Privacy policy.

What we collect

We store your username, account identifiers, password and recovery-code hashes, sign-in records, and team and competition memberships. Running summaries contain the activity source and identifier, start time, type and distance.

Activities come from your manual entries, uploaded FIT files or a watch provider you connect. COROS and Garmin support direct activity synchronization. Connected-provider credentials are encrypted. We do not store your watch-account password.

FIT files and provider responses can contain routes and heart-rate information. We process them to extract running summaries, then discard the original files and additional records. Exercise information can reveal information about health.

Why we use it

We use account, membership and running information to provide the service you request: maintaining your account and teams, recording runs and calculating competition results. The legal basis is performance of our agreement with you (GDPR Article 6(1)(b)).

Optional watch connections and imports rely on your consent (Article 6(1)(a)). You can use manual entries without connecting a watch. Without an account we cannot maintain your membership; without running data we cannot calculate your contribution.

We process limited technical information to protect the service against abuse, based on our legitimate interests in security (Article 6(1)(f)), and handle privacy requests to meet our legal obligations (Article 6(1)(c)). We do not sell running data, use it for advertising or send it to AI services. Rankings are calculations, not decisions with legal or similarly significant effects.

Who can see it

Competition members can access your nickname and individual running summaries, as well as team totals. This includes activity identifiers and summaries from members without a current scoring team. A nickname is not anonymity.

Anyone with a competition invitation code can join. Team owners can enter their team’s members into competitions. Leaving or removal from a team does not revoke competition access already granted. Membership changes update ongoing competitions; finished rosters remain fixed, although activity or account deletion can change totals.

Griterion’s authorised operator can access data to run the service and handle requests. We may disclose information when legally required. Watch providers operate their own services under their privacy notices: COROS and Garmin.

Storage and retention

Runborne account data is stored on infrastructure operated by Griterion. We keep account and running records while your account exists. You can edit or delete manual runs, delete your account, or request correction or erasure of imported data. Account deletion removes your records from the active service and deletes competitions you own; shared teams and other members’ records may remain.

Disconnecting a provider removes its authorization credentials and stops future imports. Previously imported activities remain. Deleting an activity at its source does not currently guarantee deletion of its Runborne copy. Recovery backups may contain earlier records after deletion from the active service; requests to erase these copies are handled through the contact route below.

An essential sign-in cookie lasts seven days. There are no advertising trackers or analytics scripts. Cloudflare hosts this policy page and processes technical visit information such as IP address and requested URL. This does not send your running history to Cloudflare.

Cloudflare and watch providers operate internationally. Their processing may take place outside the EEA. Cloudflare’s data processing terms describe applicable transfer safeguards, including standard contractual clauses. Reach out for information about safeguards relevant to your data.

Your choices and rights

Use Account in Runborne to export your data or delete your account. You may also request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests, where the applicable conditions are met.

You can withdraw consent without affecting earlier lawful processing. Disconnect your watch to stop future imports; reach out to withdraw consent for further use of previously imported information. We may ask for proportionate information to verify your identity.

We normally respond within one month, free of charge. If a permitted extension is needed, we will explain it within that month. You may complain to IMY, the Swedish Authority for Privacy Protection, or another competent supervisory authority.