Privacy policy

Last updated 6 November 2026 · Draft: this policy may change before the apps' public release.

This policy covers the Run·dere apps for iPhone and iPad and for Android (“the app” or “the apps”), this website (rundere.app), and the Run·dere demo server (demo.rundere.app). “We” and “us” means the Run·dere developer. “Your server” means any Run·dere server you add to the app. Where the iPhone and Android apps differ, this policy says so.

How Run·dere is set up

Run·dere is self-hosted software. There is no central Run·dere service that stores your information. When you use the app, it connects directly to the server address you enter in its settings. Whoever operates that server (usually you) controls the data on it and is responsible for it. If you use a server run by someone else, such as a friend or family member, their practices apply to what you store there.

The apps

What the app sends, and where

Apart from the map and place lookups described below, the app sends information only to your server, over the connection you configure. This includes your sign-in, the trips, activities, captures, packing lists and journal entries you view or change, and any files you choose to share with it. We don't receive a copy.

What stays on your device

Signing out clears your saved session and the offline copy on this device. Deleting the app removes everything it stored on the device. The Android app leaves its data out of Google's cloud backups and device-to-device transfers, so none of it is copied off the phone.

Permissions the app may ask for

• Face ID or Touch ID (iPhone and iPad) or fingerprint, face or screen lock (Android), if you turn on the app lock. The operating system handles the check. The app only learns whether it succeeded; it never receives your face or fingerprint data or your screen-lock code.
• Location, iPhone and iPad, while using the app and only if you allow it. The app uses it to add where you are to a new journal entry, which is saved to your server. To show a short place name such as “Old Town, Albuquerque”, the app asks Apple Maps to look up that spot. Turn off Add my location when writing an entry, or deny the permission, and none of this happens.
• Location, Android, while using the app and only if you allow it (approximate is enough). The Android app uses it in two ways:
  • Add my location on a new journal entry or expense adds where you are to it, and that's saved to your server (if you're offline, it's kept on the phone with the entry until it's sent). To show a short place name, the app asks the phone's built-in geocoder to look up that spot (see below). Turn off Add my location when writing an entry or expense, and none of this happens.
  • What's near me sorts your saved and nearby places by distance. The sorting happens on the phone, and this use of your location isn't sent to your server or to us. The Near me map is centred on where you are, so Google receives requests for map images of that area (see below).
  Deny the permission and none of this happens: entries and expenses are saved without a location, and the Near me list is unsorted.

Apple services the iPhone and iPad app uses

Maps and place-name lookups in the app are provided by Apple Maps. To show a map or look up a place, your device sends the request to Apple, and Apple's privacy policy applies to that. Web links you open from the app load in Safari's in-app browser, which follows your Safari settings.

Google services the Android app uses

Maps in the Android app are provided by Google Maps. To show a map, your phone asks Google for map images of the area on screen, such as a trip's places or, on the Near me map, the area around you. To place a saved spot or a shared Maps link on the map, the app asks the phone's built-in geocoder to look up the place's name and address, which sends that name and address but not your own location. When you use Add my location, the app asks the same geocoder for a short place name for that spot, which sends the spot's coordinates. On most phones that geocoder is provided by Google. Google's privacy policy applies to what Google receives. Sign-in pages and web links you open from the app load in a Custom Tab of your default browser, which follows that browser's settings.

Testing the iPhone and iPad app with TestFlight

The iPhone and iPad app is currently available only to testers we invite through Apple's TestFlight.

• Asking for an invite. If you email us to ask for one, we use your name and email address to send the invite and keep track of who is testing. We keep them until testing ends or you ask us to remove you.
• From TestFlight. Apple shares with us your name and email address as a tester, which version of the app you've installed, how often it's used, crash reports and any feedback or screenshots you choose to send from TestFlight. We use these only to fix problems and improve the app. Apple's privacy policy and TestFlight terms apply to what Apple collects.
• Stopping. You can stop testing at any time in the TestFlight app, or ask us to remove you.

Testing the Android app on Google Play

The Android app is currently available only to testers we invite through Google Play's testing tracks.

• Asking for an invite. If you email us to ask for one, we use your name and email address to send the invite and keep track of who is testing. To let you install the test version, we add the email address of your Google Account to the app's tester list in Google Play Console. We keep it until testing ends or you ask us to remove you.
• From Google Play. Google shares with us, through Play Console, figures about installs and the devices and Android versions the app runs on, crash and “app not responding” reports from phones whose owners have chosen to share usage and diagnostics with Google, and any private feedback you send about the test version from its Google Play page. These reports don't include your trips or other data from your server. We use them only to fix problems and improve the app. Google's privacy policy and Google Play's terms apply to what Google collects.
• Stopping. You can leave the test at any time from the opt-in link or the app's Google Play page, or ask us to remove you.

Your server

Your server may connect to other services to do its work, depending on how its operator has set it up. For example, it may look up weather, exchange rates, places, routes or web search results, or use a language model to help process captures and research. Those connections are configured by, and are the responsibility of, the server's operator. We don't receive the data involved.

If you connect an AI assistant (such as Claude) to your server, you choose what it can access when you sign in to approve it. The trip data it reads or changes is then handled by that assistant's provider under their privacy policy. You can disconnect it at any time under Account → Connected apps on your server.

The demo server

The demo server at demo.rundere.app lets you look around Run·dere, in a browser or the app, without setting up your own server. We operate it.

• It holds fictional sample trips only. Everyone signs in with the same shared demo account, shown on its sign-in page.
• It's read-only. You can view everything, but the server refuses any change, so nothing you type is saved and no one's real information is stored there. Each night the sample trips' dates are moved forward so they stay current.
• It has no email, no AI assistant connections and no language models, and it doesn't send anything to outside services. The only outside requests it makes are for map images (OpenStreetMap) when a trip's PDF is printed.
• Signing in sets a cookie that only keeps you signed in. The demo uses no analytics or tracking.
• The demo server itself doesn't log your visits. The web proxy in front of it keeps short-lived technical logs (IP address, time and the page requested) for up to 14 days, to keep the server running and to block abuse. If an address is blocked for abuse, that record is kept for up to 30 days.
• To see roughly where visitors come from, we count visits by country and region. Those counts don't include IP addresses and can't identify you.

This website

rundere.app is a static website hosted by Netlify. It sets no cookies and uses no analytics. Its fonts and images are served from this site, not from third parties. Netlify processes standard request information, such as your IP address, to deliver the pages and protect the service; see Netlify's privacy policy. Links to the Run·dere source code and documentation go to GitHub, where GitHub's privacy policy applies.

The sign-in page at rundere.app/auth/callback exists only to hand you back to the app after you sign in to your server. It doesn't read, store or forward anything in the link it receives.

Children

Run·dere isn't directed at children under 13, and we don't knowingly collect information from them.

Your choices and rights

Because your travel data is on your server, you can view, correct or delete it there, or ask your server's operator to do so. For anything we hold (only demo-server logs, any emails you send us and, if you're a tester, your TestFlight or Google Play testing details), you can ask us to access or delete it by writing to the address below. Depending on where you live, laws such as Canada's PIPEDA or the EU and UK GDPR may give you further rights, and you can complain to your local data-protection authority.

Changes to this policy

If we change this policy, we'll update the date at the top of this page. If a change affects what an app does with your data, we'll also note it in that app's release notes.

Contact

Questions about privacy: privacy@rundere.app.