Runome Privacy Policy

1Data Controller

Business League Oy

Business ID (Y-tunnus): 3425214-2

Tekniikantie 4A, 02150 Espoo, Finland

Business League Oy develops and operates Runome, a running analytics application. Business League Oy has not appointed a Data Protection Officer. Privacy inquiries should be sent to the email address above.

2Scope

This Privacy Policy explains how Business League Oy collects, uses, stores, shares and protects personal data when users access the Runome iOS and Android applications, Runome Android application, runome.com website and related Runome services.

Runome is a fitness and running-analysis service. Runome is not a medical device and does not diagnose, treat, cure or prevent any medical condition. Users should consult a qualified healthcare professional for medical advice, diagnosis or treatment.

3Sources of Data

Runome receives personal data from the following sources:

Directly from the user when creating an account, editing a profile, entering training values, tagging activities, or contacting support
From supported health platforms with the user's explicit permission
From supported devices and data sources connected through OAuth or provider APIs
From third-party sign-in providers used to authenticate the user
From the Apple App Store and Google Play subscription systems for purchase and entitlement information
From other Runome users where the user participates in friend or challenge features
Automatically from the device and app during ordinary operation (for example, request metadata and error information)

4Data We Collect

With user authorization and consent, Runome may collect the following categories of data.

Account Data

Email address, name, and user ID
Authentication provider and third-party sign-in identifiers
Hashed password if email/password login is used
Legal-acceptance version and timestamp (terms and privacy policy consent records)
If you create an account with email and password, Runome stores a hashed password. Runome does not store plain-text passwords or payment card information.

Profile and Training Preferences

Public handle and profile picture (where set by the user)
Age, sex, weight, maximum heart rate, and resting heart rate
Custom heart-rate zones
Weekly goals and training preferences
Training Path goal, schedule, baseline, and adherence data
Profile visibility settings, including "hide profile"
Connected Service Data

Provider user IDs and provider activity IDs
OAuth access tokens, refresh tokens, and granted scopes
Sync status and connection timestamps
Activity and Running Data

Runs and workouts, dates and times, device/source name, provider activity IDs
Distance, duration, pace, speed, heart rate, max heart rate, cadence, elevation, calories
Run type/classification, splits and laps
Run names, tags, and manually entered values
GPS route coordinates, route polylines, and maps
Stream/sample data such as time, distance, speed, pace, heart rate, cadence and elevation
VO₂max estimates provided by connected services
Route and location data are private by default. Runome does not publish routes to a public feed. GPS routes are stored alongside the corresponding activity for as long as the account is active and are deleted when the activity or the account is deleted. Route data is not used for advertising.

Derived Analytics

Run Quality score, HR Cost, Aerobic Efficiency Index (AEI), Efficiency Factor (EF)
TRIMP, Fitness (CTL), Fatigue (ATL), Form (TSB)
VO₂max estimates, aerobic decoupling, HR drift, fatigue resistance, cadence stability
Insights, trends and pattern recognition derived from your data
Sleep and Recovery Data

When you connect a supported sleep or recovery data source, Runome may import:

Sleep score and readiness score
Sleep start/end time, time in bed, total sleep time
REM sleep, deep sleep, light sleep, and awake time
Resting/lowest heart rate during sleep, average sleep HR, HRV
Sleep latency, restlessness, and related recovery summaries
Health Platform Data

When enabled, data imported from supported health platforms may include workouts/runs, distance, duration, heart rate, route/location data, energy/calories, cadence, steps, and other user-authorized workout or health fields. Runome only reads fields you explicitly authorize through the relevant platform permissions.

Health platform data is not used for advertising, marketing, or data brokerage purposes.

Social Data

Friend relationships and friend requests
Challenge participation, progress, and results
Shared activity summaries visible to accepted friends or challenge participants
Subscription and Purchase Data

Runome Club product, entitlement, and subscription status
App Store transaction identifiers and App Account Token
Renewal, expiration, and cancellation events reported by the app store
Runome Club is offered as auto-renewable monthly and annual subscriptions inside the iOS application, and as a one-time Runome Club Lifetime purchase on the Runome website. "Lifetime" refers to the operational lifetime of the Runome service provided by Business League Oy, not the lifetime of the user, and lasts for as long as Runome and Runome Club are operated.

In-app subscription purchases are processed by the app store operator. One-time purchases made on the Runome website (for example, Runome Club Lifetime) are sold by Business League Oy and processed by Stripe Payments Europe, Ltd., which acts as the payment processor and, on Runome's behalf, handles tax calculation, collection, and remittance, invoicing, chargebacks, and buyer support. In all cases, Runome does not receive or store payment card details.

For website purchases, Runome receives from Stripe the transaction identifier, product and price identifier, order amount and currency, buyer email address, and coarse billing country used for tax purposes. This information is used to grant entitlements, provide support, keep accounting records, and reconcile refunds.

Support, Feedback, and Uploaded Content

Feedback and support reports submitted through the app or email
Profile images and any share media the user uploads or sends to Runome
Server Request and Error Logs

Runome's servers retain request metadata and error logs generated when the app communicates with the Runome backend. These logs may include timestamps, IP address, user or account identifier, request path, response status, and error messages, and are used only for security, debugging, and reliability. Logs are not used for advertising and are not sold.

5Purposes of Processing

Runome processes personal data for the following purposes:

Providing user accounts and authentication
Importing and syncing activity, health, and recovery data from connected services
Calculating Run Quality, training load, trends, sleep-to-run correlations, VO₂max estimates, and pattern insights for the individual user
Generating analytics, trends, and performance insights for the individual user
Operating friend, profile, and challenge features that the user opts into
Administering Runome Club subscriptions and entitlements
Responding to support requests and processing user feedback
Recording legal acceptance versions and related compliance records
Debugging sync and processing issues affecting individual accounts
Ensuring application stability, security, reliability, and abuse prevention
Personal activity, health, or route data is used to calculate features for the user who owns that data. Runome does not sell personal data, does not use personal data for advertising or marketing, and does not send identifiable personal data to third-party AI services for model training.

6Legal Basis for Processing (GDPR)

Runome relies on the following lawful bases, mapped to purpose:

Account creation, authentication, activity import, and delivery of core analytics — Contract (Article 6(1)(b))
Health, fitness, sleep, heart-rate, and related activity data that constitutes special-category personal data — Explicit consent under Article 9(2)(a), in addition to the Article 6 basis above
Location and GPS route data — Consent (Article 6(1)(a))
Runome Club subscription administration — Contract (Article 6(1)(b)) and, where applicable, legal obligation (Article 6(1)(c))
Support requests and feedback handling — Contract (Article 6(1)(b)) or Legitimate Interest (Article 6(1)(f)) in responding to the user
Server request and error logs, security, and abuse prevention — Legitimate Interest (Article 6(1)(f)) in operating a secure and reliable service
Legal-acceptance records — Legal obligation (Article 6(1)(c)) and legitimate interest in establishing legal claims (Article 6(1)(f))
Health, fitness, sleep, recovery, and heart-rate data may constitute special-category personal data under the GDPR. Runome processes this data only with the user's consent under Article 6(1)(a) and explicit consent under Article 9(2)(a).

Before Runome imports, stores, or analyzes this data, it asks for separate, versioned consent for both of the following specified purposes:

Importing and storing health and fitness data, including connected workouts, routes, heart-rate data, and available sleep and recovery data.
Analyzing that data to personalize metrics, trends, recovery insights, training plans, and recommendations.
This consent is separate from accepting the Terms of Use and Privacy Policy. It is also separate from granting Apple Health or Health Connect permissions, depending on the user's platform or authorizing a connected provider. Provider authorization controls access to the data source but does not replace Runome's health-data consent.

Both purposes must be explicitly accepted before Runome enables health-data features. Users may decline and continue using account, friend, and subscription features that do not require health data.

7Automated Processing and Analytics

Runome uses automated processing to analyze activity and health data in order to generate training metrics, trends, and insights.

These automated analyses are informational only, do not produce legal effects, and do not result in similarly significant effects on users. Personal activity data is used to compute features for the account that owns the data. Runome does not use personal data to train third-party artificial intelligence or machine-learning models.

Users remain fully responsible for how they interpret and use the information provided.

8Social Features and Visibility

Runome offers optional social features. When these are used:

A user's public handle may be searchable by other authenticated Runome users
A user's profile picture may appear in friend discovery and search
Accepted friends may see limited activity summaries the user has shared through the feature
Challenge participants may see other participants' progress, results, and relevant activity totals for that challenge
Private GPS routes and raw health streams are not exposed through friend or challenge features
Enabling "hide profile" reduces discovery and social visibility
When a user creates and exports a share image or video, the exported media may contain route or activity information. The user chooses the recipient and destination through the device's sharing interface, and the destination service applies its own privacy terms. Runome does not publicly publish routes through a Runome feed.

9Data Storage, Security, and Retention

Production data is stored on servers hosted within the European Economic Area
Data in transit is protected with TLS; credentials and provider tokens are transmitted over encrypted connections and stored using industry-standard security measures
Access to personal data is restricted to authorized personnel and backend processes required to operate the service
Retention periods

Runome retains personal data only as long as necessary for the purpose for which it was collected, or as required by law. The current retention criteria are:

Account, profile, social, and subscription data — retained while the account remains active, or for longer where required by applicable accounting, tax, consumer-protection, security, or legal obligations.
Activities, workouts, manually recorded runs, GPS routes, sample streams, health, fitness, sleep and recovery data, training paths, and derived analytics — retained only while the account and the current health-data consent remain active. This data is permanently deleted when health-data consent is withdrawn or the account is deleted, subject to the limited backup-retention cycle described below.
OAuth access and refresh tokens — retained until the service is disconnected or the account is deleted
Expired or revoked authentication sessions — removed by scheduled cleanup after the configured retention period
Successfully processed webhook events — retained up to 30 days
Failed webhook events — retained up to 90 days for debugging and reprocessing
App store subscription events — retained up to 730 days for entitlement, refund, and dispute handling
Feedback and support reports — retained until account deletion, unless required to establish or defend legal claims
Server request and error logs — retained for a limited operational period sufficient for security and debugging
Backups — retained for a limited period on a rolling basis; deletions propagate to backups within the backup retention cycle
Legal-acceptance and transaction records — retained where required by applicable tax, accounting, or legal-defense obligations
Account deletion normally propagates through production systems shortly after the request; propagation to backups occurs within the backup retention cycle.

Data Breach Notification

In the event of a personal data breach, Runome will take appropriate measures consistent with applicable data protection laws, including notifying affected users and competent supervisory authorities where legally required and within the timeframes required by law.

10Data Sharing and Disclosure

Runome does not sell or rent personal data.

Personal data may be shared only:

With infrastructure or cloud service providers acting as data processors under data processing agreements
With the app store operator to administer subscriptions and entitlements
With Stripe Payments Europe, Ltd., acting as the payment processor for purchases made on the Runome website, to process payments and, on Runome's behalf, calculate and remit sales tax and VAT, issue receipts and invoices, handle refunds and chargebacks, and provide buyer support
With other Runome users to the extent the user has opted into friend or challenge features (as described above)
When required by applicable law or by lawful requests from authorities
When you connect a third-party service, data is exchanged with that provider according to the permissions you approve and that provider's own privacy policy. Runome does not sell this data.

All processors are bound by confidentiality and data protection obligations.

11Data Processors and Infrastructure Providers

Runome uses carefully selected third-party service providers to operate the application. These providers process data only on behalf of Runome under contractual data protection obligations and are not permitted to use the data for their own purposes.

Categories of processors include:

Cloud hosting and application infrastructure providers (production hosting within the European Economic Area)
Managed database and storage providers
Authentication and third-party sign-in providers
Email delivery and customer support tooling
App store operator, for subscription administration
Stripe Payments Europe, Ltd., processing website purchases (checkout, payment processing, tax calculation and remittance on Runome's behalf, invoicing, refunds, and buyer support). Stripe's privacy policy is available at stripe.com/privacy.
Where a processor operates outside the European Economic Area, Runome relies on appropriate safeguards, such as European Commission adequacy decisions or Standard Contractual Clauses. Users may request further information about the safeguards used for a specific transfer by contacting support@runome.com.

A current list of named subprocessors will be provided on request. Runome updates this list as processors are added or replaced.

12User Rights

Users have the right to:

Access their personal data
Request correction of inaccurate data
Request deletion of their data
Request restriction of processing
Object to processing based on legitimate interests
Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal
Request data portability where the right applies under GDPR Article 20
Lodge a complaint with a supervisory authority
Requests can be submitted to support@runome.com. Runome responds without undue delay and in any event within one month of receiving the request, in line with GDPR Article 12. This period may be extended by up to two further months where necessary, taking into account the complexity and number of requests. Runome may request information necessary to verify the identity of the requester. Requests are handled free of charge unless they are manifestly unfounded or excessive.

In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi.

13Consent Withdrawal, Disconnection, and Deletion

Runome distinguishes between the following actions:

Revoke access at the provider — Removing Runome through Apple Health or a connected provider stops that provider from sharing new data. It does not by itself delete data already stored by Runome.
Disconnect one provider in Runome — Runome stops new imports from that provider and deletes its stored authorization credentials. Previously imported data remains until health-data consent is withdrawn, the Runome account is deleted, or provider rules require earlier deletion.
Withdraw health-data consent — Users may withdraw consent in Settings → Data Sync. Withdrawal disconnects all health and fitness providers, cancels active or queued synchronization, stops further import and analysis, and permanently deletes stored activities, workouts, manually recorded runs, GPS routes, sample streams, heart-rate data, sleep and recovery data, training paths, and derived training analytics.
Withdrawing health-data consent does not delete the Runome account. The account, friend relationships, and Runome Club subscription remain active. Health-data features can be used again only after the user grants the current consent again.

Delete the Runome account — Account deletion removes the user account, profile, provider credentials, stored health and training data, social data, and related user-owned records, except where retention is required by law. Deleting the account does not automatically cancel an App Store subscription; the subscription must be managed separately through Apple.

Withdrawing consent does not affect the lawfulness of processing performed before withdrawal. Deletions propagate to backups within Runome's limited backup-retention cycle.

14App Store Privacy Disclosures

Runome's app store privacy disclosures are intended to be consistent with this Privacy Policy and cover the following privacy label categories where applicable:

Contact Info (email address)
Identifiers (user IDs, provider IDs, sign-in identifiers, App Account Token)
Health & Fitness (workouts, heart rate, sleep and recovery data)
Location (GPS routes and activity location data)
User Content (profile images, run names, tags, feedback, and uploaded share media)
Purchases (Runome Club entitlement and subscription status)
Customer Support (support and feedback correspondence)
Diagnostics (server request and error data associated with the app)
App store privacy details cover both Runome's own data practices and those of third-party partners used to operate the app.

15Garmin Connect Data

When a user connects Garmin Connect to Runome, Runome collects and processes Garmin data only with the user's authorization and only for the purpose of providing Runome's fitness and training analytics features. Categories collected, retention, security, and disconnection behavior are as described in the general sections of this policy. Garmin data is not sold, rented, used for advertising, shared for data brokerage, or sent to third-party AI services for model training.

Users may disconnect Garmin at any time. Upon disconnection, Runome stops importing new Garmin data and deletes or revokes Garmin authorization tokens where supported. Data previously imported from Garmin is handled as described in the "Consent Withdrawal, Disconnection, and Deletion" section above; where Garmin's terms require deletion of imported data following disconnection or revocation, Runome deletes that data accordingly.

Garmin data submitted to Runome is submitted to Business League Oy, not Garmin. Garmin is not responsible for Runome's processing or protection of that data.

16Optional Usage Analytics

Runome offers an optional, first-party usage analytics feature labeled "Help improve Runome" inside the application. This feature is disabled by default and is enabled only after the user's affirmative in-app consent.

When enabled, Runome records account-linked daily counters of app usage. Each event may include a screen or feature name, a bounded interaction type, the date, the app version, and the platform.

Usage analytics do not include: GPS routes or location data, activity or provider IDs, raw health streams, heart-rate samples, sleep values, run names, tags, or share content.

Users may turn usage analytics off at any time in the app. Disabling the feature stops future collection and clears any pending on-device event queue. Counters already stored on Runome's servers remain until the account is deleted or the counters expire under the retention criteria in the "Data Storage, Security, and Retention" section.

The legal basis for this processing is consent under Article 6(1)(a) GDPR.

17Android and Health Connect

On supported Android devices, Runome can connect to Health Connect after the user grants the required Android permissions and separately consents to Runome's processing of health and fitness data.

Depending on the features selected by the user and the data available in Health Connect, Runome may read:

Exercise and running sessions
Exercise routes and GPS coordinates
Distance
Heart rate
Speed
Step cadence
Steps
Total calories burned
Elevation gained
Historical health and fitness records made available by Health Connect

Runome uses this information to import the user's runs, display activities, calculate running metrics, generate training-load estimates, produce trends and comparisons, and provide personalized fitness and training analysis.

Exercise-route access may require an additional confirmation for an individual route. Runome does not attempt to bypass Health Connect permission controls.

Health Connect synchronization can be disabled from Runome's settings. Users can also manage or revoke Runome's permissions through Android's Health Connect settings. When synchronization is disabled or access is revoked, Runome stops importing new Health Connect data. Previously imported data remains in the user's Runome account until the relevant activities or the account are deleted, unless the user separately requests its deletion.

Health Connect data is used only to provide or improve user-facing Runome health and fitness features. It is not sold, used for advertising, used to determine creditworthiness, or provided to data brokers. Runome does not use identifiable Health Connect data to train third-party artificial-intelligence models.

18Android Location and Activity Recognition

When a user starts recording a run on Android, Runome may use precise location to record the route, distance, speed and progress of that user-initiated activity. Recording may continue while the screen is off or Runome is in the background. Android displays an ongoing foreground-service notification while the run is being recorded.

Runome may use Android activity-recognition access during an active recording session to support workout and cadence tracking. Runome does not use this permission for advertising or unrelated background profiling.

Recorded and imported GPS routes are private by default. They are stored with the corresponding activity and are not published to a public Runome feed. A route may appear in an image or video only when the user deliberately creates an export and chooses to share it.

19Camera-based Heart-rate Measurement

Runome includes an optional camera-based pulse-measurement feature on compatible Android devices with a rear camera and working flash. The feature is started deliberately by the user.

Camera frames are analyzed temporarily and locally on the device to estimate pulse. The camera frames are not stored, uploaded to Runome or shared with third parties. The resulting heart-rate measurement may be saved as part of the user's recorded activity and processed in the same way as other heart-rate and fitness data.

Camera-based measurements are estimates, may be unavailable on some devices, and must not be used for medical diagnosis or treatment.

20Google Play Purchases

When a user purchases Runome Club through the Android application, Google Play processes the payment. Runome does not receive or store the user's complete payment-card details.

Runome may receive and process the product identifier, purchase token, transaction or order identifier, subscription status, entitlement status and related verification information needed to confirm the purchase, prevent fraud and provide Runome Club access. Runome sends the purchase token and related identifiers to the Runome server for verification.

21Optional Product-usage Analytics

Runome asks users whether they wish to share limited product-usage analytics. This choice is optional and does not affect access to ordinary app features.

When enabled, Runome may collect account-scoped events such as:

Screens opened
Information panels opened
Run details opened
Trend or route metrics selected
Completed share exports
Provider connection or synchronization actions
Analytics preference changes
Application version, platform and event time

These analytics do not contain GPS routes, run identifiers, raw health streams, camera frames, passwords, provider credentials or the content of exported share cards. Users can disable product-usage analytics in Runome settings. Disabling it stops new collection and clears pending analytics stored by the application.

22Maps and Mapbox

Runome uses Mapbox to display maps and route visualizations. When Mapbox maps are displayed, Mapbox processes requests for map styles, tiles and related resources and may receive de-identified device, location and map-usage telemetry according to Mapbox's terms and privacy practices.

Runome provides Mapbox attribution and access to the applicable Mapbox telemetry controls. Runome does not provide Mapbox with Runome account passwords or Health Connect health streams.

23Account and Data Deletion

Users can permanently delete their Runome account from the account settings inside the Runome mobile application. Users who no longer have access to the application can request deletion at: https://runome.com/delete-account

Account deletion removes the Runome user account and associated user-owned data, including profile information, stored activities, GPS routes, health and fitness data, derived analytics, settings, provider credentials, friend relationships, challenge data and other account-linked content.

Runome may retain limited information where required by law or reasonably necessary for accounting, transaction records, security, fraud prevention or the establishment, exercise or defence of legal claims. Any retained information is restricted to those purposes and retained only for the necessary period. Deletion may take time to propagate through limited backup-retention systems.

Runome verifies web-based deletion requests before processing them. Users must never send their password, Google credentials, Apple credentials or provider access credentials by email.

Deleting a Runome account does not automatically cancel an Apple App Store, Google Play or website subscription. Users must cancel recurring subscriptions through the store or payment service where the purchase was made.

24Website and Launch List

The runome.com website allows visitors to submit an email address to join the Runome launch list. Runome collects the email address and the platform preference (Apple or Android) provided in the form. This information is used only to notify the subscriber about the Runome launch and closely related product announcements.

The legal basis is consent under Article 6(1)(a) GDPR. Subscribers may unsubscribe at any time by using the unsubscribe link in any email received or by contacting support@runome.com. Launch-list data is retained until the subscriber unsubscribes or requests deletion, or until the launch list is retired.

Launch-list emails are not used for third-party advertising and are not sold.

25Cookies and Website Analytics

The runome.com website uses a small number of cookies and similar technologies. These fall into two categories:

Strictly necessary — cookies and local storage entries required to operate the site, remember the visitor's cookie choice, keep the checkout session working, and maintain basic security. These are set without consent because the site cannot function without them.

Analytics (Google Analytics 4) — Runome uses Google Analytics, provided by Google Ireland Limited, to understand aggregate site usage (pages viewed, referrer, approximate location, device and browser type). Google Analytics is loaded only after the visitor gives affirmative consent through the cookie banner and is fully blocked before that using Google Consent Mode v2 (all advertising, analytics, personalization, and functionality storage default to denied).

Runome does not use advertising cookies, does not run ad retargeting, and does not sell website data. Google Analytics data may be transferred to and processed by Google in the United States under Standard Contractual Clauses and the EU–US Data Privacy Framework.

Visitors may withdraw consent at any time by clearing the runome_consent entry from their browser's site storage, which will cause the cookie banner to reappear on the next visit, allowing a new choice. Rejecting analytics cookies does not affect access to any part of the site.

The legal basis for strictly necessary cookies is Runome's legitimate interest in operating a functional website (Article 6(1)(f) GDPR) and, where applicable, the ePrivacy exemption for cookies strictly necessary to provide a service explicitly requested by the user. The legal basis for analytics cookies is consent under Article 6(1)(a) GDPR and section 205 of the Finnish Act on Electronic Communications Services.

26Children's Privacy

Runome is intended for users aged 16 and older. Runome does not knowingly collect personal data from anyone under 16. Registration requires confirmation that the user meets this minimum age. If Runome learns that personal data of a person under 16 has been collected without appropriate authorization, that data will be deleted.

27Changes to This Policy

This Privacy Policy may be updated as the application evolves.

Each version is identified by an effective date and version identifier shown at the top of this page, and the corresponding version is recorded when the user accepts the policy. Material changes will be communicated in advance through the application, by email, or by other appropriate means. Where required by applicable law, users may be asked to review or consent to material changes — particularly those affecting consent or special-category data — before continued use of the affected features.

28Contact Information