Privacy Policy

What we collect

Runs and location. Precise location is recorded while a run is active, after you consent. A run is stored on your phone first; the GPS track and its summary are uploaded to our servers so you can recover it and see it on other devices. Separately from runs, opening the courses screen reads your approximate position once and asks our servers only for the area around it.

Weather for a run. From 2026-09-21, when you start an outdoor run with location consent on, the app looks up the weather forecast for your starting area once and keeps the temperature and humidity with that run. The area is rounded to about one kilometre before it leaves your phone.

Fitness and health. Distance, pace, splits, and cadence from the runs you record. Body weight only if you connect Apple Health on iPhone and consent separately.

Heart rate. A paired watch or chest strap can send heart rate to your phone while you run, and it is shown to you there. Heart rate is not sent to our servers.

Account. Email address and a user identifier when you sign in, the display name you choose, your birth year, a two letter country code used to place you on a country board, and the app settings kept with your account, such as units, language, theme, and whether you appear on rankings. Sign in with Apple, Google, or Kakao sends you to that provider, which returns an identifier to us.

Content you publish. Routes, reviews, community posts, comments, reports, and the nickname you use on boards.

Profile photo. If you choose one, the picture is resized and re-encoded on your phone, which strips camera metadata such as the location a photo was taken, and the result is stored with your account until you replace or remove it.

Groups. When you create or join a group we store its name, its invite code, and who its members are. While your sharing toggle for that group is on, members see your name, your photo, and a daily summary of each run: the date, distance, time, and pace. Route coordinates and the time of day you ran are not shared. You can turn sharing off per group at any time, or leave the group.

Live runner count. While a run is being recorded, the app tells our server that your account is running right now, once every few minutes. This powers the anonymous runner counters in the app. The signal carries no location and it is deleted when the run ends.

Usage. In app events, an anonymous device identifier, app version, locale, and display settings, used to find crashes and broken flows.

Launch note. If you leave your email address on this website before launch, we keep that address to send a single note when Runflake opens. It is not used for anything else.

Running without an account

You can run without signing in, and your runs are kept on your phone. This does not mean nothing leaves the device: the app creates an anonymous identity so your data can be attributed to you, map tiles are requested from a third party map host as you move the map, and features you choose to use, such as rankings or publishing a route, send data to our servers.

Why we use it

To record and show your runs, measure goals and personal bests, rank participants who opt in, publish and discover routes, keep the community usable through reports and blocks, and diagnose failures. We do not sell personal data and do not use it for advertising or tracking across other companies’ apps.

Who else processes it

Supabase Inc. hosts our database, authentication, storage, and server functions. Vercel Inc. hosts this website. OpenFreeMap serves map tiles. MET Norway (the Norwegian Meteorological Institute) provides the weather forecast for your runs from 2026-09-21. Apple, Google, and Kakao process sign in when you choose that method. Resend (Plus Five Five, Inc.) delivers the one email we send to the launch list, and only your email address reaches it. Each processes data only to provide that service to us.

Here is where your data goes and when. Supabase Inc. (a US company; the region that stores the data is Singapore) receives it over encrypted HTTPS as you record and sync runs. Vercel Inc. (a US company; web functions run in Seoul) receives it when you open this website. Resend (Plus Five Five, Inc., United States) receives only your email address, at the moment we send the launch email you asked for. OpenFreeMap (Europe) receives map tile requests while you look at a map, without any account identifier. From 2026-09-21, MET Norway (Norway) receives your starting area rounded to about one kilometre, over encrypted HTTPS, once near the start of an outdoor run and only while location consent is on, without any account identifier. Apple (United States), Google (United States), and Kakao (Korea) receive data when you sign in that way.

Each recipient keeps the data only while it performs that service, following the retention section below. If you want to reach a recipient, write to us at contact@runflake.com and we will handle it for you.

You may refuse the transfer. Write to contact@runflake.com and we will delete your account and the data attached to it, which stops the transfer. Runflake runs on these providers, so refusing means the account features (run sync, community, sign in) are unavailable to you. Without an account, your runs stay on your phone and never leave Korea.

How long we keep it

Runs, routes, and profile data are kept until you delete them or delete your account. Consent records are kept alongside your account and are removed when the account is deleted. Usage events never carry an account identifier, a name or an email, so there is nothing in them to unlink when you delete your account. Records required by law, such as records of complaints and disputes, are kept for the period that law prescribes.

Deleted data is removed from live systems immediately and from backups within thirty days.

A launch note address is kept until you ask us to delete it at contact@runflake.com.

Your rights

You can view, correct, export, or delete your data, and withdraw any consent, from inside the app or by contacting us. Withdrawing location consent stops uploads; runs already on your phone stay there.

You can also complain to the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972), the Privacy Portal (privacy.go.kr, 118), or the Korean National Police Agency cybercrime unit (ecrm.police.go.kr, 182).

Children

We do not create accounts for children under 14 and we do not knowingly collect personal information from them. Under that age runs are recorded on the device and are not sent to us. The app still sends anonymous usage events, which carry a random device identifier and no name, email, account identifier, location, or heart rate. If you believe a child under 14 has given us personal information, contact us and we will delete it.

Security

Data in transit is encrypted with TLS. Access to production data is limited to the people who need it, row level security separates one runner’s data from another’s, and credentials are held outside the codebase.

Who is responsible

WorkNPLAY Inc. is the controller. Our privacy officer is the Chief Executive Officer, reachable at contact@runflake.com. We will answer within thirty days.

Our location information manager is the Customer Support team, reachable at contact@runflake.com or +82-2-581-3001.

Changes to this policy

We post changes on this page and announce them in the app at least seven days before they take effect, and thirty days ahead when a change reduces your rights.

Change history

2026-10-07: This policy did not change. The date above is shared by the Runflake legal documents, and on that day the terms of service reworded the paid features section.

2026-09-21: Added MET Norway (the Norwegian Meteorological Institute), which provides weather forecasts, to the list of recipients. When an outdoor run starts, the app sends your starting area rounded to about one kilometre, without any account identifier, and keeps the forecast temperature and humidity with the run. This takes effect on 2026-09-21, and nothing is sent to MET Norway before then.

2026-09-16: The business information below now also lists the name this company trades as, Flowlab Works. That is the developer name shown on our app store accounts, and it belongs to WorkNPLAY Inc., the same company already named as the provider. Nothing else changed: what we collect, how we use it, who receives it, and your rights are the same, so this takes effect immediately.

2026-09-14: A correction. The earlier text described location collection as happening only during a run, but showing courses near you reads your position separately when you open that screen. That is now stated. Nothing about what we collect or why has widened; the text now describes what the app already did, so it takes effect immediately.

2026-09-09: The provider of Runflake changed. The app was transferred from Foo AI Corp. to WorkNPLAY Inc., which is now the company named in the business information below and the controller of your personal data. What we collect, how we use it, and your rights did not change. The people responsible are now identified by role rather than by personal name.

2026-08-20: This document did not change. The date above is shared by the Runflake legal documents, and on that date the location terms recorded that community posts no longer publish a route line.

2026-08-16: Corrected where body weight comes from. On Android nothing is read from the system health store any more, so body weight reaches us only when you connect Apple Health on iPhone.

2026-08-11: Corrected the in-app path for deleting an account. The earlier text sent people to a Settings screen that no longer exists.

2026-08-09: Corrected the children section. Anonymous usage events are sent even when there is no account, which the earlier text denied.

2026-08-07: Added profile photo, groups, and the live runner count to what we collect.

2026-08-05: Removed heart rate from what we collect, because it is recorded on the phone and is not sent to us, and added the app settings kept with your account.

2026-07-31: First published.