfers occur, we rely on approved safeguards (e.g., UK IDTA/Addendum and/or EU Standard Contractual Clauses) with Google/Firebase acting as our processor.

7. Retention

• Account data: kept until you delete your account, then permanently deleted within 30 days.
• Chat messages: deleted 90 days after the related run concludes.
• Usage logs/diagnostics: kept 12 months to improve reliability and performance.

Limited records may be retained where necessary for legal/regulatory obligations, security, or dispute resolution. Deleted content may persist briefly in backups before being purged.

8. Security

We use industry-standard measures and reputable cloud services (e.g., Firebase), including encrypted transport, authentication, and controlled access. If a data breach creates a high risk to you, we will notify you and/or regulators where required by law.

9. Your choices: withdrawing consent & managing permissions

Push notifications (withdraw consent):

• iOS: Settings → Notifications → RunPal → toggle Allow Notifications off.
• In-app notifications toggle (where available) can also be turned off.

Approximate location (turn off permission):

• iOS: Settings → Privacy & Security → Location Services → RunPal → select Never (or another preference).
• You can also choose to set your city manually in-app.

Delete account & data:

Use Settings → Account → Delete account (where available) or email support@runpal.live.

10. Your rights (UK GDPR)

You have the right to be informed, access, rectification, erasure, restriction, portability, objection, and to withdraw consent (where consent is the basis).

To exercise your rights, email support@runpal.live. We aim to respond within 48 hours (Mon–Fri, UK time).

11. Children's privacy

RunPal is intended for users aged 13 and over in the United Kingdom. We do not knowingly collect personal data from anyone under 13. If you believe we have collected data from a child under 13, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. Significant changes will be notified in-app or by email. The latest version is always available in the App's settings.