Privacy policy
Last updated: 4 November 2026
This is an English translation for convenience. In case of any difference, the French version of this page prevails.
In short: RunRunFar collects what it needs to run the game, and nothing more. The track of your runs is kept in a lightened form to display its map; other players never see it with your start or your finish, and you can hide it. No advertising, no reselling, no tracking. You can delete your account at any time from the app.
1. Who is responsible for your data?
Mountain Duck Studio (a French SAS currently being registered), which publishes RunRunFar (see the legal notice), reachable at contact@runrunfar.com.
2. What data, and why?
| Data | What it is used for | Legal basis |
|---|---|---|
| Account: first name, last name, username, email address, password (stored encrypted, never in clear text), home town | Creating and securing your account, attaching you to your town, sending you a link if you forget your password, contacting you about your account | Performance of the contract (the terms of use) |
| Location during a run (GPS), or the GPX/FIT file you import | Measuring your kilometres and knowing whether they were run inside your town or outside it. The track is sent to the server and split along town boundaries. A lightened version (at most 500 points, without the time of each point or the altitude) is kept to display the run's map (see 3). On Android, recording continues with the screen off as long as a notification is shown, and stops when you finish the run: the app never asks for permanent background location. | Performance of the contract, with the permission you grant in iOS or Android |
| Motion sensors during a live run, on iPhone only (if you allow it): share of the time recognised as driving or cycling, number of steps and cadence | Checking that a run was really run. Only this summary of a few figures is sent with the run. The Android app does not read these sensors. | Legitimate interest (fair play), with the permission you grant in iOS |
| Imported .fit or .gpx file, as is | Checking it has not been altered (dates, checksums). It is only kept if the run goes to review (see below), until the decision. | Legitimate interest (fair play) |
| Strava data (if you link your Strava account): see section 4 | Importing your runs into the game, and writing the survival report if you asked for it | Your consent, given by linking Strava and then accepting sharing in the game |
| Watch data (if you link your Suunto or Garmin account): see section 5 | Importing your runs into the game | Your consent, given by linking your account |
| Notification token of your device, and the notification types you have unticked. On Android, game notifications do not exist yet: no token is created or sent. | Sending you the game's notifications (attacks, messages, objects…) | Your permission in iOS |
| Location at sign-up (if you accept) | Suggesting your town. Nothing is stored. | Your permission in iOS or Android |
| Summary of each run: start, end, duration, distance inside and outside your town, average speed, maximum distance from home, towns crossed and kilometres run in each | Computing your earnings and your town's, the rankings, the objects brought back, showing passages through each town (see 3), and detecting cheating. A run that looks abnormal (speed, car, walking, altered file) is only credited after review by the team, who may then look at its track, its file and its figures. | Performance of the contract; legitimate interest (fair play) |
| Daily step count (if you allow it): on iPhone, read from Apple's Health app; on Android, read directly from the phone's step counter, as physical activity | Turning your steps into resources for your town. Only the day's total is sent. RunRunFar writes nothing to Health, reads no other health data, and connects to no health service on Android. | Your permission in iOS or Android |
| Messages to the team (Messages tab): their text, the date, and the app version, system version and device model used | Answering your questions, fixing the bugs you report, studying your ideas. You are notified by email when the team replies. | Performance of the contract; legitimate interest (improving the service) |
| Messages between players: the text, the date, the author; your reports and the players you block | Running your town's chat room and private messages; moderating exchanges (a reported message is reviewed by the team) | Performance of the contract; legitimate interest (player safety) |
| Game data: resources, buildings, loot, invasion results | Running the game | Performance of the contract |
Where your visit to the website came from: the source of the shared link you arrived through (for example ?utm_source=…), or failing that the name of the site you came from (the domain only, never the page), and an identifier drawn at random by your browser. If you sign up on the website, this source is attached to your account. | Knowing which shares and which sites bring players (how many visits, downloads, sign-ups). No IP address, no cookie, no sharing with third parties; nothing is recorded for a player already logged in. | Legitimate interest (website audience measurement, limited to this use) |
| Website traffic: the page of the site you open (its name only, for example “home” — never the full address nor what you do there), how many times you open it in a day and how long you stay, with the same random identifier as above. Nothing is recorded from the Android app. | Knowing whether the site is visited and which pages are useful. No IP address, no cookie, no third-party tool or sharing; figures are only read aggregated by day and by page. | Legitimate interest (website audience measurement, limited to this use) |
| Technical data: login tokens, date of last login; irreversible fingerprint of the IP address in case of repeated login errors; host logs | Keeping you logged in, protecting accounts against password guessing, keeping the service secure | Legitimate interest (security) |
Data from Health, and the step count read on Android, are never used for advertising nor shared with third parties.
3. What other players see
Your username, your portrait, your town, your kilometres and your rank in the leaderboards are visible to other players, in the app and on the website. Your first name, last name and email address are never displayed. So pick a username that does not reveal your identity if you prefer to stay discreet.
Your passages through other towns are visible to other players: when a run crosses a town that is not yours, players can see, from that town's page, that you passed through, the day and time of the run, the kilometres run in the town, and the distance and duration of the run (except for a run coming from Strava, see 4). Likewise, each object you bring back from a town shows, in the Forge, who brought it back, when, and from which run. The map of your runs: you see the full track of your runs. Other players can see a run's map from those same pages, but without its first and last 300 metres, so as not to reveal where you start from. You can hide a run's map with one tap, or all your maps at once (Profile › Account and privacy › “Always hide my maps”): other players then see nothing of it. A run coming from Strava is never shown to other players: neither its map, nor its distance, nor its duration. If you do not want your passages to be visible, avoid running outside your town with RunRunFar, or write to us to have them erased.
If you refer a friend or are referred, your username and portrait appear in your referrer's list or your referrals' list, and among your town's recruiters.
Your messages in your town's chat room are read by the runners of your town; your private messages, by their recipient. The team may read a message reported to it, together with the few messages before it, to decide whether it breaks the rules.
4. Strava
Linking your Strava account is optional. You do it from the app (Activity › Strava), and you choose on Strava's screen which rights you grant.
- What RunRunFar reads: the list of your activities (including private ones, so that your private runs count too), and for each run you import: its GPS track, its times, its distance, its moving time, its type (run, ride…) and your watch's cadence. Your Strava first name, last name and photo, to show you which account you are linked to.
- What RunRunFar writes: only if you ask for it (the “Survival report” box, which you can untick at any time), a short report added below the description of your imported runs. Your own text is never changed.
- Your agreement to sharing in the game: once Strava is linked, RunRunFar explicitly asks you to accept that the kilometres of your Strava runs count for your town and appear, with your username, in what other players see (see below). Until you accept, no Strava run is read. You can withdraw this agreement at any time from the app's Strava page: your next Strava runs are then no longer imported.
- Who sees them: you alone. Data coming from Strava is never shown to other players: neither the map, nor the time, nor the distance, nor the duration of your Strava runs. Other players only see their effects in the game: the VO₂ earned by your town, your rank and kilometres in the leaderboards, and, in a town you crossed, your passage with the kilometres that counted there and the Horde it woke. The team may look at a run to review it.
- What we do not do with it: no reselling, no sharing with third parties, no advertising, and no use in any artificial intelligence tool.
- How long: your Strava tokens as long as the link exists; an activity's type and cadence, 7 days at most; the report log, 30 days. The runs you sent to your town remain game results, visible to you alone.
- Unlinking Strava: from the app (Activity › Strava › Disconnect), or from Strava's settings (My Apps). Access is removed and whatever we kept from Strava is erased. Deleting your RunRunFar account also unlinks Strava.
Strava processes your data under its own privacy policy. RunRunFar is neither developed nor sponsored by Strava.
5. Connected watches (Suunto, Garmin)
Linking your watch account is optional. You do it from the app (Profile › Watch), then sign in with Suunto or Garmin, who ask you to accept the sharing.
- What RunRunFar receives: your running workouts and, for each one, its original file (GPS track, times, distance, duration, type, cadence and heart rate), plus an identifier of your Suunto or Garmin account to link the workouts to your RunRunFar account. Other activities (cycling, swimming…) are ignored.
- What it is used for: only to compute what your runs earn in the game, like a manually imported run: kilometres inside and outside your town, VO₂ earned, towns crossed. The full track is split and then discarded; only the run summary and its lightened map are kept (see 2 and 3).
- Who processes it: RunRunFar alone, on its server hosted by OVH in France (see 6). This data is neither sold nor shared with any third party, is not used for advertising, and is processed by no artificial intelligence tool nor used to train any model.
- Nothing is written to Suunto or Garmin.
- How long: your access tokens as long as the link exists; the list of your recent workouts, a few hours in cache; runs sent to your town, like any run (see 7).
- Unlink your watch and withdraw your consent: at any time from the app (Profile › Watch › Disconnect), or from your Suunto or Garmin Connect account. Access is removed and what we kept from that account is erased. Deleting your RunRunFar account also unlinks your watch. To access, correct, export or erase your data, see section 10.
Suunto and Garmin process your data under their own privacy policies. RunRunFar is neither developed nor sponsored by Suunto or Garmin.
6. Who receives your data?
Nobody buys it and we do not sell it. It is hosted by OVH, in France, acting as a processor. We transfer no app data outside the European Union, apart from notifications (Apple) and Strava if you link it. Your watch data (Suunto, Garmin) is passed on to no one.
Notifications go through Apple's notification service (APNs), which receives your iPhone's token and the notification text. If you link Strava, Strava receives the survival report you asked for.
During the test phase, Apple (TestFlight) may receive the crash reports and feedback that you choose to send, under its own terms.
The Android app installed from the Google Play Store is distributed and updated by Google, which then sees your Google account and your device, and may receive the crash reports your phone sends, under Google's terms. Installed from our website, it goes through no intermediary: the file is downloaded from www.runrunfar.com, hosted in France, and does not update itself.
On the website, your browser downloads fonts from Google Fonts, a library from cdnjs (Cloudflare) and map tiles from OpenStreetMap. These services see your IP address, as with any web page.
7. How long?
- Account, runs, steps, game data, messages to the team and messages between players: as long as your account exists. A message you withdraw, or that the team deletes, is no longer visible to anyone. Everything is erased immediately when you delete your account.
- Inactive accounts: deleted after 3 years without logging in.
- Full GPS track of a run: the time of the calculation, a few seconds. Lightened track (map): as long as the run exists, that is, until your account is deleted.
- Imported .fit or .gpx file: the time of the upload; if it goes to review, until the team's decision.
- Strava data: see section 4. Watch data: see section 5.
- Fingerprints of IP addresses linked to login errors: 24 hours at most.
- Where your visit came from: the source is kept 30 days in your browser, the random identifier 13 months; visits recorded on the server are erased after 13 months. Once attached to your account, the source is erased with it.
- Login tokens: 90 days, or until you log out.
- Password reset link: 1 hour, usable once. Only an irreversible fingerprint of it is kept.
Your town, however, remains: its buildings and its total kilometres belong to its community and contain no data about you.
8. Storage on your device
On iPhone, the app keeps your login token in the iOS keychain, and a copy of your town and your runs so it can display them offline. On Android, the token is kept in the app's private storage, which other apps cannot read, and a run in progress is written as it goes into a file in the same storage: it lets you recover your run if the phone interrupts it, and it is erased as soon as the run is sent or abandoned. None of this leaves the phone by itself. The website keeps in your browser's local storage your login token and, if you arrived through a shared link or from another site, that source (30 days) with a random identifier (13 months), which only serve to know what brings players and which pages are visited (see 2). You can erase them at any time by clearing the site's data in your browser. We use no cookies, neither advertising nor audience measurement, and no third-party measurement tool. The language you pick with the flags at the top of the page is also remembered in your browser's local storage.
9. Security
All exchanges go over HTTPS. Passwords are hashed with bcrypt. Repeated login attempts are blocked.
10. Your rights
You can at any time access your data, correct it, have it erased, get it back in a readable format, object to a processing or ask for it to be restricted.
- Delete your account: in the app, Profile → Account and privacy → Delete my account. It is immediate. Without the app, see the Delete my account page.
- Everything else: write to contact@runrunfar.com from your account's email address. Answer within one month.
- Withdraw a permission (location, Health, physical activity, motion, notifications): in iOS Settings or Android Settings, at any time.
- Unlink Strava: see section 4. Unlink your watch: see section 5.
If you believe your rights are not respected, you can lodge a complaint with the French data protection authority, the CNIL, or with the authority of your own country.
11. Minimum age
RunRunFar is reserved for people aged 15 or over. If you learn that a younger child has created an account, write to us: we will delete it.
12. Changes
If this policy changes significantly, we will let you know in the app before the change applies. The date at the top of the page shows the latest version.