Privacy policy

We regularly ask Strava for your recent activities. Strava's reply includes a lot more than we need — things like the activity name, elapsed time, elevation, the start and end coordinates and so on.

We read two fields out of all of those, distance and the date, add the day's activities together, and discard the rest of the data.

• Your name, email address (optional), profile picture and Strava account id, so we know whose runs are whose.
• One row per day with your total distance. This is the history behind your progress and your charts.
• Your Strava access and refresh tokens, so the update can run without you logging in again.
• Which routes you have picked, how far along them you are, and any groups you belong to.
• If you subscribe: a Stripe customer id and whether the subscription is active.
• A record of which emails we have sent you, so we don't send the same one twice.

Everything we keep is encrypted at rest and travels over an encrypted connection, which our hosting provider Cloudflare handles for us.

By default, only you. Your dashboard, your history and your route progress are behind your login.

If you join a group, the other members of that group can see your name, your picture and your contribution to the group's progress — that is the entire point of a group, but it is worth being clear that joining one makes those things visible to the people in it. Leaving the group ends that.

If you share a progress image using the share button, that image is created in your browser and handed to whichever app you chose. Where it goes after that is up to you, not us.

We do not sell your data, we do not share it for advertising, and we do not hand it to anyone except the services listed below that we need to run the app.

The only cookie we set is the one that keeps you logged in. Since we don't set any others, there is nothing to ask consent for — which is why we don't interrupt you with a cookie banner.

We count visits, using Pirsch, a privacy friendly German analytics service built to work without identifying anyone. It records which page was viewed, the page that linked you here, your country, and the rough type of device and browser. It stores no cookie and nothing else on your device, and it cannot follow you to other websites.

If you would rather not be counted at all, a tracker blocker or your browser's “do not track” setting will stop it, and the app works exactly the same either way.

If you share your email with us we send a welcome email when you sign up, a monthly progress report, and a note when you finish a route. You can turn the reports off in your profile settings at any time.

Your address is used for these emails and for support replies.

Subscriptions are handled entirely by Stripe. Your card number never touches our servers — we never see it.

All we keep is the customer id Stripe gives us and whether your subscription is currently active.

Running the app means a handful of other companies necessarily handle some of your data:

• Strava — where your runs come from, and who you log in with.
• Cloudflare — our database, file storage and the servers the app runs on.
• Vercel — hosts the website you are reading this on.
• Stripe — payments and subscriptions.
• Resend — delivers our emails.
• Mapbox — draws the maps in your browser.
• Pirsch — counts visits, as described above. Hosted in Germany, so your data stays in the EU.

Your distance history stays for as long as you have an account — a route that takes three years to finish needs three years of history behind it.

When you delete your account it all goes immediately. The one exception is Stripe: if you ever paid us, Stripe keeps the invoice records it is legally required to keep, and that is out of our hands.

Open your account menu and choose Delete account. Note that deletion is instant and irreversible.

Deleting your account:

• Revokes our access on Strava's side, so we disappear from your connected apps and our tokens stop working;
• Cancels any active subscription;
• Deletes your profile, your entire distance history, your tokens, your routes, your group memberships, your email records and the map image of your progress.

You can also just disconnect us from your Strava settings. We stop receiving anything new the moment you do.

You log in through Strava, so we never see or store your password. Everything travels over HTTPS, and your Strava tokens are only ever held on the server.

We are a small operation and won't pretend to be a bank, but the less we keep, the less there is to go wrong — which is a good part of why we keep so little.

In the Long Run is run by Globex Corporation in Oslo, Norway, so European data protection law (the GDPR) applies to you wherever you are.

We handle your running data because you asked us to track your progress, and we send optional reports because you opted in. You are entitled to a copy of everything we hold, to have anything wrong corrected, to have it all deleted, and to complain to your data protection authority if you think we have mishandled it.

The delete button covers the deletion case instantly. For anything else, email us and we will sort it out.

We will update the date at the top. If a change actually affects what we collect or who sees it, we will tell you by email rather than quietly editing this page.

Questions, or something here that doesn't match what you expected? Email [email protected] and a human will answer.