PL EN
← Back

Privacy policy

Effective from: August 14, 2026. The Polish version prevails in case of discrepancies.

1. Data controller

The data controller and owner of runnin.app and the Runnin app is:

The Cloudest Tomasz Iwanowski
NIP: 1251739189
ul. Bandurskiego 47B, 05-270 Marki, Poland
e-mail: contact@runnin.app

2. The account is optional

You can use Runnin calculators and core features without an account; calculator inputs are processed locally. If you voluntarily create an account, Runnin can synchronize selected data between devices and connect to Strava. The app contains no ads.

3. Account data and purposes

For account users we process an email address, password hash, nickname and optional name, profile and MFA settings, sessions (IP and user-agent), records, races, heart-rate zones, plan progress and private workout feedback. This is necessary to provide and secure the account and synchronization service. Passwords, recovery codes and session tokens are not stored in plaintext; MFA secrets and integration tokens are encrypted.

We receive data from you, your device and — after connection — Strava. Email and password are required only to create an account; other profile data and the Strava integration are optional. Account processing and transactional messages are necessary to perform the contract (Article 6(1)(b) GDPR), while technical security and abuse prevention rely on our legitimate interests (Article 6(1)(f) GDPR).

4. Strava integration

The integration is optional and uses OAuth authorization. We store the connection identifier and retrieve activity information you request — including older pages imported manually — such as sport, time, distance, elevation, heart rate, cadence, device, laps, segments and GPS track when available, solely for a private source-data view. We do not analyze it, combine it with plans or other user data, or include it in Runnin exports. A Strava webhook informs Runnin when an activity is created, changed or deleted, and when authorization is revoked. Activity data and webhook metadata are retained for no longer than 7 days. Disconnecting deletes the cache and linked derived data and triggers an email confirmation. Runnin does not publish content to Strava.

Strava may monitor Runnin’s API usage and collect related data under its API Agreement and privacy policy. You can obtain your own copy of Strava data directly from Strava.

Runnin does not make decisions producing legal effects about a user through automated profiling.

5. Processors

Where a provider processes data outside the European Economic Area, we use a mechanism required by the GDPR, such as an adequacy decision or Standard Contractual Clauses.

6. Retention

Account data is retained until deletion. Source Strava activity data is cached for no longer than 7 days. Records derived from Strava and feedback linked to Strava activities are deleted with the source; manually entered records may remain until account deletion. Expired tokens and sessions are periodically removed; backups expire on the provider's schedule and are not used to resume the service after account deletion.

7. Export and deletion

In the app go to Profile → Profile and security → Privacy and data to request a JSON export of Runnin data delivered as a one-time, one-hour link to the account e-mail address or permanently delete the account. The export excludes Strava data; obtain that copy directly from Strava. Both operations require the current password and MFA when enabled. See Delete your Runnin account.

8. The runnin.app website

9. Your rights (GDPR)

You have the right to access, rectify, erase, restrict processing, port your data, object, and lodge a complaint with the Polish supervisory authority (UODO). Contact: contact@runnin.app.

10. Changes to this policy

This policy may be updated. The current version is always available at runnin.app/privacy-en.html with its effective date.