Privacy Policy

What we collect

Runs and location. Precise location is recorded while a run is active, after you consent. A run is stored on your phone first; the GPS track and its summary are uploaded to our servers so you can recover it and see it on other devices.

Fitness and health. Distance, pace, splits, and cadence from the runs you record. Body weight only if you connect Apple Health on iPhone and consent separately.

Heart rate. A paired watch or chest strap can send heart rate to your phone while you run, and it is shown to you there. Heart rate is not sent to our servers.

Account. Email address and a user identifier when you sign in, the display name you choose, your birth year, a two letter country code used to place you on a country board, and the app settings kept with your account, such as units, language, theme, and whether you appear on rankings. Sign in with Apple, Google, or Kakao sends you to that provider, which returns an identifier to us.

Content you publish. Routes, reviews, community posts, comments, reports, and the nickname you use on boards.

Profile photo. If you choose one, the picture is resized and re-encoded on your phone, which strips camera metadata such as the location a photo was taken, and the result is stored with your account until you replace or remove it.

Groups. When you create or join a group we store its name, its invite code, and who its members are. While your sharing toggle for that group is on, members see your name, your photo, and a daily summary of each run: the date, distance, time, and pace. Route coordinates and the time of day you ran are not shared. You can turn sharing off per group at any time, or leave the group.

Live runner count. While a run is being recorded, the app tells our server that your account is running right now, once every few minutes. This powers the anonymous runner counters in the app. The signal carries no location and it is deleted when the run ends.

Usage. In app events, an anonymous device identifier, app version, locale, and display settings, used to find crashes and broken flows.

Launch note. If you leave your email address on this website before launch, we keep that address to send a single note when Runflake opens. It is not used for anything else.

Running without an account

You can run without signing in, and your runs are kept on your phone. This does not mean nothing leaves the device: the app creates an anonymous identity so your data can be attributed to you, map tiles are requested from a third party map host as you move the map, and features you choose to use, such as rankings or publishing a route, send data to our servers.

Why we use it

To record and show your runs, measure goals and personal bests, rank participants who opt in, publish and discover routes, keep the community usable through reports and blocks, and diagnose failures. We do not sell personal data and do not use it for advertising or tracking across other companies’ apps.

Who else processes it

Supabase Inc. hosts our database, authentication, storage, and server functions. Vercel Inc. hosts this website. OpenFreeMap serves map tiles. Apple, Google, and Kakao process sign in when you choose that method. Resend (Plus Five Five, Inc.) delivers the one email we send to the launch list, and only your email address reaches it. Each processes data only to provide that service to us.

Here is where your data goes and when. Supabase Inc. (a US company; the region that stores the data is Singapore) receives it over encrypted HTTPS as you record and sync runs. Vercel Inc. (a US company; web functions run in Seoul) receives it when you open this website. Resend (Plus Five Five, Inc., United States) receives only your email address, at the moment we send the launch email you asked for. OpenFreeMap (Europe) receives map tile requests while you look at a map, without any account identifier. Apple (United States), Google (United States), and Kakao (Korea) receive data when you sign in that way.

Each recipient keeps the data only while it performs that service, following the retention section below. If you want to reach a recipient, write to us at contact@runflake.com and we will handle it for you.

You may refuse the transfer. Write to contact@runflake.com and we will delete your account and the data attached to it, which stops the transfer. Runflake runs on these providers, so refusing means the account features (run sync, community, sign in) are unavailable to you. Without an account, your runs stay on your phone and never leave Korea.

How long we keep it

Runs, routes, and profile data are kept until you delete them or delete your account. Consent records are kept alongside your account and are removed when the account is deleted. Usage events never carry an account identifier, a name or an email, so there is nothing in them to unlink when you delete your account. Records required by law, such as records of complaints and disputes, are kept for the period that law prescribes.

Deleted data is removed from live systems immediately and from backups within thirty days.

A launch note address is kept until you ask us to delete it at contact@runflake.com.

Your rights

You can view, correct, export, or delete your data, and withdraw any consent, from inside the app or by contacting us. Withdrawing location consent stops uploads; runs already on your phone stay there.

You can also complain to the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Privacy Portal (privacy.go.kr, 118), or the Korean National Police Agency cybercrime unit (ecrm.police.go.kr, 182).

Children

We do not create accounts for children under 14 and we do not knowingly collect personal information from them. Under that age runs are recorded on the device and are not sent to us. The app still sends anonymous usage events, which carry a random device identifier and no name, email, account identifier, location, or heart rate. If you believe a child under 14 has given us personal information, contact us and we will delete it.

Security

Data in transit is encrypted with TLS. Access to production data is limited to the people who need it, row level security separates one runner’s data from another’s, and credentials are held outside the codebase.

Who is responsible

WorkNPLAY Inc. is the controller. Our privacy officer is the Chief Executive Officer, reachable at contact@runflake.com. We will answer within thirty days.

Our location information manager is the Customer Support team, reachable at contact@runflake.com or +82-2-581-3001.

Changes to this policy

We post changes on this page and announce them in the app at least seven days before they take effect, and thirty days ahead when a change reduces your rights.

Change history

2026-09-09: The provider of Runflake changed. The app was transferred from Foo AI Corp. to WorkNPLAY Inc., which is now the company named in the business information below and the controller of your personal data. What we collect, how we use it, and your rights did not change. The people responsible are now identified by role rather than by personal name.

2026-08-20: This document did not change. The date above is shared by the Runflake legal documents, and on that date the location terms recorded that community posts no longer publish a route line.

2026-08-16: Corrected where body weight comes from. On Android nothing is read from the system health store any more, so body weight reaches us only when you connect Apple Health on iPhone.

2026-08-11: Corrected the in-app path for deleting an account. The earlier text sent people to a Settings screen that no longer exists.

2026-08-09: Corrected the children section. Anonymous usage events are sent even when there is no account, which the earlier text denied.

2026-08-07: Added profile photo, groups, and the live runner count to what we collect.

2026-08-05: Removed heart rate from what we collect, because it is recorded on the phone and is not sent to us, and added the app settings kept with your account.

2026-07-31: First published.