Privacy policy.

Last updated: 25 October 2026

1. Who we are

Runpacks ("we", "us") runs the Runpacks app and the website runpacks.app (together, "Runpacks"). Runpacks is the controller of the personal data described here.

Questions about this policy or your data: hello@runpacks.app.

Runpacks is in a closed beta. Some features may change before a public release, and we will update this policy when they do.

2. The short version

You can browse runs and clubs without an account. To join a run you sign in with a one-time code sent to your email.
We keep what we need to run Runpacks: your email, your display name, your "18 or older" declaration, the runs you join and your after-run answers.
Your exact location never leaves your phone. Near me uses it on the device and forgets it. While the map shows the area around you, our map provider can tell roughly where you are (see 3.7).
We don't sell your data, show ads, or track you across other apps and websites. We use no analytics in the app.
You can delete your account in the app at any time.
If you sign up for the weekly email on the website, we send it every Monday until you unsubscribe, which takes one click (see 3.12).
If you ask the shop to tell you when something can be ordered, we send one email when it can, and nothing else (see 3.13).

3. What we collect, and why

3.1 Your account

Email address. You give it to sign in. We send a one-time code to it, and we use it to send essential notices about runs you joined when push notifications are off. It also identifies your account.
Sign-in session. After you enter the code, our sign-in provider issues a session that stays on your phone in its secure storage, so you stay signed in. Our sign-in provider keeps records of sign-ins, such as the time and the network (IP) address used, for up to 30 days.
Display name. You choose it (up to 50 characters). Others see it as described in section 4. Your avatar is your initials; we don't collect profile photos. Clubs' photos are covered in 3.11.
"I am 18 or older." Before your first join you confirm this. We store that you confirmed it, and when. It is your own declaration: we don't ask for a birth date or ID.
An account ID. A random identifier our systems use for your account.

Why: to create and run your account and let you join runs (performance of our contract with you).

3.2 Runs you join

The runs you join, when you joined, and any runs you leave.
Your optional after-run answer ("Interested" or "Not staying"). Organizers see only how many people are interested, not who.
Your past runs: the runs you were still signed up for when they started. This records sign-ups, not attendance.

Why: to confirm your place, keep counts right, show your Upcoming and Past runs, and tell you if a run changes (contract).

3.3 If you organize runs for a club

Clubs are added by us, with one organizer each. If you are a club's organizer, we keep:

the runs you publish, edit, duplicate or cancel, with their details: date, time, meeting point and its map position, distance, effort, pace, places and after-run plan;
a record of any runner you remove from a run, with the reason you give, and any later restore. The reason is kept in the club's record. The removed runner is never shown it.

Why: to publish runs, keep runners informed, and keep a record of removals and their corrections (contract, and our legitimate interest in running safe events).

Meeting-point search: when you search for a meeting point, the search uses our own list of places in Cyprus, built from OpenStreetMap data (© OpenStreetMap contributors) and kept on our servers. The search text stays with us and goes to no outside service. The point you choose is saved with the run and shown to everyone who views it.

3.4 Reports

If you report a run or a person, we keep your report: the run or person reported, the reason you chose, any details you add (up to 1,000 characters), and that you sent it. A person on the Runpacks team reviews every report by hand. We are told about new reports by email; that email contains only the report's number, its kind, its reason and the run, not names or details. The person you report isn't told who reported them.

Why: to keep runs safe and act on misuse (legitimate interest, and legal obligation where it applies). Only the person who reviews reports for Runpacks can see them. A "Might be under 18" report is reviewed within 48 hours; if the account appears to belong to someone under 18, we close it and delete its data (see section 10).

3.5 Notices about runs you joined

When a run you joined is changed (date, start time or meeting point) or cancelled, or if an organizer removes you or lets you join again, we send you a notice.

Push notifications. If you allow notifications, your phone gives us a push token, which we store with your account to send notices through a push notification service and Apple's or Google's notification services. You can turn notifications off at any time in your phone's settings. Signing out removes this phone's token.
Email. If push is off, the notice goes to your email address through our email provider.
We keep a record of each notice: which run, what kind, when it was sent and how, for 90 days after the run.

Why: these notices are part of the service you signed up for (contract). Push permission is your choice in your phone's settings.

3.6 Location

Near me asks for your location only when you tap it. Your position is used on your phone to show runs within the range, kept in memory, and never stored or sent to us. While Near me centres the map on you, the map images your phone downloads from our map provider cover the area around you (see 3.7). Runpacks never uses location in the background. On the map, your position shows only to you, only while Near me is on.

3.7 Maps

The map in the app comes from our map provider. To draw it, your phone downloads map images from it, and it sees your network (IP) address and the map area requested. While Near me is on, the map is centred on you, so the area requested shows the map provider roughly where you are. The app sends it no account ID, email or name. We turn off the map provider's telemetry in the app.

Map pictures: Run details opens on a picture of the meeting point's map. Your phone downloads it from our map provider, so the provider sees your phone's network (IP) address and the area around the meeting point. That area is the run's place, not your location. No account ID, email or name is sent.

3.8 Crash reports

When the app crashes or hits an error, it sends a crash report to our crash-reporting service (EU data region): the error, the app version, the device model and the operating system. When the crash happens in the phone's native code, the crash-reporting software also adds a hashed device identifier, which we cannot switch off; it is not linked to your account. A crash report never carries your account ID, email or name, and the crash-reporting service is set not to store your network (IP) address.

Why: to find and fix faults (legitimate interest).

3.9 Technical logs

Our servers keep technical logs to run and secure Runpacks: the request, its time and its result. We don't write email addresses or push tokens into our logs. Our hosting provider's logs may include the network (IP) address of a request; we keep logs for up to 30 days.

Why: security and reliability (legitimate interest).

3.10 The website

runpacks.app is run by a website hosting provider. It counts page views without cookies, and uses a bot check on the waitlist, weekly email and shop Notify me forms to stop bots. We leave club kit pages out of the page counts.

The waitlist. When you join, you give your email address and pick a city. We store, in plain words: your email, your city, your sign-up number, your own referral code, who referred you (if someone did), your display name, your network (IP) address, your browser details, the time you signed up, and the campaign tags of the link you came from (where the link came from, up to 64 characters each). Your IP address and browser details are kept to stop abuse. We email you a link to confirm your address. A hidden field and the bot check confirm that you are not a bot.
Where waitlist data is held. The waitlist server is the earlier Runpacks app's API, hosted in the EU (Germany). Its database is that app's own database, in the EU (Ireland). The confirmation email goes through our email delivery provider. This is not the same system that holds the new app's accounts.
The upgrade page. The website takes no payments. The upgrade page says Runpacks is free, and its checkout is switched off, so the website collects no payment details.
The Cyprus club pages. Browsing the run directory, club pages and race pages needs no account and has no sign-up form. A club's organizer can unlock the club's kit with the club's access code; the website keeps an access cookie on that browser for 8 hours so the kit stays open, and for nothing else. The map page loads map images and terrain tiles from our map-tile providers, which see your network (IP) address and the area you view.

3.11 Club content

Clubs give us their photos and captions to show on their club page, with the club's written OK. They are public: anyone can see them in the app, signed in or not. The club confirms that the people shown agreed to be in them. We strip location data (EXIF and GPS) from the files before we publish them. Anyone shown in a photo can ask hello@runpacks.app to remove it, and we remove it within a few days. Photos are kept until the club or a person shown asks for removal.

Why: to show what a club's runs are like (the club's consent, and our legitimate interest in presenting clubs).

3.12 The weekly email

"Running in Cyprus this week" is a free email we send every Monday: the week's group runs, the races coming up, new clubs and the latest Couch to Club episode. You get it only if you sign up on the website and then click the link in the confirmation email we send you.

What we store. Your email address; the language you signed up in (English or Greek); the city you asked to see first, if you picked one; the page you signed up on; the consent wording you saw and its version; when you signed up, confirmed and unsubscribed; and a scrambled (hashed) copy of the code in your confirmation link, which is deleted when the link expires, 7 days after we send it. We don't keep your network (IP) address with this list; it is held for an hour at most to stop repeated sign-ups. A hidden field and the bot check confirm that you are not a bot, as on the waitlist.
What we send. The confirmation email, then one email a week. For each weekly email we keep a record of which subscriber it went to, by a random ID and not your address, so the same week never goes to you twice.
Why. To send you the email you asked for. Our legal basis is your consent (GDPR Article 6(1)(a)), which you give by signing up and confirming.
How to leave. Every weekly email has an unsubscribe link that works in one click, and mail apps that show their own Unsubscribe button use the same link. You can also write to hello@runpacks.app. We stop at once.
How long we keep it. A sign-up you never confirm is deleted after 30 days. After you unsubscribe, your address and the records that go with it are deleted within 30 days.
Who handles it. The emails go out through Resend, our email delivery provider, which receives your address and the email's content to deliver it (see sections 5 and 6). The list is kept on the same server and database as the waitlist (section 3.10), in the EU.
Separate from the waitlist. Joining the waitlist never signs you up for the weekly email, and we never send the weekly email to the waitlist.

3.13 Notify me in the shop

Some things in the shop can't be ordered yet and show "Coming soon". If you ask us to tell you when one can, we store your email address, the product and colour, the language you asked in, the page you asked on, which version of the consent wording you saw, and when you asked. We use it for one email, when you can order that product, and for nothing else: it doesn't sign you up for the weekly email. We delete the request 30 days after that email, or 12 months after you asked if the product never becomes available. Our legal basis is your consent (GDPR Article 6(1)(a)); to cancel a request sooner, write to hello@runpacks.app. A hidden field and the bot check stop bots, and your network (IP) address is held for an hour at most to stop repeated requests. The requests are kept with the weekly email's list, in the EU.

Ορισμένα προϊόντα του μαγαζιού δεν διατίθενται ακόμη και γράφουν «Έρχεται σύντομα». Αν μας ζητήσετε να σας ειδοποιήσουμε όταν διατεθεί κάποιο, αποθηκεύουμε το email σας, το προϊόν και το χρώμα, τη γλώσσα και τη σελίδα από την οποία το ζητήσατε, ποια έκδοση του κειμένου συγκατάθεσης είδατε και πότε το ζητήσατε. Το χρησιμοποιούμε για ένα μόνο email, όταν μπορείτε να παραγγείλετε το προϊόν, και για τίποτα άλλο: δεν σας εγγράφει στο email της Δευτέρας. Διαγράφουμε το αίτημα 30 ημέρες μετά από εκείνο το email, ή 12 μήνες αφού το ζητήσατε αν το προϊόν δεν διατεθεί ποτέ. Νομική βάση είναι η συγκατάθεσή σας (άρθρο 6(1)(α) ΓΚΠΔ)· για να ακυρώσετε ένα αίτημα νωρίτερα, γράψτε στο hello@runpacks.app. Η διεύθυνση δικτύου (IP) σας κρατιέται το πολύ μία ώρα, για να σταματούν οι επαναλαμβανόμενες αιτήσεις.

4. Who can see what

Everyone, signed in or not: published runs and their details, club pages, and how many people joined each run.
The run's organizer and the runners who joined it: the display names of the people who joined. A notice on each run says so before you join: "The organizer and joined runners see participant names, including yours if you join."
The organizer only: the number of "Interested" answers, and removal reasons in the club's record.
Nobody else sees your email address. It never appears in participant lists.

5. Who we share data with

We use these service providers to run Runpacks. They process data for us under contract and may not use it for their own purposes.

Provider type	What for	Data	Where
Sign-in provider	Sign-in	Email, sign-in session, sign-in records	EU (Ireland)
Backend hosting provider	Hosting our backend	Account, run, report and notice data, as it passes through the backend	EU
Database hosting provider	Database hosting	All account, run, report and notice data	EU (Germany)
Email delivery provider	Sending sign-in codes, notice emails, waitlist confirmation emails, the weekly email and the shop's Notify me emails	Email address, the email's content	Sends from the EU (Ireland). Some processing may happen in the United States under the safeguards in section 6
Push notification services, including Apple's and Google's	Delivering push notices	Push token, the notice's text	May include the United States, under the safeguards in section 6
Map provider	Map images, including the map picture of a run's meeting point	Network address and map area (the area around you while Near me is on; the meeting point's area for map pictures)	May include the United States, under the safeguards in section 6
Crash-reporting service	Crash reports	Error details, device model, operating system, app version, a hashed device identifier on native crashes	EU
Website hosting and bot-check providers	Website hosting, page counts, bot checks	Website visit data	A worldwide network. May include the United States, under the safeguards in section 6
The waitlist's server and database	Running the website's waitlist (the earlier app's system)	Waitlist sign-up data	EU (Germany and Ireland)

You can ask us for the names of our providers at hello@runpacks.app.

We may also disclose data if the law requires it, or to protect someone's safety.

We don't sell personal data and we don't share it for advertising.

6. Transfers outside the EU

Some providers above may process data outside the European Economic Area, including in the United States. Where they do, we rely on the European Commission's adequacy decisions (including the EU-US Data Privacy Framework for certified companies) or on standard contractual clauses. You can ask us for a copy of the safeguards.

7. How long we keep data

Your account and the data in section 3.1 to 3.3: while your account exists. During the closed beta we don't delete inactive accounts; we'll set a period before a public launch and tell you first.
When you delete your account: see section 8.
Reports: one year after the report is closed, longer only while needed for a legal claim.
Removal records: one year after the run.
Notice records: 90 days after the run.
Waitlist sign-ups: kept until we open Runpacks to everyone and send the invitation, then deleted within 3 months. You can ask to be removed at any time at hello@runpacks.app.
The weekly email: sign-ups never confirmed, 30 days; after you unsubscribe, your address and its send records are deleted within 30 days (see 3.12).
Shop Notify me requests: 30 days after the one email we send, or 12 months after the request if the product never becomes available (see 3.13).
Sign-in records and technical logs: up to 30 days.
Crash reports: up to 90 days (set in the crash-reporting service).
Backups: our hosting providers keep backups that are overwritten on a schedule, within 30 days.

8. Deleting your account

In the app: You → Account → Delete account. The screen lists what will happen before you confirm.

When you delete your account, all of this happens at once, or nothing does:

your account, email address, display name and "18 or older" declaration are deleted;
you leave your upcoming runs, and your places are released; your joins, past sign-ups and after-run answers are deleted;
your push tokens and your notice records are deleted;
your sign-in account at our sign-in provider is deleted;
if you organize a club, its upcoming runs are cancelled, stay visible marked Cancelled, and the runners who joined them are sent a cancellation notice. You stop being the club's organizer.

Some records stay:

a record that an account was deleted, holding only its random ID and the times, so that sign-in sessions issued before the deletion stop working. It is deleted shortly after our sign-in provider confirms the deletion.
if an organizer removed you from a run, the club's removal record keeps the name you had then, marked as a deleted account, for one year after the run.
reports you sent stay, no longer linked to your account; reports about you keep the display name you had then. They are kept for one year after the report is closed.
runs you organized and past runs keep their details and counts.

The app says the same in one line before you confirm: reports and removal records are kept for up to a year.

Without the app: see runpacks.app/delete-account.

9. Your rights

Under the GDPR you can ask us to:

give you a copy of your data (access), including in a portable format (portability);
correct it (you can change your display name by asking us; the app has no profile editor yet);
delete it (the app does this; see section 8);
restrict or object to how we use it, where we rely on legitimate interests.

Write to hello@runpacks.app from the address you sign in with. We answer within one month.

You can also complain to the Office of the Commissioner for Personal Data Protection in Cyprus (dataprotection.gov.cy), or to the authority where you live.

Where we rely on your consent (for example the phone's notification or location permission), you can withdraw it at any time in your phone's settings. For the weekly email, use the unsubscribe link in any issue, or write to hello@runpacks.app.

10. Age

Runpacks is for adults. You must be 18 or older to join runs, and you confirm this before your first join. We don't check ages. If we learn that someone under 18 has an account, we close it and delete its data. Anyone can tell us through a report ("Might be under 18") or at hello@runpacks.app; we review it within 48 hours.

11. Security

Data travels encrypted (HTTPS). Our providers encrypt stored data. Your sign-in session is kept in your phone's secure storage (the iOS Keychain or Android Keystore). Access to our systems is limited to the people who run Runpacks. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the authorities as the law requires.

12. Changes to this policy

We will post changes on this page and update the date above. For important changes we will also tell you in the app or by email before they apply.

13. Contact

hello@runpacks.app