Privacy Policy

RunnerTracker (“RunnerTracker”, “we”, “us”) is a live run-tracking service operated by the RunnerTracker team. It lets runners share their live GPS position on a map, either publicly or via a private password-protected link. This policy explains what information we collect, why we collect it, who processes it on our behalf, and the choices you have. We've tried to keep it in plain English.

What we collect

• Account details — your email address and a display name, provided when you sign up.
• Precise location — GPS coordinates (latitude, longitude, altitude, speed, heading, accuracy) recorded while you are tracking a run, including background location as described below.
• Device information — when you pair a phone, we store the device's name, platform (iOS, Android, or web), and a pairing token so the device can stream location securely.
• Run details — run names, visibility settings (public or private), and derived statistics such as distance, duration, and elevation gain.

We do not collect payment details, contacts, photos, health data, or advertising identifiers.

Background location

RunnerTracker collects precise location in the background — that is, while the app is not on screen or your phone is locked — only during a run that you have started. Background collection exists for one purpose: so your live position keeps updating on the map for the people you are sharing your run with, even when your phone is in your pocket. Location collection starts when you start a run, stops when you stop the run (or it auto-stops), and never runs at any other time. You can also stop it at any moment by ending the run or revoking the app's location permission in your phone's settings.

Why we collect it

We use your information solely to operate the service: creating and securing your account, streaming your live position to your run's map page, computing run statistics, letting you manage paired devices, and sending essential transactional emails (such as password resets). We do not use your data for advertising or profiling, and we do not use any analytics or ad-tracking SDKs.

Public and private runs

When you start a public run, your display name, live position, trail, and run statistics are visible to anyone viewing the public map or your run page while the run is live. When you start a private run, that information is visible only to people who have your run link and the password you set. Location sharing is always user-initiated — nothing is shared unless you start a run, and you choose its visibility each time.

Third-party processors

We don't sell your personal information to anyone. A small number of service providers process data on our behalf to run the service:

• Supabase — database and authentication. Stores your account, devices, runs, and GPS traces.
• Vercel — hosting. Serves the website and API.
• MapTiler — map tiles. Requests are proxied through our servers, so MapTiler does not receive your identity.
• Mapbox and Open-Elevation — elevation lookups. They receive coordinates only, with no account or identity information.
• SendGrid — transactional email, such as password reset messages.

Cookies and local storage

We use only the cookies the service needs to function: a session cookie that keeps you signed in, and a viewer-access cookie that remembers you entered the correct password for a private run link. We also store your theme and unit preferences (for example dark mode, kilometres vs miles) in your browser's local storage. There are no advertising or analytics cookies.

How long we keep your data

Your runs and GPS traces are kept until you delete them or delete your account. Deleting your account permanently removes your profile, paired devices, runs, and all recorded GPS traces. See how to delete your account.

Your rights

You can access the data we hold about you and you can delete it. Your runs, devices, and profile are visible and manageable from your dashboard, and you can delete your account (and everything associated with it) from the dashboard at any time. If you need help exercising these rights, email support@runnertracker.app and we'll assist.

Children

RunnerTracker is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we will delete it.

Security

Data is transmitted over HTTPS and stored with access controls, including row-level security in our database. Private run passwords and device tokens are stored hashed. No system is perfectly secure, but we design the service to minimise the data we hold and who can reach it.

Changes to this policy

If we change this policy, we will update this page and the “last updated” date above. Material changes will be communicated by email or an in-app notice.

Governing law and contact

This policy is governed by the laws of Queensland, Australia. For any privacy question or request, email support@runnertracker.app.