Privacy policy for the Rungtime app

1. Controller and contact

Email for privacy and support: support@darkstone.app · Imprint: https://darkstone.app/imprint

We have not appointed a data protection officer because there is currently no obligation to do so.

2. In short

• Rungtime works without an account. Your training data is then stored only on your device.
• Rungtime contains no ads, no advertising or analytics services and does no tracking.
• For purchases the app talks to the App Store or Google Play and to the purchase service RevenueCat. On the web you buy from Paddle (section 4a). No training data is sent.
• Rungtime sends crash reports only if you explicitly switch them on.
• Apple Health, Health Connect, the watch connection and location in “Discover parks” run only with your permission. The OpenFreeMap online map loads only after your tap.
• A Rungtime account is optional. It backs up only what you explicitly choose, on our servers in Germany. Sync, the web view, friends, groups and shared templates are separate steps (section 12).
• Rungtime uses neither the camera nor the microphone, contacts or photos.

In the app, all external services are listed under Settings → Privacy & diagnostics.

3. Data on your device

Rungtime stores your plan, your sessions and confirmed results, notes, training places (names you choose, no positions), information about restrictions, heart rate readings from the watch, achievements and settings in a database on your device. Without an account we have no access to it, and none of it is sent to us.

• The app folder is excluded from the operating system’s device backup (iOS: excluded from backup; Android: allowBackup off).
• You can export your data as a CSV file at any time or save it as an encrypted backup file with a separate key (Me → Data & backup). You choose where the file goes in the system dialog; a cloud storage you choose there processes it under its own terms.
• Rungtime reads a workout import (CSV) only on the device.
• Deleting: Me → Data & backup → “Delete training data on this device”. Files you exported and trainings sent to Health stay where they are. Your purchase rights are kept.

This processing takes place only on your device and under your control; we do not receive this data. Section 12 covers what you put into the cloud.

4. Purchases (App Store, Google Play and RevenueCat)

You buy Rungtime Pro through the App Store or Google Play (on the web from Paddle, section 4a). The store handles the purchase and payment with your store account; Rungtime does not see payment details. Apple or Google process store account, payment and purchase data as independent controllers under their own privacy terms.

To show offers and check the purchase state, the app talks to RevenueCat (RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA) at start, when it returns to the foreground, on the “Rungtime Pro” page, when buying, when restoring and when opening subscription management. This involves:

• a randomly generated, pseudonymous identifier of this installation (no advertising or device identifier),
• product identifier, purchase history, entitlement status, store receipt or purchase token, price, currency and times,
• technically necessary connection and app data: IP address, platform, SDK, app and system version, device language and store country.

The app does not send training data, profile, plans, notes, places, health values, email address, names or advertising or attribution identifiers. For a web purchase, RevenueCat receives your purchase email address from Paddle (section 4a). Automatic device identifiers and RevenueCat diagnostics are switched off. With an account and sync, or after a web purchase, a random purchase identifier of your account is added (sections 4a and 12.3).

The app stores the last confirmed purchase state sealed on your device so that Pro also works offline under the rules of the terms of use. It is never part of an export or backup.

Purpose: offers, purchase, unlocking, restoring and checking the purchase state. Legal basis: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(f) GDPR (our legitimate interest in a reliable purchase state and in preventing abuse). Accessing purchase data on your device is technically necessary for the purchase you request (§ 165(3) Austrian TKG 2021 or § 25(2) German TDDDG). RevenueCat processes the data as our processor, also in the USA (section 14). Retention: as long as needed for unlocking, restoring, refunds, abuse prevention and legal duties; you can ask us by email to delete your record at RevenueCat.

4a. Buying on the web (Paddle)

If you buy Rungtime Pro on the web, Paddle (Paddle.com Market Limited, 30 Old Bailey, London EC4M 7AU, United Kingdom, together with the companies named in Paddle’s privacy notice, including Paddle Payments Ltd, Dublin) is the seller and is independently responsible as controller for processing at purchase. This covers ordering, payment, invoicing, VAT, fraud checks, withdrawal and refunds. Paddle processes name, email address, billing country and address, payment data, IP address and device data, purchase and discount data, according to Paddle’s privacy notice. For the transfer to the United Kingdom, the European Commission’s adequacy decision applies; for further transfers Paddle names standard contractual clauses.

The purchase page is part of the web view at app.rungtime.darkstone.app (section 12.4); there you sign in with your Rungtime account. When you open the purchase page, it asks our server for your account’s purchase identifier (section 12.3). If you have not linked the app to the account yet, the server reserves a new random purchase identifier (rt. + random number) for your sign-in. Only when you choose “Continue to payment” does the purchase page load Paddle’s payment form (Paddle.js from cdn.paddle.com). Paddle then receives your IP address and technical browser data. The purchase page passes Paddle the product, your account’s email address for prefilling, a partner code from the link and the purchase identifier. Across the sign-in, the browser tab remembers the purchase page with the partner code (session storage, at most 30 minutes). After payment, the browser keeps the purchase identifier and its time in local storage so that a reload does not offer a second purchase; signing out removes it. The payment form may set cookies or storage that are technically necessary for payment and fraud prevention (§ 165(3) Austrian TKG 2021 or § 25(2) no. 2 German TDDDG).

So that we can unlock Rungtime Pro, Paddle reports the purchase to RevenueCat, our processor (USA, section 14): Paddle customer identifier, email address, purchase identifier, product, price, currency, discount applied, purchase, subscription, refund and chargeback status, and country. RevenueCat books the purchase to the purchase identifier. When you sign in to the app with the same account, your account takes over the reserved purchase identifier, and the app uses it to check the Pro status with RevenueCat. We ourselves see purchase and discount data in the Paddle and RevenueCat dashboards, including your email address, and use them only for support, unlocking, settlement with partners (only aggregated figures, no buyer data) and to prevent abuse.

Legal bases: Art. 6(1)(b) GDPR (purchase page, reservation of the purchase identifier and providing the Pro you bought); Art. 6(1)(f) GDPR (support, partner settlement, abuse prevention); Art. 6(1)(c) GDPR (statutory retention of our accounts with Paddle).

Retention at RevenueCat: as long as needed for unlocking, restoring, refunds and legal duties. Our server in Germany stores the reservation with the issuer and identifier of your sign-in, the purchase identifier, the time it was created and, once we have confirmed the payment with RevenueCat, the time of that confirmation; it contains no content. If you do not buy, we delete it together with the unused sign-in (section 12.9, “Unused accounts”). If you have bought, the sign-in and the reservation stay until you sign in to the app and your account takes over the purchase identifier, until you ask for deletion, or until the purchase is refunded; after that the rule for unused sign-ins applies again. If you bought only on the web and never linked the app to the account, you ask for deletion by email to support@darkstone.app.

5. Crash reports (Sentry, only with consent)

Under Settings → Privacy & diagnostics → “Send crash reports” you can allow Rungtime to send a cleaned report to Sentry (Functional Software, Inc., USA; data region EU, Frankfurt) after a crash or error. The switch is off by default; without consent no Sentry code runs.

A report contains the app version, build, operating system and version, device model, error type, a cleaned error message and call sites. It does not contain training values, plans, notes, place names, heart rate, restrictions, account or purchase identifiers, tokens, email addresses, file paths or screenshots. Before sending, the app checks every report and removes texts you typed yourself. Your IP address is technically used for the transfer but is not stored by Sentry.

Without a connection a report waits on the device (at most ten). Switching off stops sending and deletes waiting reports. Sentry deletes reports already sent after 30 days. Not every crash is captured.

Independently of this, the app keeps the last error message, cleaned, on the device for 30 days. It leaves the device only if you attach it to a support message.

Legal basis: your consent (Art. 6(1)(a) GDPR; for reading device data § 165(3) Austrian TKG 2021 or § 25(1) German TDDDG). You can withdraw it at any time with the switch; this does not affect the lawfulness of reports sent before. Sentry processes the reports as our processor. For its parent company in the USA see section 14.

6. Help, reporting a problem and website

Help and common questions work without an account and offline. Report a problem hands your message to your mail app; Rungtime sends nothing itself. Only when you send the mail there does it go through your mail provider to our support inbox support@darkstone.app. It contains your description, an optional contact, the attachments you pick one by one (“Technical report”, “Last error”) and the sender address of your mail app. Please do not send us passwords, the key of your backup file, payment details or health information we do not need for your request.

Purpose: handling your request and fixing errors. Legal basis: Art. 6(1)(b) GDPR where it concerns the app or your purchase, otherwise Art. 6(1)(f) GDPR (our interest in answering requests). Our inbox runs on Google Workspace; the processor is Google Cloud EMEA Limited (70 Sir John Rogerson’s Quay, Dublin 2, Ireland) with affiliated companies, also in the USA (section 14). Processed are your email address, the content of your message with its attachments and the mail metadata (time, sender, recipient, subject, technical headers). We delete support messages twelve months after the last message of the request. We keep a message longer only as long as we need it to establish, exercise or defend legal claims (Art. 17(3)(e) GDPR). Error descriptions without personal data may stay longer.

When you open a page on darkstone.app (help, privacy, terms, imprint, the “Rungtime Pro on the web” and “Refunds and withdrawal” pages), your browser calls the fixed address without parameters. These pages are static, set no cookies and contain no analytics, advertising or social media services. Your IP address is technically needed to deliver the page over HTTPS; the web server and the proxy in front of it keep no regular access logs. The server is operated by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Legal basis: Art. 6(1)(f) GDPR (secure and reliable operation of the website). The purchase page for a web purchase is not on darkstone.app but in the web view (sections 4a and 12.4).

7. Apple Health and Health Connect

Both features are off by default and run only with your system’s permission.

• Export trainings (Settings → Health): Rungtime writes the start, end and type (strength training) of each finished session that ends after you switch this on to Apple Health or Health Connect, and for a resumed session also the times of its pauses. Exercises, sets, notes, heart rate and skill evidence are not transferred.
• Reading (two separate switches): Rungtime shows other strength workouts of the last 30 days in History and the latest available resting heart rate as context in Analytics. The values are only displayed; they are not stored, backed up, exported or sent to the cloud. Rungtime’s own workouts are excluded.

These features send nothing over the network; the data stays in your device’s health store, and we do not receive it. What happens to it there is governed by Apple Health or Health Connect and the apps you give access. Switching off stops new transfers; you delete trainings already transferred in Health. Data from Apple Health and Health Connect is not used for advertising, not sold and not passed on to third parties.

8. Apple Watch and Wear OS

Apple Watch (Rungtime Pro): phone and watch exchange today’s session, your set results and – only with your Health permission on the watch – heart rate readings over the connection between the devices. Rungtime uses no server of its own for this. The watch workout session is discarded at the end and not saved to Apple Health. The app stores heart rate readings on the iPhone with the session; they are part of your backup file and your CSV export and go to the cloud only if you allow the “Heart rate” category there.

Wear OS (Android, Rungtime Pro): the connection is off by default and is switched on under Settings → Watch. Then Rungtime transfers the session with targets, equipment and restrictions, your set results and – with heart rate permission on the watch – readings between phone and watch. Google Play services carry the data over Bluetooth or encrypted through Google servers. Google acts as the provider of Google Play services under its own terms; we do not receive this data. No Rungtime account is needed. Switching off stops new transfers; saved values stay on your devices.

9. Discover parks and location

Station data, the city directory and selected licensed photos are bundled with the app. City search, equipment filters, saved stations and training matching run on your device. Saved stations are stored locally, excluded from backup and sync, and removed when training data is deleted or restored.

Only “Use location” requests the system permission “While using the app”. Rungtime displays and updates your position only while this view is in the foreground, keeps no movement history and does not save the position or send it to our backend. Manual city search and the results list work without permission.

The online map is requested only after “Load online map”. OpenFreeMap (Hyperknot Software Kft., Hungary, possibly using Cloudflare as a CDN) receives your IP address and the requested map areas. Centering the map on your position can reveal your surroundings and, at high zoom, a precise geographical area. Training data, account details and saved stations are not sent. You can close the online map in the view. The map library may cache downloaded map data on your device; this is not a location history. According to OpenFreeMap, error logs containing IP addresses and request URLs are kept for seven days and possible security logs for at most 30 days (OpenFreeMap privacy policy). OpenFreeMap acts as an independent provider.

Purpose: showing parks and the map you request. Legal basis: Art. 6(1)(b) GDPR (providing the feature you use). Location access and the map cache are technically necessary for this feature you requested (§ 165(3) Austrian TKG 2021 or § 25(2) no. 2 German TDDDG).

“Open directions” passes only the public destination coordinates to Apple Maps or Google Maps; that app handles its own location permissions under its own rules. Links for OSM corrections and to photo sources and licences open with the respective provider only after your tap. Data: © OpenStreetMap contributors (ODbL); city directory: GeoNames (CC BY 4.0); photo licences are shown with each image.

10. Notifications, widgets, Live Activity and voice prompts

Reminders and Grease the Groove cues are local notifications without a push service and without a server. Widgets and the Live Activity (iOS) read only data on the device. Voice prompts use only voices installed on the device.

11. Sharing

When you share an achievement card, your year in review, a friend code or a file, Rungtime hands it to your system’s share dialog. You decide where it goes; the receiving app processes it under its own rules.

12. Rungtime account and cloud (optional)

You do not need an account to train. An account backs up only what you explicitly choose afterwards; signing in alone uploads nothing. All cloud data is stored on servers of Hetzner Online GmbH in Falkenstein (Germany), which we operate ourselves. In addition, an encrypted backup copy (the most recent weekly copy) is kept on a computer of the controller in Austria (Prinzersdorf), see section 12.8.

12.1 Account. Sign-in runs in your system browser through our sign-in service at auth.rungtime.darkstone.app. It stores your email address (as user name) and a hash of your password; there are no name fields. For sign-in with Apple or Google see 12.1a. The sign-in service sets technically necessary cookies that expire after ten hours at the latest. If you choose “Stay signed in” when signing in with a browser, the sign-in lasts up to 90 days (it ends earlier after 30 days without use), and another cookie remembers your email address for up to one year for the next sign-in. “Sign out” ends the sign-in and deletes these cookies. To prevent abuse, it keeps sign-in events with email address and IP address for 30 days, also after an account is deleted. When you register, you confirm with a required checkbox, or on a required page when you first sign in with Apple or Google, that you are at least 16 years old and accept the terms and this policy. With your account we store the day you last used it (any signed-in request from the app or the web view), so that we can delete unused accounts on time (12.9). We send confirmation, recovery and notice mails from noreply@darkstone.app through the SMTP relay of Google Workspace (replies go to support@darkstone.app). Google processes your email address, the mail content (confirmation code, password reset code, notice of the deletion date) and delivery metadata (time, sender, recipient, subject, technical headers) as our processor; the mails are not stored in a mailbox of ours. On the device, a sign-in token is kept in the system’s protected storage (iOS keychain, Android Keystore); it is not included in device backups.

12.1a Sign in with Apple or Google (optional). Instead of a password you can sign in with your Apple or Google account. The provider then gives us your email address and an identifier that is valid only for Rungtime. If you chose “Hide My Email” with Apple, we see only Apple’s relay address; Apple forwards our mails to you. The provider is an independent controller for its sign-in and its data. For Apple we store the access token only so that we can revoke the connection to your Apple account when you delete your account; we do not store Google tokens. The sign-in events in 12.1 also apply here. When you delete the account, we remove the link to the provider.

12.2 Cloud backup. You choose categories: “Trainings and plans”, “Heart rate”, “Restrictions”, “Notes”. Because training data can reveal information about your health (for example sessions ended because something hurt), Rungtime backs up only with your separate, explicit consent for health data; heart rate, restrictions and notes are off by default. The data is encrypted on its way to the server (HTTPS) and also stored there encrypted per account. Rungtime itself can decrypt it there to give it back to you, sync it and show it in the web view – so this is not end-to-end encryption, where only your devices would hold the key. Account metadata such as identifiers, times and categories and the sign-in database are not additionally encrypted. The backup has a storage limit per account of 64 MiB; when it is reached, Rungtime backs up nothing new and cuts nothing existing.

12.3 Several devices (Rungtime Pro). When you switch on “Sync on this device”, Rungtime keeps your backed-up data in sync between up to ten devices. So that the server can check Pro, the app registers your purchase with RevenueCat under a random purchase identifier of your account (rt. plus a random number); our server asks RevenueCat for the Pro status using only this identifier. From the app, RevenueCat learns neither your email address nor training data; after a web purchase, RevenueCat knows the purchase email address from Paddle, and the purchase is booked to your account’s purchase identifier (section 4a). RevenueCat can also link purchases of several devices of the same account. A refund takes effect up to 24 hours later.

12.3a Pro gift on Android (14 days). On Android you start the “14 days of Rungtime Pro” gift only with a free Rungtime account and a connection to the server; once per account, once per email mailbox and once per device within 12 months. When you start it, the app sends a request to our server; on app start, when returning to the foreground and after signing in, it checks the state as long as no gift is known on the device. No content is transmitted; at the start the app sends a device key (a SHA-256 value of the Android ID with a fixed prefix, never the Android ID itself; reading the Android ID and requesting the integrity token on your device are technically necessary for the gift start you request, § 165(3) Austrian TKG 2021 or § 25(2) no. 2 German TDDDG); besides the sign-in token of your account only the technically necessary connection data (section 12.8). The server stores per account the account identifier, start time, end time (start plus 14 days), platform (Android) and creation time; no training data. In addition the server stores two lock entries: one lookup value each (HMAC with a key derived from our master key) of the normalized, verified email address (lowercase, without “+…”, for Gmail without dots, googlemail treated as gmail; Apple relay addresses stay unchanged; without a confirmed email address no gift starts) and of the device key, each with start time and expiry time (start plus 365 days). These entries contain neither the address nor the device key in plain text and have no link field to your account (no foreign key); while the account exists they can be matched via the start time and the address, afterwards only by someone who knows the address or the device. They are pseudonymous, not anonymous, because we can recompute the lookup value for a known address or device. Access, erasure and objection for the mailbox record are possible if you tell us the email address; we can only find the device record through a request from the app on that device, because the device identifier is not shown anywhere. Until expiry the protection against repeated redemption prevails. They prevent the same address or device from redeeming the gift again within 12 months; if it was already used, the app says so. On Android, at the start Google Play (Play Integrity) additionally checks whether the request comes from the genuine Rungtime app installed through Google Play on a genuine, certified device: for this the app asks Google Play for an integrity token, bound to a SHA-256 hash of a fixed purpose string, the pseudonymous check value of your sign-in identifier (SHA-256 of issuer and identifier of your account) and the device key; nothing in plain text goes to Google in that field. Google (Play Store or Google Play services) processes app and device signals for this (package name, signing certificate, licence status, device attestation) under its own terms as an independent provider. The app sends the opaque token to our server; the server forwards it through a proxy that allows only the two Google addresses needed for this to Google’s Play Integrity service (Google LLC) and receives only the verdict (app recognised by Google Play, licensed, device passes the integrity check). We do not store the token or the verdict; on a refusal or when Google cannot be reached the server logs hold only the outcome category, a coarse reason from a fixed list (such as which of the three conditions was not met, an expired token or an error at Google) and the pseudonymous identifier of the calling account (12.8), no token and no verdict values. The server also compares the domain of your verified email address, in memory only and after normalising the spelling (Unicode), with lists of disposable email domains (a public list released under CC0, in a fixed version) and of email alias services; with such addresses the gift does not start, and the account and purchases remain possible. At most five integrity checks per account are possible within 24 hours; the server keeps the counter in memory only (not stored, gone after a restart). If the check fails or the address is not accepted, the gift does not start and neither a gift nor a lock entry is created (see also section 17). This way reinstalling or changing the clock does not restart the gift, and the same account gets no second gift. A running gift keeps running after you sign out until its end time. It unlocks local Pro features only, never cloud backup, sync or groups. On iOS the gift runs through a free Apple product, without an account. Legal basis: Art. 6(1)(b) GDPR (account and use of the service) and Art. 6(1)(f) GDPR (protection against repeated redemption; abuse prevention through the integrity check via Google Play Integrity, address lists and check limit). Deletion: “Permanently delete all training data” keeps the record, because otherwise a second gift would be possible; “Delete account” removes it at the latest when the account deletion is complete. The two lock entries remain after “Delete account” and “Permanently delete all training data” until their expiry time (12 months from the start); the daily deletion run then removes them.

12.4 Web view. At app.rungtime.darkstone.app you can sign in with your browser and read your backed-up history and plans, with Pro also edit plans. For this the browser keeps a copy of your data in its local storage; access tokens stay in memory only. When you open the web view, it asks the sign-in service whether you are signed in there; if so, it signs you in without entering anything again. Signing out removes the browser copy. The web view uses no analytics or advertising services, no external fonts and no cookies other than those of the sign-in service (12.1) and, on the purchase page only, those of Paddle’s payment form. Only the purchase page for Rungtime Pro loads a third-party service, and only after you click “Continue to payment”: Paddle’s payment form with its own cookies (section 4a). Rungtime syncs a plan draft from the browser only after you confirm this on your main phone. Local storage and these cookies are technically necessary for the service you request (§ 165(3) Austrian TKG 2021 or § 25(2) German TDDDG).

12.5 Friends. A separate opt-in (“Turn on friends”). You enter a display name (1–24 characters) and choose which values confirmed friends see: weekly goals of the last four weeks, level, skill milestones (on by default) and weekly streak (off). People you send a request to also see your name. Invite codes are valid for 14 days, open requests for 30 days. Friends see only what you switched on; switching off removes the value at once. Sets, exercises, plans, notes, heart rate, restrictions, places and email are never shared. No address book, no search, no public profile.

12.6 Groups. Creating groups is Pro, joining is free. You consent separately for each group. All members of a group see the group name, your confirmed name and your role; your weekly goals of the last twelve weeks and your progress in the challenge only if you switch them on (off by default) – including members who are not your friends.

12.7 Template links. When you publish a template of your own, anyone with the link can read its name, your display name, your instructions, the source, the plan and – if you explicitly choose this – your own exercise definitions, without an account. Personal loads, logs, notes and health values are never included. The page has no scripts and no cookies and is not released to search engines. We do not record who opens the link; we keep no access log with IP addresses. You can deactivate or delete the link; content already read and copies already adopted cannot be called back. We may deactivate content that breaks the terms of use after a notice.

12.8 Operation and backups. Server logs contain no content, tokens, email or IP addresses, but a pseudonymous identifier of the calling account; they are deleted after 30 days. To limit requests we evaluate IP addresses only in memory; for limits on signing in and on sending confirmation codes, the sign-in service keeps a shortened hash of the address for up to 24 hours. We back up the databases daily, encrypted, to a second server at Hetzner in Germany and keep seven daily states; another encrypted copy (only the most recent weekly copy) is kept on a computer of the controller in Austria (Prinzersdorf). Deleted data is gone from all backups after about eight days at most. A content-free deletion journal makes sure deletions also apply after a restore; it is deleted after 60 days. After an account is deleted, only a check value of your sign-in identifier remains, so that the deleted account cannot be linked again, plus the lock entries for the Pro gift (lookup values of mailbox and device, Android) for up to 12 months from the gift start (12.3a).

12.9 Deleting and withdrawing. Under Me → Data & backup you find: “Disconnect from account”, “Delete training data on this device”, “Permanently delete all training data” and “Delete account”. Withdrawing a cloud category deletes the copy in the cloud at once and from the backups after about eight days at most. “Delete account” removes data, permissions, devices, friend and group data, template links, the purchase identifier, a reservation of the purchase identifier (4a) and the gift record (12.3a); the sign-in identity is deleted shortly afterwards. RevenueCat keeps the customer record with your purchases, because purchases belong to your store account or to your web purchase at Paddle. You cancel a subscription in the store. If you bought only on the web and never linked the app to the account, you ask for deletion by email to support@darkstone.app.

Unused accounts. We delete an account that has not been used for 24 months (no signed-in request from the app or the web view) with the same effect as “Delete account”. We announce this at least 30 days in advance by email to the account’s confirmed address; if you sign in before then, the account stays. If there is no confirmed address or the mail cannot be delivered, we delete after the same period. Accounts linked to a running Pro subscription or to Lifetime (purchase identifier, 12.3) are excluded, whether bought in a store or on the web. We delete sign-ins that were never linked to the app after 90 days, without notice, unless a paid web purchase belongs to them (4a); registrations whose email address was never confirmed with the code are deleted after 7 days.

Legal bases. Account, sync, web view and transactional mails: Art. 6(1)(b) GDPR. Cloud backup and sync of the chosen categories: your explicit consent under Art. 6(1)(a) and Art. 9(2)(a) GDPR. Friends, groups and template links: your consent per permission under Art. 6(1)(a) GDPR. Sign-in events, server logs, backups and deletion journal: Art. 6(1)(f) GDPR (secure operation, abuse prevention, proof and effectiveness of deletions). Day of last use and notice mail: Art. 6(1)(f) GDPR (reliably keeping the retention periods under Art. 5(1)(e) GDPR). Pro gift record on the account: Art. 6(1)(b) and (f) GDPR (12.3a). Lock entries for the gift (mailbox, device) as well as integrity check, address lists and check limit at the gift start: Art. 6(1)(f) GDPR (fraud prevention, protection against repeated redemption). You can withdraw any consent in the app at any time with effect for the future.

13. Recipients and processors

Contracts under Art. 28 GDPR are in place with our processors. We do not sell data and do not pass it on for advertising.

14. Transfers to third countries

Paddle is based in the United Kingdom; for the transfer there, the European Commission’s adequacy decision for the United Kingdom applies, and for further transfers Paddle names standard contractual clauses (section 4a). RevenueCat (USA), Sentry’s US parent company and Google (Google Workspace for the support inbox and account mails; Google Play Integrity at the start of the Pro gift on Android) may involve a transfer to the USA. It is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the EU standard contractual clauses in the data processing agreements (Art. 45 and Art. 46(2)(c) GDPR). For Google this is the “Cloud Data Processing Addendum (Customers)”; according to Google, Google LLC has certified to the EU-US Data Privacy Framework, and otherwise the standard contractual clauses incorporated there apply. You can request a copy of the safeguards. For the integrity check (12.3a) Google is an independent provider; Google’s terms for the Play Integrity API and Google’s privacy policy apply, and the transfer to Google LLC in the USA is based on the adequacy decision for the EU-US Data Privacy Framework where Google LLC is certified under it. About the proxy: it only passes on the server’s encrypted connection to Google and cannot see its content. The Rungtime cloud itself is located on servers in Germany; only the encrypted weekly copy of the backup is kept by the controller in Austria (section 12.8), so also within the European Economic Area. If OpenFreeMap uses Cloudflare as a CDN for the online map, your request may also pass through servers outside the EU; this is governed by those providers’ terms.

15. Retention

16. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (Art. 15–20 GDPR), and the right to withdraw a consent at any time with effect for the future. You can exercise many of these rights directly in the app (export, download, delete, switches). For everything else, write to support@darkstone.app. We reply within one month and may ask for reasonable proof of identity, for example an email from your account’s address.

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation (Art. 21 GDPR).

You can lodge a complaint with a data protection supervisory authority, in particular in the member state where you live. Our competent authority is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, dsb@dsb.gv.at.

17. No automated decisions

Rungtime suggests plans, replacement exercises and next steps by fixed rules on your device. You confirm every change yourself. There is no automated decision with legal or similarly significant effects within the meaning of Art. 22 GDPR and no profiling for advertising. At the start of the Pro gift on Android (12.3a), however, the gift can be refused automatically if the integrity check is not passed or the domain of your email address is on a list of disposable or alias addresses. This serves abuse prevention; it has no legal or similarly significant effect (Art. 22 GDPR does not apply): the gift is a voluntary extra, and your account, purchases and all features you bought remain unaffected. If you think the refusal is a mistake, write to support@darkstone.app; we will review the case.

18. Minimum age

Rungtime is intended for people aged 16 and over. You may use the account, cloud, friends, groups and template links only from the age of 16; you confirm this when you register. If we learn that an account belongs to a younger person, we delete it.

19. Obligation to provide data

You are not obliged to provide us with data. Without an account, purchase, support mail and crash reports we receive no personal data from you; individual features are then not available.

20. Changes

We update this policy when the app, our service providers or the law change. The current version is at https://darkstone.app/en/rungtime/privacy/. A changed policy does not extend a consent you gave for an earlier version; for new purposes we ask you again.