Privacy Policy

RunMap is a free tool that visualizes your Strava activities on an interactive world map. You connect your Strava account, we import your activity data, and you get a personal map with geographic badges and a shareable profile.

When you connect your Strava account, we access and store:

• Your Strava athlete ID, name, and profile picture
• Activity data: sport type, date, distance, elevation, duration, GPS start coordinates, and route polylines
• Derived data: country, city, and region determined from GPS coordinates

We do not access your heart rate, power data, private notes, or any data beyond what is needed to render your map and badges.

• Display your activities on your personal world map
• Calculate and award geographic badges
• Generate your public profile page (if you choose to share it)
• Keep your data in sync via Strava webhooks

We do not sell, rent, or share your personal data with third parties. We do not use your data for advertising or analytics profiling.

Your data is stored in a secure PostgreSQL database hosted by Supabase with row-level security enabled and disk-level encryption (AES-256). Your Strava access tokens are only used server-side to sync your activities and are never exposed to the browser. Session authentication uses signed HTTP-only cookies.

RunMap relies on the following third-party services:

• Strava — for authentication and activity data (Strava Privacy Policy)
• Mapbox — for map rendering and reverse geocoding (Mapbox Privacy Policy)
• Supabase — for database hosting (Supabase Privacy Policy)
• Vercel — for application hosting (Vercel Privacy Policy)

If you set a profile slug, a public page at /u/your-slug will display your world map, activity stats, and earned badges. This page is accessible to anyone with the link. You can change or remove your slug at any time from your settings.

You can delete your account directly from your dashboard settings, or by contacting us. Upon deletion, we will:

• Revoke our access to your Strava account
• Delete your user account and all associated activities
• Remove all badges and statistics

You can also revoke RunMap's access directly from your Strava settings, which will stop all future data syncing.

RunMap uses a single HTTP-only session cookie (runmap_session) to keep you logged in. We do not use tracking cookies, analytics cookies, or any third-party cookie-based services.

We may update this policy from time to time. Changes will be reflected on this page with an updated date. Continued use of RunMap after changes constitutes acceptance of the updated policy.

For any questions about this privacy policy or to request data deletion, reach out at contact@runmap.app.