Privacy Policy

1. Introduction

Runapy ("we," "our," or "us") operates the Runapy mobile application and the runapyhub.com web platform. This Privacy Policy explains how we collect, use, and protect your information when you use our services.

The data controller is Runapy, Zietenstr. 42, 40476 Düsseldorf, Germany. You can contact us at support@runapyhub.com.

2. Pilot Access Requests

While Runapy is in an approval-only pilot, we collect a small amount of information when you request pilot access through this website:

• What we collect: your email address, the page or button you signed up from, the date and time you consented, the exact consent notice you agreed to, the version of this policy at the time, your IP address, and your browser's user-agent string.
• Why (lawful basis): your explicit consent, which you give by ticking the consent box on the waitlist form. Under the EU / UK GDPR this is Article 6(1)(a); under CAN-SPAM and Canada's CASL we treat it as express opt-in.
• What we use it for: to review and respond to pilot access requests, send club-owner onboarding details, and share future launch or SaaS plan updates. Nothing else. We do not sell, rent, or trade waitlist emails, and we do not use them for unrelated marketing.
• Processors: the signup is stored with our email platform provider, which processes the data on our behalf under a Data Processing Agreement. We do not load non-essential analytics cookies unless a consent flow is added.
• Retention: kept until 90 days after public launch, or until you unsubscribe or ask us to delete it — whichever comes first.
• How to withdraw consent: click the unsubscribe link in any email from us, or email support@runapyhub.com. Withdrawing consent does not affect the lawfulness of processing that happened before.
• International transfers: our providers may process data in the United States and the European Union. Where required, we rely on the EU Standard Contractual Clauses and equivalent UK safeguards.

3. Information We Collect (App & Platform)

Once Runapy launches, we collect the following types of information:

• Account Information: Email address, display name, and password when you create an account.
• Club Membership Data: Which clubs you belong to, your role (member, admin, owner), and your event participation history.
• Event Check-in Data: Records of QR code check-ins at club events, including timestamps.
• Device Information: Device type and push notification tokens (if you enable notifications).
• Payment Information: Club administrators who subscribe to paid plans provide payment details, which are processed and stored by our payment processor (Paddle). We do not store credit card numbers.

4. How We Use Your Information

• To provide and maintain the Runapy platform
• To authenticate your identity and manage your account
• To enable club membership, event registration, and check-in features
• To send push notifications about events (with your permission)
• To process subscription payments for club administrators via Paddle
• To improve our services and fix bugs
• To comply with legal, tax, accounting, and security obligations

5. Data Storage and Security

Your data is stored securely using Supabase, which provides encryption in transit and security controls for database access. Authentication tokens are stored on-device. We implement row-level security policies to ensure users can only access data they are authorized to view.

6. Data Sharing

We do not sell your personal data. We share information only in the following cases:

• With your club: Club administrators can see member names, roles, and event attendance within their club.
• Service providers: We use third-party services (Supabase for data, Paddle for payments, Expo for push notifications) that process data on our behalf.
• Legal requirements: If required by law or to protect our rights.

7. Subprocessors

To operate Runapy we rely on a small set of vendors ("subprocessors") who process personal data on our behalf. Each is bound by a Data Processing Agreement that requires them to protect your data at least as carefully as we do, to process it only on our written instructions, and — for transfers outside the EEA — to do so under the EU Standard Contractual Clauses or an equivalent safeguard.

If we add or replace a subprocessor, we'll update this list before the change takes effect. You can request the then-current list at any time by emailing support@runapyhub.com.

8. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your account and associated data
• Object to or restrict certain processing where applicable law gives you that right
• Request a portable copy of data you provided to us
• Leave any club at any time from the app
• Disable push notifications through your device settings

Waitlist signups can be managed self-serve: unsubscribe with one click from any email we sent you, or permanently delete your waitlist data at any time. For anything else — or to exercise these rights against the main app — contact us at support@runapyhub.com.

9. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except where we are required to retain it for legal, tax, accounting, security, dispute-resolution, or compliance purposes.

10. Children's Privacy

Runapy is not intended for children under 16 in the EEA / UK, or under 13 elsewhere. We do not knowingly collect personal information from children in those age groups. Waitlist signups require users to confirm they are 16 or older before submitting the form.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice in the app or sending an email.

12. Contact Us

If you have questions about this Privacy Policy, contact us at support@runapyhub.com.