1. Controller and scope
Runquest is the Service operator and controller for the personal data described in this policy, except where a third party acts as an independent controller. The legal seller is identified in the applicable Apple App Store or Google Play listing. For privacy requests, contact privacy@runquestapp.app.
2. Personal data we process
We process account and profile details, authentication identifiers, selected preferences, workout records, route coordinates, distance, duration, pace, elevation, calories, heart rate, cadence, cycling power, speed, territory claims, social interactions, support requests, reports, blocks, notification settings, push tokens, purchase entitlement status, diagnostics, and product analytics.
Precise location is processed when you record a workout or use a location-based feature. Background location is processed only during an active recording when you grant that permission, so the recording can continue while the app is not in the foreground.
3. Purposes and legal bases
We use personal data to provide and secure the Service; authenticate accounts; record activities; calculate workout metrics; render maps; generate territory claims; provide social, safety, support, and notification features; prevent fraud and abuse; restore purchases; maintain and improve reliability; and comply with legal obligations. Where applicable law requires a legal basis, we rely on performance of our contract with you, your consent, our legitimate interests in operating a safe and reliable service, and legal obligations.
4. Location, activities, and visibility
Your recorded route can create activity maps and territory visuals. Territory data is derived from route data. Your profile and activity visibility settings affect what other users can see. Do not record or publish routes that disclose sensitive places or information about you or another person.
Map display and route calculation are not navigation or safety services. Location, GPS, map, route, and territory information can be inaccurate or incomplete.
5. Health platform permissions
If you choose to connect Apple Health or Health Connect, Runquest requests only the workout data and permissions needed for the features you enable. Imported workouts are private by default and are not eligible for territory capture or public competition. We do not use connected health data for advertising and do not sell it.
You may stop synchronization in Runquest settings and revoke Apple Health or Health Connect permissions through the controls provided by those platforms. Disconnecting stops future synchronization; it does not automatically remove data already imported into your Runquest account.
6. Recipients and service providers
We disclose data to service providers that process it on our behalf, including providers for backend infrastructure, maps, app delivery, push notifications, diagnostics, analytics, and subscription entitlements. Current examples include Supabase, Mapbox, Expo, RevenueCat, Apple, and Google, depending on the feature and device you use. Providers may process data in countries other than yours under their own terms, privacy notices, and contractual safeguards where required.
We may also disclose data when required by law, to protect users or the public, to enforce our terms, or in connection with a merger, financing, sale, or transfer of all or part of the Service.
7. Retention
We retain account and activity data while your account is active and for the period reasonably needed to provide the Service, resolve disputes, enforce agreements, meet legal obligations, and protect against fraud or abuse. When you delete your account, we delete or anonymize account-linked data, subject to limited retention required for those purposes. De-identified and aggregated data may be retained.
8. Your choices and rights
You can manage activity visibility, connected health permissions, notifications, and certain profile settings in the app or operating-system settings. You may request access, correction, deletion, restriction, objection, portability, or withdrawal of consent where these rights apply. You may also request account deletion through the app or the data deletion page. We may need to verify your identity before acting on a request.
9. Children
The Service is not directed to anyone under 18. Do not use the Service or provide personal data if you are under 18. If you believe a child has provided personal data to us, contact us so we can take appropriate action.
10. Security, changes, and contact
We use reasonable technical and organizational measures designed to protect personal data, but no system is completely secure. We may update this policy when the Service or applicable law changes. Material changes will be posted here with a revised effective date. Privacy requests: privacy@runquestapp.app.