Who is responsible
Rund is a location-based running and community app operated by Emre Pehlevan, the controller of the personal information described here. Use the contact form at https://rund.run/support.html for support, privacy requests or questions about this notice. This notice covers the Rund app, rund.run, accounts, running, social features, organizations, races and Rund Pro.
A persona, not a public identity
Other runners normally see a persona, runner number, game color and permitted game statistics rather than your real name. You decide whether to add a name, phone number or photo. Identity sharing with a buddy requires the relevant reveal choice; race profile sharing is selected separately for each event. You can revoke a buddy connection or leave an event. These choices do not make an account anonymous to Rund: account identifiers, activity and information you supply are linked to your account.
Territory shapes, race results and shared content can reveal context even without a name. Do not put your home address, contact details or other sensitive information in a persona, public content or a route you share. Organizers are different: enabling an organization's public identity requires a separate choice and makes the organizer's name and photo public. Participant privacy settings do not hide that organizer identity.
Information we collect
Account and identity: account and runner identifiers, sign-in provider identifiers, email, password credentials stored as hashes, verification status, session records, chosen gender including an unspecified option, date of birth for eligibility, language and optional name, phone and photo. Apple may provide a private relay address instead of your ordinary email.
Activity and location: GPS coordinates, timestamps, route geometry, distance, duration, pace, territory ownership, checkpoints, flags, results, streaks, cards and awards. Precise location is collected for features that require it after device permission. Background location is used during an active tracked outing, not as a requirement for browsing the map.
Social and event data: memberships, buddies, direct-message and room content you provide, organization announcements, invitations, participation requests, selected profile visibility, blocks, reports, moderation actions and consent choices. Delivery details for a physical reward are requested separately when claiming that reward.
Device and purchase data: app/device information needed for operation and diagnostics, push tokens if enabled, security and request logs, Apple transaction identifiers, subscription product, environment, expiry and entitlement status. Apple handles payment; Rund does not collect your payment card number.
Optional Apple Health
Apple Health is optional and is not required to create an account, browse or use ordinary running features. If you explicitly connect it, the app can use the activity, workout, distance, heart-rate and energy categories you authorize, and can save a Rund workout where you allow writing. HealthKit permissions remain category-specific in Apple's permission sheet. Denied categories remain unavailable.
Health information is used for your activity and workout experience, not for advertising, marketing profiling or sale. Disconnect or change permissions in Apple Health or iOS Settings. Withdrawing access stops future access; deleting a workout already saved to Apple Health is a separate action in Apple Health. Where health information is special-category data, its optional processing relies on your explicit permission and consent.
Purposes and legal grounds
We use necessary account, activity, community and transaction data to provide the features you request and administer the service relationship. Under GDPR this is contract performance, Article 6(1)(b); under KVKK it is processing directly necessary for establishing or performing a contract, Article 5(2)(c), where applicable.
Security, fraud prevention, abuse handling, service reliability and proportionate technical logs rely on legitimate interests, GDPR Article 6(1)(f) and KVKK Article 5(2)(f), only where those interests do not override your rights. Legal compliance relies on an applicable legal obligation; handling legal claims may rely on the establishment, exercise or protection of rights. Optional identity disclosure and other consent-based uses rely on a separate, specific choice. Optional health processing additionally requires the applicable special-category condition. A privacy-notice acknowledgement is not consent to every use of your data.
Who receives information
Rund uses infrastructure and service providers to host and operate the app, deliver email and push notifications, provide maps, support sign-in and verify Apple purchases. They receive the information necessary for their function. Apple receives the information needed for Apple sign-in, Health permissions and App Store purchases; push delivery may use Expo and Apple services. Map and geocoding providers receive the requests needed to display or resolve a location.
Other users and organizers receive only information made available by the feature and applicable visibility choice. During a race, approved participants and the organizer can receive live positions needed for the event when you opt into that participation. An organizer who separately collects information, arranges a physical prize or uses information outside Rund is responsible for that separate processing and must provide their own notice. We may disclose information where required by law, to respond to valid legal process or to protect rights and safety, subject to applicable law.
International processing
Rund and its infrastructure, email, map, sign-in, payment and notification services may process information outside your country, including in Europe and the United States. Cross-border processing must have a valid legal basis and applicable transfer safeguards, such as an adequacy decision or approved contractual safeguards where required. Contact us for the recipients and safeguards relevant to your request. Accepting the service terms is not a blanket consent to international transfers; this notice does not claim that every vendor holds a particular certification.
Retention and deletion
Account, ordinary run history, game results, memberships, awards and feature choices are generally kept while needed for your active account and the feature they support. Raw organization-race GPS samples and live position records are scheduled for deletion within 24 hours after an event ends. Ordinary run routes are separate from those short-lived race samples and remain part of your run history until account erasure or an applicable deletion request.
In-app account deletion revokes sessions, removes account credentials and contact details, erases the account's ordinary raw run routes and profile-change values, and removes or anonymizes event data as supported by the erasure flow. Shared content, jointly owned game information, safety reports and limited non-identifying aggregates may remain where needed for other participants, safety or the integrity of the game. Content you have shared or information another person has independently saved cannot necessarily be recalled. Contact us for a specific content or jointly owned route erasure request. Legal obligations or a valid dispute can justify limited further retention; we do not promise an unsupported universal deletion deadline for backups or every category.
Your controls and rights
You can edit your profile, manage buddies and blocks, choose direct-message and notification preferences, leave events, change device permissions, request an account export and delete your account in account settings. The in-app export is bounded: it includes profile and account information plus category manifests; contact us for additional underlying records such as route samples where applicable.
Depending on the law that applies, you may request access, a copy, correction, deletion, restriction, portability, objection to legitimate-interest processing, withdrawal of consent and review of an applicable solely automated decision. We may need proportionate verification to protect your account. Send requests through the contact form at https://rund.run/support.html, ideally using your account email and runner number. Do not send a full identity document unless a secure, necessary verification method has first been agreed.
KVKK requests are handled within the applicable statutory period, normally no later than 30 days. GDPR requests normally receive a response within one month, with a lawful extension explained when needed. Applicable US state-law requests normally follow their statutory deadlines, including 45 days under the CCPA where it applies. We explain refusals and available appeal or complaint routes. You may complain to the Turkish Personal Data Protection Authority or your competent European or US regulator. No service penalty applies merely because you exercise a privacy right.
US privacy choices
Rund does not sell personal information, share it for cross-context behavioral advertising, or use Health information for targeted advertising. We do not use personal information to decide employment, housing, lending, insurance or other similarly significant eligibility. Precise location and health information are used for requested functionality and optional permissions, not to infer sensitive advertising audiences.
Where a US state privacy law applies, eligible residents may request information about collection and disclosure, access, correction, deletion, portability, limits on qualifying sensitive-data uses, an authorized-agent request and an appeal where provided by law. A legally valid opt-out signal is honored for any use to which that signal applies. Consumer-health information rights and consent requirements may apply even where a general state privacy law does not. Rund is not a healthcare provider and does not represent itself as a HIPAA-covered medical service.
Children and safety
Rund is intended for people aged 16 and over, and any higher minimum required by local law. Do not register if you are below that age. We do not intentionally offer the service to children under 16. Contact us if you believe a child has provided information so we can investigate and take appropriate action. Rund is not an emergency, medical or personal-safety monitoring service.
Security and website
We use HTTPS, access controls and account/session protections appropriate to operating the service. No system can guarantee absolute security. Keep your sign-in credentials private and report suspected unauthorized access. The public website does not require an account to view this notice and does not use advertising cookies. Necessary server logs and requests to any external assets remain subject to this notice.
Changes and contact
This version is dated October 4, 2026. Material changes will be presented in the app or another appropriate channel. A new optional purpose requires a new choice rather than silently expanding an old consent. Contact: Emre Pehlevan, via https://rund.run/support.html. Terms of Use: https://rund.run/terms.html. Turkish KVKK Notice: https://rund.run/kvkk.html.