LEGAL / PRIVACY NOTICE
YOUR DATA.
YOUR RUN.
This notice covers the public website and the Raptor Run mobile and web app. It describes the data actually used for run recording, cloud restore, groups, and optional integrations.
We do not sell personal data and do not use advertising trackers. Precise routes are sensitive: a reduced route copy is stored with your account for cloud restore, while your device keeps the fuller run record. A GPX export can contain the full route.
1. Who is responsible
The controller is the Raptor Run developer or business identified as the seller or provider in the store or distribution channel from which you obtained the service, operating from the United Kingdom under the trading name Raptor Run. Contact: [email protected]. If a registered business becomes the controller, this notice and the store listing will be updated with its registered details.
2. Data we handle
Email, authentication identifiers, sign-in provider, call sign, optional real name and avatar. Used to authenticate you, operate the account, and identify you in groups. A real name stays private unless you enable group sharing.
GPS coordinates, time, speed, heading, accuracy, altitude, and route segments collected during an active run. Used for route, distance, pace, splits, best efforts, chase logic, maps, exports, and restore. The device keeps fuller route data; a time-downsampled copy is stored in Supabase for sync and restore.
Step count, cadence, motion classification and confidence, relative altitude, moving time, intervals, fitness level, goals, workouts, achievements, body weight if entered, and performance calculations. Used for run recording, calorie estimates, personalisation, and progress features.
Date, duration, distance, mode, difficulty, chases, escapes, encounters, XP, medals, field-guide progress, missions, streaks, title, mood, notes, and calculated insights.
Group membership, challenge settings, call sign, leaderboard statistics, and optional real-name sharing. Other members can see the information presented in their group.
Files or images you choose to export through the device share sheet.
Device, app version, operating system, network and security records, error and performance information, and messages you send to support. Precise route data should not be deliberately attached to diagnostics.
The hosting service may process IP address, browser, requested URL, referrer, and time in ordinary server and security logs. Google receives a font request when the current public website loads its display fonts.
3. Where data comes from
Data comes from you, your device and sensors while you use the app, calculations made from your runs, other group members' activity, Apple or Google if you use their sign-in, and service providers that report security or technical events.
3a. Launch notification list
If you enter an email address into the launch-notification form on this website, we store that address so we can tell you once when Raptor Run is available to download. We do so on the basis of your consent, which you give by submitting the form and can withdraw at any time. The address is not used for any other message, is not combined with app account data, and is not shared with anyone. It is held until the launch message has been sent or you ask us to delete it, whichever comes first. To be removed before then, email [email protected].
4. Why we use it and our legal bases
- Provide the service and perform our contract: accounts, run recording, route restore, progress, groups, exports, support, and requested integrations.
- Your consent: device access to precise location and motion; processing fitness or body information where law treats it as health data; and any optional analytics or similar device storage that requires consent. You may withdraw permission in device settings and withdraw optional processing without affecting earlier lawful use.
- Legitimate interests: securing accounts, preventing cheating and abuse, diagnosing faults, understanding aggregate service performance, and defending legal claims, where those interests are not overridden by your rights.
- Legal obligations and vital interests: complying with valid law, protecting rights and safety, and responding to an emergency where the law permits and the information is available. Raptor Run is not an emergency-monitoring service.
Run and fitness information can reveal health-related information and may be “special category” or sensitive personal data in some places. We process it to provide the fitness service you request and, where required, on the basis of explicit consent. We do not use it for advertising, eligibility, employment, insurance, or automated decisions with legal or similarly significant effects.
5. When data is shared
- Supabase: authentication, database, cloud sync, and server functions.
- Apple and Google: sign-in and app distribution where you use those services.
- CARTO and OpenStreetMap: map tiles requested as you view a route, which indicates the general area of a run. No account details or run statistics are sent with a tile request.
- Sentry: crash and performance diagnostics if enabled for the release.
- PostHog: limited product events only if enabled and where any legally required consent has been obtained; advertising profiles and automatic page capture are not part of the configured design.
- Website and map providers: the website host/CDN, Google Fonts, OpenStreetMap contributors and CARTO map services receive technical requests needed to deliver their content.
- Group members and recipients you choose: group information, exports, share images, or other data you deliberately send.
- Authorities, advisers, or a successor operator: where reasonably necessary for law, safety, claims, professional advice, or a genuine business transfer with appropriate protection.
We do not sell personal data. We do not share personal data for cross-context behavioural advertising or targeted advertising as those terms are used in US state privacy laws.
6. International transfers
Providers and recipients may process data outside your country, including in the United Kingdom, European Economic Area, and United States. Where transfer restrictions apply, we rely on an adequacy decision, approved contractual clauses or addenda, a provider certification recognised by law, a transfer you request yourself by exporting or sharing, or another lawful safeguard. You may ask for information about the safeguard used for your data.
7. Retention
- Account, profile, cloud progress, group, and run data are kept while the account is active or until you delete the relevant run/history or account.
- Local run files and preferences remain on the device until cleared, deleted, reset, or removed by the operating system. Uninstall behaviour depends on the platform.
- The on-device diagnostic log is kept until you clear history, reset, sign out, delete your account, or remove the app. It records movement as distances from where a run began, not as map coordinates.
- Support, security, diagnostic, and legal records are kept only as long as reasonably needed for the issue, security, limitation periods, or a legal duty.
- Deletion from active systems may not immediately remove encrypted backups; backup copies expire or are overwritten on the provider's normal protected cycle and are not restored except for continuity or disaster recovery.
8. Security
We use authentication, encrypted transport, access controls, database row-level security, restricted server functions, provider safeguards, and data minimisation. No service can promise absolute security. Protect your device and account, use a unique password, install updates, and contact us if you suspect misuse.
9. Your choices and rights
Depending on where you live, you may have rights to know or access data, correct it, delete it, receive a portable copy, restrict or object to processing, withdraw consent, opt out of sale, sharing, targeted advertising or certain profiling, appeal a refusal, and complain to a regulator. You will not receive discriminatory treatment for exercising a privacy right.
- Use Settings to change profile choices, clear run history, turn anonymous usage data on or off, export supported run data, or delete the account.
- Use device settings to control location, motion, notification, and other permissions.
- Email [email protected] for a broader request, an authorised-agent request, an appeal, or information not available in the app. We may verify identity and authority before acting.
UK users may complain to the Information Commissioner's Office. EEA users may contact their local data protection authority. Other users may contact the regulator or attorney general responsible for privacy where they live.
10. Regional privacy rights
The general rights in section 9 apply wherever local law provides them. In particular:
- United Kingdom, EEA, and Switzerland: you may have rights of access, correction, erasure, restriction, portability, objection, consent withdrawal, and complaint to a supervisory authority. You may also ask about transfer safeguards.
- California and other US states: in the preceding 12 months we have collected identifiers, internet or network activity, precise geolocation, user-provided content, activity, fitness and potentially health information, and related personalisation inferences. We have not sold these categories or shared them for cross-context behavioural advertising. Where applicable, you may request access, correction, deletion, or portability and appeal a refusal.
- Canada: where federal or provincial privacy law applies, you may request access or correction, withdraw consent subject to legal or contractual limits, and challenge compliance through the contact above.
- Brazil: where the LGPD applies, you may request confirmation, access, correction, anonymisation, blocking or deletion, portability, information about sharing, review of covered automated decisions, and consent withdrawal.
- Australia: where the Privacy Act applies, you may request access or correction and complain to us before contacting the Office of the Australian Information Commissioner.
Some rights are limited or differ by location. We will apply the law that covers the request and explain any refusal.
11. Children
Raptor Run is intended only for adults aged 18 and over. We do not knowingly permit children to create accounts or provide precise location and fitness data. If you believe a child has used the service, email [email protected] so we can investigate and delete the account and associated data where appropriate.
12. Route-sharing warning
Shareable route images aim to remove approximately the first and last 150 metres, but no redaction method guarantees that a home, workplace, or other sensitive place cannot be inferred. GPX exports can include the full route. Review content and recipient settings before sharing.
13. Changes
We will update this notice when data practices, providers, or law materially change. For significant changes we will provide additional notice in the app or by another appropriate method and request renewed consent where required.
14. Contact
Privacy requests and questions: [email protected]. Do not include passwords or unnecessary route or health details in an ordinary email.
Effective and last updated: 23 September 2026. Previous versions may be requested by email.