Privacy Policy

Last updated: May 5, 2026

1. Who We Are

RunMate ("we," "us," "our") is a race journal and running identity app operated from the Philippines and accessible at runmateapp.com. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use the Service, and what rights you have over your data.

RunMate is a product of PixelPath Software Publishing House, a business registered with the Department of Trade and Industry of the Philippines (DTI Business Name No. 8145950). PixelPath Software Publishing House is the personal information controller responsible for your data under this Privacy Policy.

We take your privacy seriously. This policy is written in compliance with the Republic Act 10173, also known as the Data Privacy Act of 2012 of the Philippines.

2. Information We Collect

2a. Account Information

We use Google OAuth exclusively for authentication. When you sign in with Google, we receive your name, email address, and Google profile photo. We store your email address to identify your account. Your email is not displayed publicly.

2b. Profile Data

You may optionally provide a display name, username, short bio, and profile photo. Your username and display name are public and appear on your public profile URL. Your bio is shown on your public profile if you have one set.

2c. Race and Run Data

When you log a run, we collect the race name, distance, date, finish time, location, notes, and whether you mark the entry as public or private. We store bib and medal photos you upload.

2d. Planned Races

If you add upcoming races to your schedule — directly or through a group — we store the race name, distance, date, location, and any notes.

2e. Groups

If you create or join a running group, we store your membership status and role within the group. Your display name and avatar are visible to other approved members of any group you belong to. RSVP responses to group races are visible to group leaders and co-leaders.

2f. Podium Submissions

If you submit a podium finish, we collect your name, race name, distance, placement, finish time, race date, location, a photo, and optionally your Instagram handle and RunMate username. Approved submissions are publicly displayed on the Podium Wall.

2g. Payment Data

If you submit a Pro upgrade request, we collect your GCash reference number and a screenshot of your payment receipt. This information is used solely to verify your payment and activate your Pro subscription. Payment records are retained for accounting and dispute purposes.

We do not collect or store credit card numbers or any sensitive financial instrument details. All payment verification is done manually.

2h. GPS and Location Data (Run Buddy)

The Run Buddy feature requests access to your device's GPS while active. Location data is used in real time to calculate distance and pace. We do not store your GPS route, coordinates, or any location data on our servers. All location processing happens locally on your device. When you stop a run, the location data is discarded.

2i. Usage, Analytics, and Advertising Data

We use Google Analytics (GA4) to understand how users interact with the Service. Google Analytics collects anonymized data such as pages visited, time spent, general geographic region (country/city level), device type, and browser. This data does not identify you personally. You can opt out of Google Analytics by using the Google Analytics Opt-out Browser Add-on.

We use the Meta Pixel (Facebook Pixel) to measure the effectiveness of our advertising on Facebook and Instagram, and to show relevant ads to people who have visited runmateapp.com. The Meta Pixel collects data about your visit (pages viewed, actions taken) and sends it to Meta Platforms, Inc. This data may be used to serve you ads on Facebook or Instagram. Meta's use of this data is governed by Meta's Privacy Policy.

We have enabled Meta's Automatic Advanced Matching feature. When you are logged in to RunMate, your hashed email address and name may be sent to Meta to improve the accuracy of ad measurement and audience matching. This data is hashed (encrypted) before transmission and is not shared in plain text. You can opt out via your Facebook Ad Preferences.

We use Microsoft Clarity to understand how visitors interact with our website. Clarity collects data such as mouse movements, clicks, scrolls, and page navigation patterns. It may record anonymized session replays for analysis. Clarity automatically masks all text input fields — we do not see what you type into any form. This data is used solely to improve the usability of the Service and is governed by Microsoft's Privacy Policy.

We also collect basic server logs (IP addresses, request timestamps) for security and troubleshooting purposes. These logs are retained for a limited period and are not used for profiling.

3. How We Use Your Data

  • To create and manage your account.
  • To provide you access to your race journal, stats, and badges.
  • To display your public profile and public runs to anyone with the link.
  • To operate the Groups feature and allow group leaders to manage their crews.
  • To review and approve podium submissions for the Podium Wall.
  • To verify Pro upgrade payments and activate or manage your subscription.
  • To send you important service-related communications (e.g., changes to Terms or Privacy Policy).
  • To detect, prevent, and respond to fraud, abuse, or security issues.
  • To improve the Service through anonymized usage analytics.
  • To measure the performance of our advertising campaigns and show relevant ads to past visitors on Facebook and Instagram via the Meta Pixel.

We do not sell your personal data. We use the Meta Pixel to measure ad performance and show relevant ads to visitors on Facebook and Instagram. We do not use your personal run data or race journal entries for advertising purposes.

4. Public vs. Private Content

You control which runs are public. Public runs, your public profile, and approved podium submissions are visible to anyone — including search engines — without logging in. Private runs are visible only to you.

Once public content is indexed by search engines or shared by others, we cannot guarantee its removal from those external sources even after you make it private or delete it.

5. Service Providers

We share your data with the following third-party service providers who process data on our behalf. Each has their own privacy and security obligations:

  • Supabase — authentication, database storage, and backend services. Your account data and run data are stored in Supabase.
  • Cloudflare R2 — primary image storage. Photos you upload (bib, medal, avatar, group banner, podium) are stored in Cloudflare's infrastructure.
  • Cloudinary — legacy image storage. Images uploaded before our migration to R2 may still be served from Cloudinary.
  • Vercel — hosting and content delivery. All web traffic passes through Vercel's infrastructure.
  • Google — OAuth authentication provider. When you sign in with Google, Google's privacy policy applies to that authentication process.
  • Google Analytics (GA4) — anonymized usage analytics. Data is collected per Google's Privacy Policy and may be stored on Google's servers.
  • Meta Platforms, Inc. (Facebook Pixel) — advertising measurement and retargeting. The Meta Pixel collects visit data to measure ad effectiveness and enable retargeting on Facebook and Instagram. Governed by Meta's Privacy Policy.
  • Microsoft Clarity — behavioral analytics including heatmaps and anonymized session recordings. Used to improve usability. All form inputs are automatically masked. Governed by Microsoft's Privacy Policy.

We do not share your personal data with any other third parties except as required by law.

6. Cookies and Tracking

RunMate uses cookies and similar technologies for the following purposes:

  • Authentication: Supabase uses session cookies to keep you logged in.
  • Analytics: Google Analytics uses cookies to track usage patterns. These are anonymized and do not personally identify you. Microsoft Clarity uses cookies and local storage to enable session recording and heatmap analysis.
  • Advertising: The Meta Pixel uses cookies to track visits from Facebook/Instagram ads and enable retargeting. You can opt out via your Facebook Ad Preferences.
  • Preferences: We use localStorage to remember small UI preferences (e.g., whether you dismissed a banner).

You can disable cookies in your browser settings. Disabling authentication cookies will prevent you from staying logged in.

7. Data Retention

We retain your account data and run entries for as long as your account is active. Payment records are retained for a minimum of 3 years for accounting purposes.

If you request account deletion, we will delete your personal data within a reasonable period. Residual copies may remain in backups for a limited time before being purged. Approved podium submissions that have been publicly displayed may be retained in anonymized form.

8. Data Security

We implement reasonable technical and organizational measures to protect your data, including:

  • Row-Level Security (RLS) in our database so users can only access their own data.
  • HTTPS encryption for all data in transit.
  • Authentication exclusively through Google OAuth — we never store passwords.
  • Access controls limiting admin capabilities to authorized accounts only.

No system is completely secure. In the event of a data breach that is likely to result in risk to your rights and freedoms, we will notify affected users as required by applicable law.

9. International Data Transfers

RunMate is operated from the Philippines, but we use service providers whose servers may be located outside the Philippines (including the United States and Europe). By using the Service, you consent to your data being transferred to and processed in these locations. We ensure our service providers maintain adequate data protection standards.

10. Children's Privacy

RunMate is intended for users 18 years of age and older. We do not knowingly collect personal information from anyone under 18. If we become aware that a user is under 18, we will take steps to suspend their account and delete their data promptly. If you believe a minor has provided us with their data, please contact us at support@runmateapp.com.

11. Your Rights Under the Data Privacy Act of 2012

As a data subject under Republic Act 10173 (Data Privacy Act of 2012), you have the following rights:

  • Right to be informed — you have the right to know how your data is being collected and processed. This Privacy Policy fulfills that obligation.
  • Right to access — you can request a copy of the personal data we hold about you.
  • Right to correction — you can update your profile information directly in the app, or request corrections to other data.
  • Right to erasure — you can request deletion of your account and personal data.
  • Right to data portability — you can request a copy of your data in a commonly used format.
  • Right to object — you can object to the processing of your data for analytics or advertising purposes. To opt out of Google Analytics, use the Google Analytics Opt-out Browser Add-on. To opt out of Meta Pixel retargeting, visit your Facebook Ad Preferences. To opt out of Microsoft Clarity, visit Microsoft's Privacy Settings.
  • Right to lodge a complaint — you may file a complaint with the National Privacy Commission of the Philippines if you believe your data privacy rights have been violated.

To exercise any of these rights, contact us at support@runmateapp.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. If changes are significant, we may notify users through the Service. Continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

13. Contact

For privacy-related questions, requests, or concerns, contact us at: support@runmateapp.com

We will respond to privacy requests within a reasonable time and no later than 30 days from receipt.