Privacy Policy

Last updated October 23, 2026

onRun is built on a simple idea: help runners find and share events. We collect only what we need to make that work, we never sell your data, and we give you clear controls over everything you share. This policy explains exactly what we collect, why, and how you can change or delete it.

Questions? Email us any time at legal@onrun.com.

1. What We Collect

Account information

When you sign up we collect your name, email address, and (optionally) a profile photo. You can update or delete this information at any time from your profile settings.

Location — while you use the app

When you open the events map, start a paced run, or pick an address, the app asks for access to your location while the app is open. We use this to:

Show events and runs happening near you
Centre the map on your current position
Track your route and pace in real time during a paced run
Auto-fill your base location in notification settings

This is called foreground location. The app never reads your location in the background unless you explicitly turn on the feature described below.

Location — when you share breadcrumbs

onRun has an optional “Share Breadcrumbs” feature on the event screen. When you enable it, the app tracks your position even while the app is minimised — this is called background location. Your location is shared in real time only with other athletes who are attending the same event. Nothing is shared with advertisers, data brokers, or anyone else.

Background location collection stops the moment you disable breadcrumb sharing or leave the event. The OS will ask you to grant “Allow all the time” permission before this feature activates; you can revoke it at any time in your device settings.

Activity data

When you complete a paced run, we store your route, distance, elapsed time, and pace splits so you can review them later. You can delete individual runs from your activity history.

Content you post

Events you create (title, description, location, date) and any profile information you add are stored on our servers. Public events are visible to all onRun users; private events are visible only to invited participants.

Payments

When you pay for a group run, you enter your card details into a payment form provided by Stripe, our payment processor. They go straight to Stripe and never reach onRun's servers. We keep a record of each payment (which group run it was for, the amount, its status and Stripe's reference for it) so we can confirm your spot and handle refunds.

If you organise paid group runs, Stripe collects the identity and bank details it needs to pay you, directly on its own sign-up pages. onRun stores only your Stripe account reference and whether your payouts are set up.

Device and usage data

We automatically collect basic device information (device type, operating system, app version) and usage logs (screens visited, errors) to keep the app stable and improve it. This data is not linked to identifiable individuals for advertising purposes.

To see how people use onRun (which pages and screens they visit and what they tap or click) we use product analytics tools: PostHog on the website and in the app, and Vexo in the app. Both can also make short session recordings of how the interface is used, which help us find and fix problems. Every recording masks text fields, so what you type is never captured, and recordings in the mobile app also hide photos.

Analytics are optional. If you are in the European Economic Area, the United Kingdom or Switzerland, PostHog and Vexo stay off until you choose to allow them; elsewhere they are on by default and you can opt out at any time. You can change your choice whenever you like in Settings → Preferences (web) or Preferences (mobile app).

When something goes wrong, the website and app send an error report to Sentry, our error-monitoring provider. A report describes what failed and on which device or browser, and we set reports up to leave out personal details such as your email address. For a small share of visits, and for visits in which an error occurs, Sentry also keeps a replay of the screen with all text masked and photos hidden. Error reports keep onRun working, so the analytics choice above does not turn them off.

On the website, Vercel, our hosting provider, also counts page views and measures how fast pages load. It does this without cookies and without identifying you.

Push notifications

If you allow notifications, we send alerts about events near you, follows, and activity on events you are interested in. You can change notification settings in the app or turn them off entirely in your device settings.

2. How We Use Your Information

Provide, maintain, and improve the onRun service
Show you events and runs that are near you
Enable real-time breadcrumb sharing with other athletes at your event
Power the paced run GPS tracker and post-run summary
Send notifications you have opted in to
Respond to your support requests
Detect and prevent abuse, fraud, or safety risks
Comply with applicable law

We do not use your data to serve you ads or to build advertising profiles.

3. Who We Share Your Data With

Other onRun users

Your public profile and any public events you create are visible to other users. Your real-time location is shared with fellow athletes at an event only while you have breadcrumb sharing enabled — and only with participants at that specific event.

Service providers

We use these companies to run onRun. Each receives only what it needs for its job and handles it on our behalf, under a contract with us:

Google: Firebase stores and processes our data (database, sign-in, file storage and server functions), and Google Maps powers address search in the mobile app.
Vercel: hosts the website and measures page views and page speed.
Stripe: processes payments for paid group runs and pays organisers.
Sentry: receives error reports from the website and the app.
PostHog: product analytics and session recordings on the website and in the app, when analytics are allowed.
Vexo: product analytics and session recordings in the mobile app, when analytics are allowed.
Upstash: keeps short-lived counters, keyed by your account ID or IP address, that limit how often requests can be made, to stop abuse.
Mapbox: maps and address search on the website.
Cloudflare: the bot check (Turnstile) on the website's sign-up, support and account-deletion forms and on the race search on its home page.
Twilio SendGrid: delivers the messages you send us through the support form.
Expo: delivers push notifications to your device and measures app performance.

Stripe also uses payment data under its own privacy policy, for example to prevent fraud and to meet its legal duties as a payment provider. If you use “Find Past Races” in the app, or the race search on the website's home page, the name, dates and place you enter are sent to Athlinks, a race-results service, to search its results; Athlinks handles that search under its own privacy policy.

AI apps you connect

You can connect an AI assistant, such as Claude or ChatGPT, to your onRun account. Nothing is shared until you sign in to onRun and approve the app on our consent screen, which lists exactly what it may do. Depending on what you approve, the app can:

see your name, username and profile photo;
see the group runs you have joined or are on the waitlist for;
join free group runs or their waitlists for you, and cancel those spots.

A connected app never receives your email address, password, phone number or payment details, and it cannot pay for anything: paid group runs are always paid for and cancelled on onRun itself. What you tell the assistant in your conversation is handled by the company that runs it, under its own privacy policy, not this one.

For each connection we keep the app’s name and website, the permissions you approved, when you connected it and when it last acted, and its access keys, which we store only in hashed form. We also log each group run an app joins or cancels for you, so we can spot misuse. Access keys last an hour and renew while you use the app; a connection you don’t use for 60 days ends on its own, every connection ends a year after you approved it (you can reconnect), and expired records are deleted automatically. We notify you whenever a new app connects, and you can disconnect any app at any time in Settings → Connected apps, which takes effect immediately. If you delete your onRun account, your app connections and their records are deleted right away. Our guide to using onRun with Claude and ChatGPT shows how to connect one.

Legal requirements

We may disclose information when required by law, a court order, or to protect the rights, safety, or property of onRun or others.

What we never do

We do not sell your personal data.
We do not share your data with advertisers or data brokers.
We do not give connected AI apps your email address, password or payment details.
We do not send the content of your form inputs to analytics tools — session recordings mask every input.
We do not collect background location without your explicit action.

4. How Long We Keep Your Data

We keep your account data for as long as your account is active. If you request account deletion, your profile, event history, and activity data are permanently removed within 30 days. Aggregated, anonymised analytics (e.g. total event counts) may be retained longer as they cannot identify you.

5. Your Rights and Choices

Access and correction — You can view and edit your profile information in the app at any time.
Location permissions — You can revoke foreground or background location access at any time in your device settings (Settings → onRun → Location).
Notifications — Adjust or disable in the app (Settings → Notification Preferences) or in your device settings.
Connected AI apps — See which apps can act on your account and disconnect any of them at any time (Settings → Connected apps).
Delete your account — You can request account deletion at any time directly in the app or website (Settings → Account → Request Account Deletion), via our website at onrun.com/delete-account, or by emailing us at support@onrun.com or legal@onrun.com. We will permanently delete your account and all associated personal data within 30 days.
Data portability — You can request a copy of your data by emailing us.

If you are in the EU or UK, you also have the right to lodge a complaint with your local data protection authority.

6. How We Protect Your Data

We use industry-standard safeguards to protect your data, including encryption in transit (TLS) and access controls that limit who inside onRun can view your information. No system is 100% secure, but we work to keep your data safe and to detect and respond to incidents quickly. If a breach occurs that risks your rights or freedoms, we will notify affected users and relevant authorities as required by applicable law.

7. International Data Transfers

onRun and the service providers listed in section 3 may process and store data in the United States and other countries. Where we transfer personal data from the EU, UK, or other regions with data-transfer restrictions, we rely on appropriate safeguards such as standard contractual clauses.

8. Your California Privacy Rights

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect, request deletion, correct inaccurate information, and opt out of the sale or sharing of personal information. As stated above, we do not sell or share your personal information for cross-context behavioural advertising. To exercise these rights, email legal@onrun.com. We will not discriminate against you for exercising these rights.

9. Children

onRun is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided us with their information, please contact us and we will delete it promptly.

10. Changes to This Policy

If we make material changes we will notify you via the app or email before the change takes effect. The “Last updated” date at the top of this page always reflects the current version.

11. Contact Us

onRun
legal@onrun.com