RunTracker

Privacy Policy

Last updated 26 October 2026

RunTracker records where you run. That is the most sensitive kind of data an app can hold, so this page says plainly what is collected, why it exists, and who else sees it. It describes what the app actually does, not what we might do later.

Who we are

RunTracker is operated by Lenscap Studios (Pty) Ltd, a private company registered in South Africa (registration number K2023650167), 6 The Old Road, Hout Bay, Cape Town, Western Cape, 7806. Lenscap Studios is the responsible party for your personal information. For any privacy question, or to have your data deleted, email privacy@runtracker.cc.

What we collect

Your account

• Email address and display name.
• We use your email address for your account — sign-in codes and password resets — and to send a few emails about live tracking: a welcome, reminders 9 days, 4 days and on the day your free live tracking ends, and a note if a link you send cannot show your run live. Each one says how to stop them: the switch "Email me about live tracking" under Profile in the app, or the unsubscribe link in the email. We never send email for anyone else.
• Your password, stored only as a PBKDF2-HMAC-SHA256 hash. We cannot read it and cannot tell you what it is.
• Your phone's make and model, its operating system version, which version of the app it runs, and when you last signed in and last used the app. Only the latest of each is kept. We use it to support you and to know when everyone has an update.

Location, while a run is running

• Latitude and longitude, and where the device reports them: altitude, accuracy, speed and heading.
• The time each position was recorded by your phone, and the time it reached our server. These can differ if you ran through an area with no signal and the phone sent them afterwards.
• Your device's timezone, so notifications read in your local time, and the difference between your phone's clock and ours, so a wrong clock does not corrupt the order of your route.

Location is recorded only while a run is running, including when your screen is off — which is why Android shows a permanent notification the whole time. Ending the run stops it. The app has no reason to know where you are between runs and does not look.

Positions the server judges impossible — wildly inaccurate, or implying a speed no runner reaches — are kept and marked as rejected rather than deleted. They are excluded from your distance, and they are the evidence if a distance ever looks wrong to you.

What you report

• Alarms you raise, with the position and the time you raised them.

People you nominate

The name and email address or phone number of the contacts you add. This is information about somebody else, and you are the one deciding to give it to us — please only add people who would expect to hear from you.

What we do not collect

• No advertising identifiers, no third-party analytics, no tracking across other apps or sites.
• No card details. Payments go directly to PayFast; we never see or store a card number.
• The public tracking page sets no cookies and does not identify whoever opens it.

Who else sees it

The people you nominate

If you raise an alarm, or your phone goes quiet during a run, or you are overdue, your contacts are emailed. Those emails include your name, when we last heard from your phone, and your last known position with a map link. That is the entire purpose of nominating them.

Anyone holding a tracking link

A tracking link is a secret URL: whoever has it can open it, with no account and no password. It shows your display name, your route, your current position, how long you have been out, your distance, and any open alarm. It shows nothing else — not your email, not your phone number, not your contacts, and not your other runs.

When you make a link, we keep where your phone was at that moment. If your live tracking is off, that spot and your display name are all the link shows, in place of your run.

You can revoke a link at any time, which kills the URL immediately, or rotate it to issue a new one. Revoking is never blocked by billing.

Services we rely on

• Mailgun sends our email. It processes the recipient address and message content.
• PayFast handles subscription payments.
• Google Maps renders map tiles inside the app when you have signal. Google's map component collects its own technical data to run and improve it — device and system details, crash reports, a pseudonymous identifier and how the map is panned and zoomed — under Google's privacy policy. It does not receive your runs.
• Our server is a virtual machine hosted by DigitalOcean in Amsterdam.

We do not sell your data, and we do not share it for advertising.

How long we keep it

• Runs and their tracks are kept until you delete them or close your account. Deleting a run in the app removes its track, times and distance from our server permanently.
• Routes you save are kept until you delete them or close your account. A route saved from a run stays if you later delete that run.
• Email sending logs are retained by Mailgun for one day.
• The server is backed up for disaster recovery on a rolling schedule. Something you delete is gone from the live service at once, but can survive in a backup for up to four weeks before that backup is overwritten. Backups are never read except to restore the service after a failure.

Your choices

• Delete a run — in the app, from the run itself or the Runs list. Immediate and permanent.
• Delete your account and everything in it — in the app, Profile → Delete account, which is immediate; or, if you no longer have the app, see runtracker.cc/delete-account or email privacy@runtracker.cc.
• Get a copy of your data — ask, and we will send it.
• Withdraw location permission — in your phone's settings, at any time. Tracking stops; the app tells you plainly that it is no longer recording.

South Africa's POPIA and the EU GDPR both give you rights over your personal information: to see what we hold, to have it corrected or deleted, and to object to how it is used. The list above is how to use them here, or email privacy@runtracker.cc. If you are not satisfied with our answer, you may complain to South Africa's Information Regulator at inforegulator.org.za.

Security

Traffic between the app and our server is encrypted with TLS. Passwords are stored only as hashes. Password reset codes, sign-in refresh tokens and email confirmation codes are stored as one-way fingerprints, so a copy of our database is not a set of usable credentials.

No system is perfectly secure, and we would rather say so than imply otherwise.

Children

RunTracker is not intended for children under 13, and we do not knowingly collect their information.

Changes

If this policy changes in a way that affects what is collected or who sees it, we will say so in the app rather than quietly editing this page.