Runsta Privacy Policy

Version 1.5, 30 September 2026

Version history

• 1.5 (30 September 2026): after withdrawing consent your runs are no longer shown to others or scored; automatic privacy zones around places where you often start or finish.
• 1.4 (30 September 2026): push notifications with your own settings, kudos and quick reactions, reporting and blocking other users.
• 1.3 (30 September 2026): new contact address info@runsta.app.
• 1.2 (30 September 2026): one automatic confirmation email after a beta application; Klixo address and KVK number filled in.
• 1.1 (29 September 2026): added beta applications on runsta.app and the website itself.
• 1.0 (29 September 2026): first version, for the launch of the app.

This policy explains which data Runsta uses, why, who can see it and what your rights are. We keep it short and concrete. Questions? Email info@runsta.app.

1. Who is responsible

Runsta is an app by Klixo, a sole proprietorship based in the Netherlands.

• Klixo (sole proprietorship)
• Address: Oldeneelweg 14, 8016 PD Zwolle, the Netherlands
• Chamber of Commerce (KVK) number: 87882531
• Email: info@runsta.app

Klixo is the controller under the GDPR. There is no data protection officer. Privacy questions are answered by the owner of Klixo directly.

2. Which data we use

Your account

• Your email address. You sign in with a one-time code sent to it.
• If you sign in with Apple: an Apple user ID and the email address Apple gives us. That may be an Apple relay address.
• Your display name and, if you set one, a profile photo.
• Your settings: language, units and, if you enter it yourself, your maximum heart rate.
• Technical sign-in data: a session key, the IP address and the type of device or browser of the session. We need these to keep you signed in and to spot abuse.

Your running data from Apple Health

Only if you give permission, Runsta reads from Apple Health:

• Running workouts: start time, time zone, distance, duration, moving time and elevation gain.
• Your heart rate during those workouts. We only keep the average and the highest value per run.
• The route of a workout (GPS). We simplify it to a line and do not keep individual measurements.
• Which device or app recorded the run, for example "Apple Watch" or "Garmin Connect".
• Whether the workout was entered by hand.

When you first connect, we fetch your runs from the last 365 days. After that, only new or changed runs. We do not read any other health data, such as sleep, weight or medical records. We never write anything to Apple Health.

Garmin and Strava (later)

If you later connect Garmin or Strava, we fetch the same kind of running data through that service. We then also store the access keys for that connection, encrypted (AES-256-GCM).

What you do in the app

• Your training plan, goal time, race results and points.
• The groups you belong to, your role and your team.
• Duels and reactions to runs.
• A push token for your device, if you allow notifications, plus your notification settings and your time zone (so we never send them at night).
• Kudos and quick reactions you give on runs in your groups. Members of those groups can see them.
• Reports you make about users, groups or runs, and the users you block. Only we see reports; blocking hides you from each other.

Beta applications on runsta.app

If you apply for the beta on runsta.app, we store what you fill in: your name, email address, the race you train for and its date, your group size, city and country, your type of phone, where you heard about Runsta and your message. We also store the language of the page, the campaign tags in the link you came from (utm parameters) and the website that sent you, without its query string. We record when you gave your consent and under which version of this policy.

We use this only to choose beta groups, to email you about the beta, and to tell you when Runsta comes to Android. After you apply, the form sends you one confirmation email, and never more than one per address. To limit abuse we count applications per IP address. We only store a scrambled (hashed) form of the address for that, and our daily cleanup removes it.

The website

runsta.app uses no cookies, no analytics and no trackers. Your browser remembers whether you closed the language hint (local storage). That stays on your device.

What we do not do

• No ads and no ad networks.
• No third-party trackers or analytics tools in the app.
• We do not sell data.
• We do not use your health data for marketing, advertising, profiling for others or data mining.

3. Purposes and legal bases

Heart rate, workouts and routes are data about your health. That is why the app first asks for your explicit consent, and only then does iOS ask for access to Apple Health. Without that consent we read nothing from Apple Health. You can still open Runsta, but plans and points will not work.

4. Apple Health (HealthKit)

• We use data from Apple Health only to provide Runsta's features: your plan, your points, your groups and your own overview.
• We do not use it for advertising, marketing or data mining. Not in anonymised form for others either.
• We do not share it with third parties, except with the processors in section 6 that we need to run the service, and with the group members you choose yourself (section 5).
• We do not store data from Apple Health in iCloud. It goes from your phone to our own server in Frankfurt.
• We never sell it.

5. Who sees what

Only you see your email address, your settings, your maximum heart rate, your recorded heart rate, your records and your full overview in the "You" tab.

Members of a friends group see your display name and profile photo, your runs (date, distance, time, pace), your route if the group shows routes, your points, your ranking, duels and reactions. In a race group they also see your goal time and how well you follow your plan.

Members of a public race group see your display name, profile photo, points, ranking, goal time and the runs that earn points. Routes are always hidden in public race groups. Anyone who picks the race can join such a group, including people you do not know. If you do not want that, use a friends group.

We do not show your heart rate to other users.

Others never see the first and last few hundred metres of your routes, and places where you often start or finish (like your home) are automatically cut out of what they see. You always see your own routes in full. Still, only share routes in groups with people you trust.

6. Processors and where your data is

We work with these parties. A data processing agreement is in place with each of them.

If we add Garmin or Strava, you bring your own data from their service to Runsta. What Garmin and Strava do with your data is covered by their own privacy policies.

7. Transfers outside the EU

Your data is stored in the EU. A few suppliers are US companies or process part of the data in the US. Those transfers are covered by the European Commission's Standard Contractual Clauses (SCCs) in the data processing agreements. Where a supplier is certified under the EU-US Data Privacy Framework, that applies as well. Resend and Expo state that they participate in that framework. Email us if you want a copy of these safeguards.

8. How long we keep data

• We keep your data as long as your account exists.
• If you delete your account in the app (Settings, Delete account), we immediately erase your account, profile, connections, runs, routes, plans, points, group memberships, duels and reactions from the database.
• A group or race you created stays available to the other members, but without your name as its creator.
• Our database keeps a short recovery history for emergencies. Erased data can remain there for up to 30 days. After that it is gone everywhere. We never restore erased data, except when recovering from an outage. In that case we erase your account again.
• Technical server logs (with IP address) are deleted automatically after a short time, at the latest after 30 days.
• Sign-in codes expire after 10 minutes.
• Beta applications: until the beta is over and Runsta is available to you, and at most 12 months after you applied. Ask us and we delete yours sooner.
• If you disconnect Garmin or Strava, we erase that connection including its keys.
• If you have not signed in for a year, we may delete your account after a warning by email.

9. Your rights

You have the right to:

• access your data. Email us and you will get an overview.
• get a copy in a common file format (JSON), so you can take it elsewhere.
• have data corrected. You can change your name, photo and settings yourself in the app.
• have data erased. Directly in the app with "Delete account", or by email.
• withdraw your consent. Turn off access in the iPhone Settings app, under Privacy & Security, Health, Runsta. Or disconnect Garmin or Strava. From then on we read nothing new, and your existing runs are no longer shown to others or counted for points (you still see them yourself). If you also want the runs we already have erased, delete your account or email us. Withdrawing does not affect what we lawfully did before. For a beta application, email us and we delete it.
• object to processing based on legitimate interest.
• restrict processing while we look into a question or complaint.

Send your request to info@runsta.app from your account's email address. We respond within one month. Sometimes we ask you to confirm it is really you.

10. Age

Runsta is meant for people aged 16 and over. If you are younger, please do not use the app. In the Netherlands you can give consent for the use of your data yourself from the age of 16. If we find out an account belongs to someone under 16, we delete it.

11. Security

• All connections between the app and our server are encrypted (HTTPS).
• Garmin and Strava access keys are stored encrypted (AES-256-GCM).
• The database is hosted by Neon and encrypted at rest.
• Only the owner of Klixo has administrative access, protected with two-factor authentication.
• We do not write sign-in codes or health data to server logs.
• If something goes wrong with your data anyway, we report it to the Dutch Data Protection Authority within 72 hours and, if the risk is high, to you as well.

12. Automated decisions

Runsta calculates your plan, points and ranking automatically. A run entered by hand does not count. This has no legal effects and does not significantly affect you. If you think a calculation is wrong, or your account was suspended for cheating, email us. A human will look at it.

13. Complaints

If you are not happy with how we handle your data, please email us first. You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or with the authority in the EU country where you live.

14. Changes

If we change this policy, you will see it in the version number and date at the top. For an important change, such as a new purpose or a new party receiving health data, we ask for your consent again in the app.