Privacy policy

Information you provide

• Account and profile information, including email address, display name, username, optional city and country, profile image, and optional phone number used for friend discovery. Passwords are handled by our authentication provider; Corruns stores encrypted session credentials in the device's secure credential storage so you can stay signed in.
• Content and social activity, including activity titles and notes, photos, comments, cheers, follows, teams, invitations, challenge memberships, and feedback.
• Organizer content, including challenge settings, team details, sponsor information, prize descriptions, terms, and official-rules links.

Location, exercise, and device information

• When you record or import an activity, Corruns processes its GPS points, timestamps, distance, duration, movement type, and derived territory or score. Completed recordings are first saved on your device so a network failure does not lose the run, then uploaded when synchronization succeeds.
• If you choose HealthKit or Health Connect import, Corruns reads the workouts and routes you select. Corruns does not write health data.
• Live presence is optional and off by default. When enabled during a recording, authorized friends may receive a coarse, short-lived location signal; exact live routes are not published.
• We process device push tokens and notification preferences to send requested notifications. Feedback includes the app version and device platform so we can diagnose the report. The app also keeps a bounded local diagnostics log. That diagnostics log stays on the device unless you choose to share it.

Contacts and friend discovery

If you choose contact matching, Corruns sends a bounded set of phone number strings to its server to compare them with players who opted into phone discovery. The submitted contact numbers are used for that comparison and are not stored as an uploaded address book. Corruns does not write to your contacts.

Optional usage and reliability telemetry

Corruns does not send app usage or reliability telemetry unless you turn on “Share usage and diagnostics” in Settings. When enabled, the app may send a random installation identifier, app version, device platform, route-pattern screen names, feature interactions, load durations, API service category and result, and GPS sampling-health summaries. It does not send exact GPS points, exact recorded routes, health records, contact lists, activity notes, photos, or message content as telemetry.

Telemetry sent while you are signed in may be associated with your account. The receiving service also derives a rotating hash from network information and coarse country or region for abuse prevention and aggregate reliability analysis. Turning the setting off stops new collection and clears unsent telemetry from the device; it does not automatically erase telemetry already accepted by the service. Server telemetry follows the retention and deletion practices described below.

How information is used

We use information to:

• authenticate accounts and keep them secure;
• record, validate, synchronize, score, and display activities;
• operate challenges, teams, programmes, social features, and invitations;
• deliver notifications and respond to feedback or support requests;
• prevent fraud, abuse, duplicate submissions, and unsafe access; and
• maintain and improve reliability and accessibility.

What other players can see

Visibility depends on the feature and choices shown in the app. Public or shared activity surfaces may show your profile identity, activity summary, photos, notes, score, and a territory or claim shape. Corruns does not publish the exact recorded route on those surfaces. Private challenges and authorized team areas are limited to eligible participants under server access rules.

Service providers and disclosure

Corruns uses service providers to operate the product, including Supabase for authentication, database, storage, and consented telemetry; Expo services for app builds and push delivery; Apple and Google platform services for app distribution, permissions, health imports, and notifications; Vercel for website hosting; and OpenStreetMap/CARTO for map tiles. These providers receive the requests needed to provide their services and may process network metadata such as IP address, request time, device or browser type, and requested tile or service address under their own applicable terms. We may also disclose information when required by law, to protect users or the service, or as part of a business transfer with appropriate safeguards.

The Corruns website does not run advertising trackers or website analytics. Corruns does not sell personal information.

Photos and legacy feedback attachments

Corruns media currently uses a publicly readable storage service. Photos are normally reached through the visibility-controlled app surfaces, but a person who obtains a direct media URL may be able to open that file. Do not upload sensitive information in an activity photo. The current Corruns client does not accept feedback attachments; an attachment submitted through an older version may remain linked to its feedback record while a verified deletion or support request is processed.

Retention, security, and deletion

We keep account and gameplay information while it is needed to provide Corruns, preserve shared competition results, meet legal obligations, resolve disputes, and protect the service. Local pending recordings remain on the device until they synchronize or you remove them. Shared or finalized competition records may need to be de-identified instead of erased so other players' standings remain consistent.

We use access controls, encrypted network connections, secure mobile credential storage, and server-authoritative permissions. No system can guarantee absolute security.

To request account and data deletion, follow the instructions on the Corruns account deletion page.

Your choices

You can change profile, activity visibility, live presence, notification, telemetry, contact, health, and location choices through Corruns and your device settings. You may request access, correction, or deletion by emailing support@corruns.com. We may need to verify that you control the account before acting on a request.

Children

Corruns is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. Contact us if you believe a child has provided information so we can investigate and take appropriate action.

Changes to this policy

We may update this policy as Corruns changes. The current version and its effective date will remain available on this page. Please review the current policy when the app or its data practices change.