Privacy Policy

1. Data Controller

The data controller for personal data is:

2. Data Collected

When using RunRun, we collect the following categories of data:

2.1 Identification Data

• First and last name
• Email address
• Profile photo (if provided via third-party authentication)

2.2 Sports Profile Data

• VMA (Maximum Aerobic Speed)
• Maximum heart rate
• Training goals (races, distances, target times)
• Training preferences (sessions per week, weekly volume)

2.3 Physical Activity Data

• Training sessions (date, duration, distance, type)
• Performance data (pace, heart rate, elevation)
• Data imported from third-party services (Strava)

2.4 Technical Data

• IP address
• Browser and device type
• Pages visited and interactions with the service

3. Processing Purposes

Your data is processed for the following purposes:

4. Data Sharing with Third Parties

RunRun does not sell your personal data. Your data may only be shared in the following cases:

4.1 Third-party services connected with your consent

4.2 Technical Subcontractors

• Hosting: Hostinger (European Union) - website hosting
• Database: MongoDB Atlas (USA/EU) - data storage
• Analytics: Google Analytics - anonymized traffic statistics

These subcontractors are subject to contractual obligations of confidentiality and security compliant with GDPR.

5. Data Retention

• Account data: Retained while the account is active. Accounts inactive for 3 years (36 months) are automatically deleted, in accordance with CNIL recommendations. A warning email is sent 30 days before deletion
• Voluntary deletion: If the user requests account deletion, data is erased immediately
• Training data: Retained while the account is active, deleted together with the account
• Third-party access tokens: Retained until revoked by the user
• Strava activities: Retained while the Strava connection is active, deleted within 30 days after disconnecting from RunRun or revoking access from Strava (confirmation e-mail sent)
• Technical logs: Maximum 12 months
• Registration-opening alerts: Email address and race concerned, kept until the single email is sent (the day before registration opens), then erased within 30 days. Withdraw at any time via the "stop these alerts" link in the email or from the race page, no account needed

6. Your Rights

Under GDPR, you have the following rights:

• Right of access: Obtain a copy of your personal data
• Right to rectification: Correct inaccurate or incomplete data
• Right to erasure: Request deletion of your data ("right to be forgotten")
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to the processing of your data for legitimate reasons
• Right to withdraw consent: Withdraw your consent at any time for consent-based processing

To exercise these rights, contact us at contact@runrun.fr or use the options in your account settings.

You also have the right to file a complaint with the CNIL (French Data Protection Authority): www.cnil.fr

7. Data Security

RunRun implements appropriate technical and organizational measures to protect your personal data:

• Secure connections (HTTPS/TLS)
• OAuth 2.0 authentication for third-party services
• No plain-text password storage
• Restricted data access (principle of least privilege)
• Hosting with certified providers

8. International Transfers

The website is hosted within the European Union. Some of our other subcontractors (MongoDB, Google) may however process your data outside the European Union, particularly in the United States. These transfers are governed by:

• The EU-US Data Privacy Framework for certified companies
• Standard contractual clauses approved by the European Commission

9. Cookies

RunRun uses cookies for:

• Essential cookies: Authentication, user session
• Analytics cookies: Google Analytics (with IP anonymization)

You can manage your cookie preferences through your browser settings.

10. Changes to This Policy

We may update this privacy policy. In case of substantial changes, we will notify you by email or via a notification on the site. The last update date is shown at the top of this page.

11. Contact

For any questions about this privacy policy or your personal data: