Privacy

Controller

The controller responsible for data processing on this website is:

Martin Richter
Raseweg 4b
37124 Rosdorf
Germany

Email: hello@runittogether.com

You can also reach us via our contact form. contact form.

Overview

We process personal data only as far as it is needed to operate and provide RUNITTOGETHER or where there is a legal basis. RUNITTOGETHER is a platform where people find and organise runs together. Below we explain which data we process for which purpose and on which legal basis, and what rights you have.

Your rights

At any time you have the right to:

access to the personal data stored about you (Art. 15 GDPR),
rectification of inaccurate data (Art. 16 GDPR),
erasure of your data (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
objection to processing (Art. 21 GDPR),
withdrawal of a given consent with effect for the future.

An informal message to hello@runittogether.com is enough to exercise these rights. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence.

Account deletion: you can delete your account and the associated data at any time via the settings in the app, or ask us by email to delete it.

Legal bases

We process personal data on the basis of Art. 6(1)(b) GDPR (performance of a contract, e.g. your account and the run features), Art. 6(1)(f) GDPR (legitimate interest, e.g. security and smooth operation), Art. 6(1)(c) GDPR (legal obligations) and, where requested, Art. 6(1)(a) GDPR (consent, e.g. location sharing). The relevant basis in each case is named in the sections below.

Data collection

Cookies and local storage

We do not use advertising or tracking cookies. For operation we use your browser's local storage (localStorage) for strictly necessary purposes: your login token and your settings (e.g. language and display mode). This storage is strictly necessary to provide the service you have expressly requested (§ 25(2) TDDDG); processing is based on Art. 6(1)(f) GDPR.

Server log files

When you access the site, our hosting providers automatically collect information in server log files that your browser transmits (e.g. browser type and version, operating system, referrer URL, time of the request and IP address). This data serves the technically error-free provision and security of the site. The legal basis is Art. 6(1)(f) GDPR.

Registration and account

To use the service you create an account. We process your email address and a password (stored only encrypted as a hash), your name and optionally your city. To confirm your email address we send a verification email. The legal basis is Art. 6(1)(b) GDPR. The data is stored until you delete your account; statutory retention periods remain unaffected.

Profile data

In your profile you can voluntarily add further details: a short bio, your typical pace, languages, how long you've been running and community tags. These are visible to other logged-in users and help decide whether to run together. The legal basis is Art. 6(1)(b) and (f) GDPR.

Run and participation data

When you create runs or take part in them, we process the related data: runs you create (host role), participations and attendance (e.g. the 'I was there' confirmation) and open join requests. Where needed for the purpose, this is visible to other logged-in users. The legal basis is Art. 6(1)(b) GDPR.

Location and area data

A run's area (city/radius) is publicly visible so that runs can be found. The exact meeting point, however, is protected and only visible to confirmed participants and the host. If you use the radius search and allow it, we use your device location once at the moment of the search to show you runs near you; the location is not stored. Sharing is optional (Art. 6(1)(a) GDPR); without it you can still search manually by city or area. Distance is calculated only from coarse area coordinates, never the exact meeting point. The purpose is to help you find runs near you (Art. 6(1)(b) and (f) GDPR).

Reporting, blocking and feedback

If you report content or people, block someone or send us feedback, we process the details you provide to prevent misuse and keep the platform safe and functional. The legal basis is Art. 6(1)(f) GDPR.

Getting in touch (contact form and email)

If you contact us via the contact form or by email, we process your details (name, email address, message) to handle your request. The legal basis is Art. 6(1)(b) GDPR where the request relates to a contract, otherwise Art. 6(1)(f) GDPR. We also use your email address to send you a confirmation of receipt. The data stays with us until the purpose no longer applies or you ask for deletion.

Hosting and processors used

To run the service we use the following processors. Where required, data processing agreements are in place with them. For transfers to the USA we rely on appropriate safeguards (EU standard contractual clauses or the EU-US Data Privacy Framework, where the provider is certified).

Frontend hosting: Vercel

Our website is hosted by Vercel Inc. (USA). When a page is accessed, Vercel processes technical access data (including IP address). The legal basis is Art. 6(1)(f) GDPR. Privacy notice: https://vercel.com/legal/privacy-policy

Backend hosting: Render

We run the application logic at Render Services, Inc. (USA). The data required to provide the service (including account and usage data) is processed. The legal basis is Art. 6(1)(b) and (f) GDPR. Privacy notice: https://render.com/privacy

Database: Neon

We use the database of Neon Inc. (USA) to store account and usage data. The legal basis is Art. 6(1)(b) GDPR. Privacy notice: https://neon.com/privacy-policy

Email delivery: Resend

To send system emails (e.g. verification, password reset, notifications, contact confirmation) we use Resend (USA). Your email address and the content of the respective message are processed. The legal basis is Art. 6(1)(b) and (f) GDPR. Privacy notice: https://resend.com/legal/privacy-policy

Domain and DNS: Cloudflare

The domain and DNS management run via Cloudflare, Inc. (USA). Technical connection data (including IP address) may be processed. The legal basis is Art. 6(1)(f) GDPR. Privacy notice: https://www.cloudflare.com/privacypolicy/

Transfer to third countries

Some of the providers named are based in the USA. Personal data is only transferred there on the basis of appropriate safeguards under Art. 44 ff. GDPR, in particular EU standard contractual clauses or a certification under the EU-US Data Privacy Framework. Details can be found in the providers' privacy notices linked above.

SSL/TLS encryption

For security reasons this website uses SSL or TLS encryption. You can recognise an encrypted connection by the 'https://' in your browser's address bar.

Objection to advertising emails

We hereby object to the use of contact data published under the legal-notice obligation for sending unsolicited advertising.

Last updated: October 2026