Privacy Policy

1. The short version

Rundoroo records your runs on your iPhone. You can track a run, hear interval coaching, and keep local history without an account or internet connection. Optional live Crew sharing needs an internet connection and starts only when you open a sharing session. Opening sharing does not start your workout clock.

Crew messages and detailed shared progress are encrypted between the participating devices. Our relay can still see operational information needed to run the service, including device and session identifiers, permissions, message routing, timing, and size. End-to-end encryption does not make that metadata disappear.

Location sharing is a separate choice and is off by default. You control which approved Crew devices may see a recent location. Closing a session clears unsaved private content on your phone and requests deletion from the relay. It cannot retract copies people already received or saved.

We do not use an advertising SDK, sell data, build advertising profiles, or use cross-company tracking in this implementation. There are no user accounts, public profiles, or automatic cloud workout-history sync.

2. Information on the runner’s iPhone

During a workout, Rundoroo records coordinates, timestamps, altitude, and available location-quality information. It calculates distance, active and total duration, pace, splits, and interval events. Saved history may also include pause events, cue markers, shoe assignment, and diagnostic information about recording quality. Shoe names and starting mileage are stored locally.

Workout location recording starts with the workout and stops when it ends. Pausing stops adding workout distance. Separately consented live location sharing can operate before a workout starts; turning that sharing off stops that separate use. Permission changes may affect tracking and sharing, but the app does not require optional Crew sharing or Health access to run a workout.

Completed workouts remain in app storage. The current version does not have an individual-workout Delete button. iOS app-storage controls can remove app files; this does not delete separate Health records, saved or exported copies, or any remote session whose deletion is still pending. App removal alone is not proof of remote deletion.

Local workout files use iOS file protection. They are not explicitly excluded from normal device backups, so your iPhone or computer backup settings may create additional copies. That is different from our temporary relay storage. We do not promise that “local” means no device backup can exist.

The optional Live Activity can show workout phase, elapsed time, distance, and pace on your Lock Screen. It does not display private cheer text, a sender’s name, or a shared location. Consider who can see your phone when enabling Lock Screen features.

3. Maps, Apple Health, and exports

Maps

The apps use Apple’s MapKit to display recorded routes or a permitted latest shared location. Map display may need network access to load map content for the area you view. Route recording itself does not need map tiles or cellular data. Apple’s processing of requests to its services is governed by Apple’s terms and privacy information. There is no third-party advertising map SDK in the app.

Apple Health

If you choose to enable it and grant permission, Rundoroo can write completed outdoor-running workouts, distance, and workout routes to Apple Health. It requests workout and workout-route read permission for saving and verifying the workouts it creates; the current implementation does not read other apps’ workout history. The app remains usable when you decline. Health records are a separate copy controlled through Apple Health and your Apple settings; closing Crew sharing does not remove them. We do not upload Health records to the Crew relay.

Workout diagnostic export

When you deliberately choose Share JSON for a run, the export includes the saved workout’s precise route, timestamps, metrics, shoe information if present, and available diagnostics. A warning appears before the share sheet. Nothing is uploaded merely because the app records a workout or prepares the export. You choose the destination or recipient, whose handling of the copy is outside the app’s control.

Saved cheers

During review, you may explicitly save a chosen message as text or original audio through Files. These saved copies remain after the live session closes. Deleting them later is your choice in the destination where you saved them.

4. Opening live sharing and approving Crew

The runner opens a live sharing session separately from pressing Start on a workout. This lets you invite Crew during preparation without adding to your run time.

Message-only sharing is the default. Live progress is part of the session; a precise latest location requires the runner’s separate consent and permission for each approved device. Invitations are temporary, one-use links. The runner verifies the actual device-key code before approving a Crew device. Share invitations only with people you intend to invite; the app or service you use to send the link may receive a copy of it.

Crew does not read its own phone’s location to show the runner’s shared point. It receives only the information the runner has permitted. The apps do not upload a contact list or require social-media, Spotify, or other service accounts.

An approved person can copy, record, or otherwise retain information they receive. Revocation prevents future authorized access but cannot make that person forget or delete an existing copy.

5. Text and original voice messages

Crew asks for a sender name and a short message. The name and message body are encrypted for the recipient, not sent to the relay as readable text. Text is spoken using native on-device speech tools; the app does not send it to a remote text-to-speech service.

You can use the system keyboard’s dictation feature to enter text. Dictation is provided by Apple and follows its permissions and settings; this app does not provide its own cloud transcription service or promise that every system-dictation mode is offline.

Original voice recording starts only after you tap Record and grant microphone permission. Recordings are limited to 30 seconds. The app stops capture when it moves to the background. It uses a protected temporary file that is excluded from backup, converts the recording to message data, and attempts to remove the temporary file when it is ready or discarded. Startup also attempts cleanup of owned unfinished recording files. A recording or cleanup failure may require another attempt; we do not claim forensic or instantaneous secure erasure.

The runner receives messages for playback during a suitable recovery period. Played, received, and submitted states are different; a playback receipt is not a guarantee the runner heard or understood the message. Unsaved messages may remain available for review after playback. They are not automatically appended to workout history.

Leaving Crew clears that phone’s local drafts, session keys, and private state. A message already submitted may still reach the runner. Runner revocation can stop future sending or playback, but previously received content can remain in the runner’s review until Close or expiry.

6. What the relay and service providers can see

The relay is a temporary internet delivery service hosted on DigitalOcean, not a cloud archive of your runs. Private message bodies, names, original recordings, detailed progress, precise coordinates, and receipts travel as end-to-end encrypted payloads. Private decryption keys remain with the participating devices in the current design; the relay has no private-content decryption operation.

The relay retains readable operational metadata: random session and device identifiers, public keys, sharing scope, approval and revocation records, workout phase and Start or Finish times, sender and recipient identifiers, message type or lane, sequence, size, creation and expiry times, and delivery cursors. It stores digests of access capabilities rather than putting those secrets into logs. Some access capabilities are necessarily presented to the service to authorize a request.

If push is enabled and the relevant app is registered, the service also receives an APNs routing token, its environment, and notification opt-in state. Apple handles push transport. Push notifications contain generic prompts or change hints, not a private cheer body or coordinate. Selected milestone hints reveal timing but do not include the exact mile value in the readable push hint. Notifications may be delayed or missed, especially under operating-system power and background limits.

Network requests expose an IP address to the systems handling them. The relay keeps bounded source-IP rate-limit records in memory for security for up to one hour. The front-end web server also uses in-memory rate limiting. This implementation does not derive a location from those IP addresses. The reviewed service configuration disables request, body, and token logging; that is not a claim that no network or hosting provider ever processes connection metadata.

The apps use ephemeral networking without an app cookie store or persistent URL cache for the relay. Data is not sent to advertising networks or analytics SDKs. Hosting and Apple services still have their own operational responsibilities; encryption does not hide network endpoints, timing, or all metadata from them.

The Rundoroo website

This informational website is hosted using OpenAI Sites and Cloudflare infrastructure, separately from the Crew relay. Website requests expose information such as your IP address, browser information, requested page, and request time to the hosting systems. This site does not include an advertising or analytics SDK, a sign-up form, or an automatic workout-report uploader. The relay-specific retention and logging settings above do not describe the website host’s own operational records.

7. Live location and session retention

Only location-approved recipients receive a precise latest point. The relay keeps only the latest encrypted state for each recipient, not a readable route history. Shared state expires 60 seconds after its sample time, and outdated state is rejected rather than presented as a fresh position. A permitted recipient may see or save the point before it expires. Finish removes the relay’s latest-state records; revocation removes the revoked recipient’s latest state.

Current session limits are:

• Up to 2 hours preparing before a workout starts.
• Up to 8 hours in the running phase.
• Up to 30 minutes of review after Finish.
• An absolute cap of 10 hours from opening the session, even if the other phase limits would end later.

These are sharing-session time limits, separate from active workout elapsed time. Finish stops new sending and cheer playback and removes live location, while allowing review of messages already received. Unsaved message and receipt ciphertext remains bounded on the relay until Close or session expiry; it is not deleted just because a message played.

The service checks expiry on requests and with a periodic cleanup process. A disconnected or suspended phone may not update its visible state until it runs again. The limits describe application access and deletion behavior, not a promise that every storage device is physically overwritten at the exact expiry instant.

8. Close, offline deletion, and remaining copies

Closing a runner session immediately clears the local unsaved private session state and independently requests relay deletion. If the phone is offline or the request is not acknowledged, the app says remote deletion is pending rather than claiming it succeeded. The relay also expires the session on its own deadline.

To retry deletion after a restart, the runner can retain a small device-only Keychain record containing a session ID, relay endpoint, recorded absolute expiry, and a delete-only capability. It cannot read, send, or decrypt messages. It is retained until the relay acknowledges Close, including when that takes longer because the phone or service is unavailable. The recorded expiry does not itself delete that local retry record. Reopening the app with connectivity lets it retry.

An acknowledged Close deletes active relay session records and ciphertext. A limited tombstone containing a random session ID, close-capability digest, and expiry remains temporarily to reject delayed requests that could resurrect a closed session. It normally ends at the original session’s absolute expiry; an early Close for a session the server has not seen can create a tombstone lasting up to 10 hours from that request.

Closing or revoking does not delete workout history, shoe mileage, Apple Health records, Files exports, copies already received by another person, ordinary device backups, or notifications already delivered. Restarting the app intentionally loses unsaved private messages and their decryption keys; it is not a recovery system for unsaved cheers.

Rundoroo has disabled automatic relay backups and snapshots for this temporary-session deployment. This is a configuration and retention policy, not a claim of independently verified physical erasure across a provider’s infrastructure. We do not promise that deletion eliminates every residual storage bit, recipient copy, or external backup.

9. Your controls and support requests

You can decline optional sharing, leave location sharing off, approve only selected devices, revoke a device, leave Crew, close a session, and decline microphone, notification, or Health permissions. iOS settings also let you change permissions. These choices have different effects: revoking microphone access does not retract a submitted recording, and turning off notifications is not the same as closing a sharing session.

The current pilot has per-session approval, revoke, and Leave controls. It does not offer a complete public-user abuse-reporting or moderation workflow and is not offered for unrestricted public messaging.

For a privacy question, deletion question, or support request, contact support@clean.tools. Do not send keys, credentials, full routes, or family recordings unless they are necessary and you deliberately choose to share them. The apps have no automatic support uploader.

We use voluntarily submitted support material only to investigate and respond to the issue. We manually delete raw reports and identifying attachments within 30 days after the support issue is resolved, unless the sender explicitly requests a different period. This is a support-handling practice, not an automated deletion timer in an app or the relay. Send a deletion request to the same support address. Copies already shared outside our control remain separate.

10. Family participation and children

The initial pilot is invitation-only and managed by consenting adults. A parent may choose whether to record a child’s encouragement on the parent’s own device and should avoid unnecessary identifying or sensitive details.

Children independently operating Crew on their own devices would be a different product and privacy scope. That use is not included in the current pilot. This policy does not claim compliance with child-privacy laws or eligibility for Apple’s Kids Category. Please do not submit children’s ages, identity documents, or extra personal information for the pilot.

11. Changes and contact

We will update this policy and affected in-app disclosures before materially changing these practices. New purposes such as analytics, account services, or public sharing are not covered by this policy.