If a running app is free, what is the catch
Short answer
A free running app is paid for somehow, and the four common answers are advertising, a paid tier, selling hardware, and data. You can usually work out which one applies before you install, because the store privacy label declares whether data is linked to you or used to track you across other companies' apps, and the privacy policy names the categories collected. An app that has not decided yet should say so rather than imply the question is settled.
Somebody is paying for the running app on your phone. If it is not you, the money comes from somewhere else, and that arrangement decides what happens to a year of your location history.
Most of the answer is published before you install.
The four models, plainly
Four common answers. Advertising, a paid tier, hardware and retail, and data. Most apps run a mix. What matters is which one is load bearing, because that is the one that shapes the product.
| Model | How it shows up | Where to check before installing |
|---|---|---|
| Advertising | Ad slots after a run, an advertising identifier request, an ad network inside | The App Store label under used to track you, or the Play data shared list |
| Paid tier | An upgrade screen, features behind a lock, a price on the listing | The in-app purchase list on the store page, and the pricing page |
| Hardware and retail | The publisher sells shoes, watches or equipment and the app markets them | The publisher name, and the marketing section of the policy |
| Data | No ads and no upgrade prompt, but broad collection and named sharing | The sharing section, and the data linked to you section of the label |
A fifth possibility is that the model is not settled yet. That is ordinary for a small app. It becomes a problem when the copy implies the question is closed, a distinction worked through in what free means in a running app.
What a store privacy label already tells you
Start at the label. It is a structured declaration on the listing page. It takes under a minute.
Apple's definition of collection is narrow: to collect is to transmit data off the device in a way that lets the developer or its third-party partners access it for longer than is needed to service the request in real time, per Apple's app privacy details documentation (fetched 2 August 2026).
On the App Store the product page groups what the developer declared under three headings: Data Used to Track You, Data Linked to You, and Data Not Linked to You. Anything listed under the first has answered the advertising question for you. That heading is a defined term, not a judgement. Apple describes tracking as linking user or device data from this app with data collected from other companies' apps, websites or offline properties for targeted advertising or advertising measurement, or sharing data with a data broker, per Apple's user privacy and data use page (fetched 2 August 2026).
Google Play divides the ground differently, and there is no tracking heading to look for. Its Data safety section asks separately about collection, which is data transmitted off the device, and about sharing, which is transfer to a third party, where a third party is any organisation other than the developer and its service providers, per Google's Data safety documentation (fetched 2 August 2026). The listing shows those two answers as separate lists, data collected and data shared, and the gap between them is the part worth reading. If an app ships on both stores, read both listings, because the forms ask different questions and the same company can answer them differently.
Reading a running app privacy policy in five minutes
Do not read it start to finish. Search it for five words and read only what surrounds them.
- ShareFind every sentence containing share, disclose or partner. Both advertising and data models need somebody else to receive something, so they surface here.
- AdvertisSearch the stem, so one pass catches advertising, advertisers and advertisement. No advertising section at all is informative too.
- LocationA running app collects precise location by definition. What you want is whether the track is used beyond showing you your run.
- RetainLook for a stated period. As long as necessary tells you nothing, so a concrete number counts in the app's favour.
- DeleteFind out whether deletion is self-serve or an email request. That matters more than the promise above it.
Two published policies show the spread. Strava's privacy policy states that it may disclose information to marketing partners or third-party advertising networks to promote its services, and lists activity data including geolocation, pace and cadence among what it collects (Strava privacy policy, fetched 2 August 2026). The ASICS policy covering Runkeeper, effective 1 August 2024, states that the company may share limited personal data such as contact information and country with its advertising partners (ASICS privacy policy, fetched 2 August 2026). Neither is hidden. Both were found by searching one word.
Permissions that do not match the feature list
Subtraction is the useful test.
Write down what the app claims to do. Work out the minimum access that needs. Then look at what is left over.
- Precise location in a run tracker is expected. Precise location in an app with no map and no recording is not.
- Contacts access in an app with no friends feature and no invite flow.
- Background location in an app that only displays finished runs.
- An advertising identifier, no ads.
That last one is checkable on Android before you install. Apps targeting Android 13 and later must declare the advertising ID permission in their manifest in order to access it, per Google's advertising ID documentation (fetched 2 August 2026). An app that declares it while showing no ads is running attribution, or sharing with a network. Or keeping the option open. Leftovers are not proof. They are the questions you take back to the policy.
Advertising identifiers and third party analytics
The advertising identifier is the join key. It lets one company's record of you meet another company's record of you, which is the behaviour those tracking definitions describe.
Both platforms hand you a switch. On iOS 14.5 and later an app must ask through the App Tracking Transparency framework before it can track you or read the advertising identifier, and without that permission the identifier reads as all zeros, per Apple's user privacy and data use page (fetched 2 August 2026). Google describes the Android advertising ID as user resettable and user deletable, and says that once a user deletes it, attempts to access it receive a string of zeros (Google's advertising ID documentation, fetched 2 August 2026).
That gives you an experiment, not an argument.
Decline the tracking prompt. Reset or delete the advertising ID, then use the app for a week. If nothing changes, the identifier was not load bearing. If the app degrades or nags, you have learned which model you are in.
Third-party analytics is a separate question. An analytics service is not an ad network, and many teams use one to find out which screen people abandon. It is still a second company receiving events keyed to a device. The policy should name it.
A worked example, held to the same test
Runflake faces the same checks.
It is the app this site publishes. There are no advertising SDKs, no third-party analytics SDKs and no third-party crash reporting service in it. Tracking is declared false for every data type and the tracking-domains list is empty.
That is not the same as measuring nothing. Usage telemetry is collected under a random device-scoped id, sent only to the app's own database table, and coordinates and heart-rate keys are actively stripped before it is sent. Crash reports ride inside that same telemetry stream and carry only the phase, a hash of the message, and a frame count. The original text, coordinates and heart-rate data stay on the phone.
Put the label questions to it. The location answer comes in two halves. Runflake's App Store privacy label declares precise location as collected and linked to your account, and declares map tile traffic separately as coarse location that is not linked. The published privacy policy says the same thing at greater length: the GPS track and its summary are uploaded, and withdrawing location consent stops further uploads while runs already recorded stay on the phone. While you are signed out, nothing about your runs reaches the server, though the telemetry and the map tile traffic described above still happen.
Only two outside companies can receive anything at all. Map tiles are the one thing that leaves to a third party with no consent gate: drawing the map sends viewport tile coordinates and your IP to an outside map host, with no account identifier attached. The other is the identity provider you pick if you sign in. That is the whole list, which is the kind of sentence worth demanding from any app you apply this test to.
On the money question: there is no in-app purchase or subscription SDK in the app, and there is no paid tier today. Every feature is available today, and while payments are switched off the server feature check returns true for every feature and every user. What the app records and what it declines to record is set out in what this app does and does not do.
What an honest answer sounds like when the model is undecided
An undecided model is not a scandal. It is a fact about a young product, and its honest form is a sentence with a boundary attached, not a promise about all future time.
Unbounded promises are the tell in the other direction. A pledge that an app will always cost nothing is a claim about a company's entire future, made by people who cannot see it, and reversing it after publication is a store compliance question.
The scoped version is duller and more useful. Runflake is free at launch. If paid features are introduced later, the price and terms are stated before anyone is charged. That has an edge, and an edge is what you hold a company to. The terms sit at the terms page and the collection detail in the privacy policy.
Apply the same standard to whatever you install next. Read the label first, search the policy for share, advertis, location, retain and delete, then set what is left over against the feature list. An app that names who receives what has answered the question. An app that only describes how much it respects you has not.
Common questions
- Does a free running app always sell my data?
- No. Advertising, a paid tier and hardware sales are all common ways to fund a free app, and many of them sell nothing. The way to tell is the sharing section of the privacy policy together with the tracking entries on the App Store label and the data shared list on Google Play.
- What is the fastest single check before installing?
- On the App Store, open the privacy label and look at whether any data type sits under Data Used to Track You, because tracking is a defined term there. Google Play has no equivalent heading, so the first look on Android is the Data safety section, where data collected and data shared are listed separately.
- Is an app with no advertising identifier automatically safer?
- Not automatically. It rules out one common model, but an app can still share broadly with named partners or hold your location history for years, so read the sharing and retention lines as well.